text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Bitcoin Mini Trust ETF

ticker: BTC


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.

secItem: Item 1C


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: During the period ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Ethereum Staking Mini ETF

ticker: ETH


companyName: Grayscale Bitcoin Trust ETF

ticker: GBTC


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Ethereum Staking ETF

ticker: ETHE


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Trust. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping the Trust's and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Invesco's information security program is led by its Chief Information Security Officer who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and the Trust's information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is Invesco's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Invesco's Board of Directors oversees cybersecurity risk and receives updates at a minimum, of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.'s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks the Trust faces from cybersecurity threats, please see Item 1A. Risk Factors.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Trust. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Ethereum ETF

ticker: QETH


text: Invesco's information security program is led by its Chief Information Security Officer who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats and employee, health care professionals, or HCPs, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, independent privacy assessors, and computer security firms to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Apellis Pharmaceuticals, Inc.

ticker: APLS


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives quarterly updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Head of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees, HCPs and patients to address cybersecurity risks. The Head of Information Technology cybersecurity function brings security credentials and expertise, with broad global cybersecurity and compliance experience in life science, healthcare, and federal government. In addition to our cybersecurity team, a managed security service provider provides us with additional coverage to monitor, detect and respond to threats and vulnerabilities.


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with cybersecurity information and training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. Our third-party risk management program is integrated with global sourcing and procurement, and requires vendor risk assessments, incident reporting, and data protection controls. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: In the ordinary course of business, we provide proprietary content and we collect, store and use confidential information (including, but not limited to, personal customer information and data) in connection with providing our products and engaging our employees and contractors. We have developed systems and processes designed to protect such content and information and we maintain cybersecurity insurance coverage. Our Board of Directors (the "Board") and management recognize the critical importance of protecting the confidentiality and integrity of such information and data and maintaining the trust and confidence of our members, business partners, employees, contractors and shareholders, as well as complying with applicable regulatory requirements and contractual obligations.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: The Board and its committees actively oversee the Company's risk management program. Cybersecurity threats and related risks are an important component of the Company's overall approach to enterprise risk management ("ERM"). We annually examine our cybersecurity program with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology (NIST), as guidelines. Cybersecurity risk management is a Company-wide initiative. In general, the Company seeks to address cybersecurity risks through a comprehensive, multi-disciplinary approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the elements of the Company's overall ERM program, the Company's cybersecurity program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which is regularly updated on cybersecurity matters by the Company's Chief Information Security Officer ("CISO"), other members of management, and relevant representatives from management's committees and the Company's Internal Audit function. • Collaborative Approach: The Company has implemented a comprehensive, multi-disciplinary approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments by internal and third-party experts, and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans pursuant to the NIST framework that fully address the Company's response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management: The Company has implemented a risk-based evaluation process to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training and education for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the regular evaluations of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including tabletop exercises and vulnerability testing, focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on certain of our cybersecurity measures, including audits and penetration testing. For example, we annually engage qualified third-party auditors to independently assess and attest to and/or provide certifications of compliance with the HIPAA Security and Privacy Rule, SOC2 Type 2, the Payment Card Industry Data Security Standard (PCI-DSS), UK CyberEssentials, and HITRUST. The results of such assessments, audits and reviews are presented to the Audit Committee and members of the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on such assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process. The Audit Committee oversees our cybersecurity program, as well as the steps management has taken to monitor and control cybersecurity threats and related risks. This oversight includes receiving reports on the regular assessments of the Company's disclosure controls and procedures to ensure that current practices account for material cybersecurity risks facing the Company. The Audit Committee receives presentations on the cybersecurity program and related risks on at least a quarterly basis. These presentations address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee, and the full Board as necessary, also receive prompt and timely information regarding any cybersecurity incident that meets recognized established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee routinely meets with our Chief Legal and Regulatory Officer ("CLRO") and CISO as well as outside experts as appropriate to assess cybersecurity risks and to evaluate the status of the Company's cybersecurity efforts, which include a broad range of tools and training initiatives that work together to protect the data and systems used in our businesses.


text: Our cybersecurity management team includes our CISO, Data Privacy Officer, CLRO, Chief Financial Officer, and Head of Internal Audit. The CISO, in coordination with the team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The cybersecurity management team meets regularly to review cybersecurity and data privacy strategy, receive updates, and consider the Company's current risk posture. The team meetings also build leadership consensus on cybersecurity risk management and tolerance. In the event they become aware of a cybersecurity threat or incident, employees are expected to follow established lines of communication to notify the relevant members of the cybersecurity management team and allow the relevant team members to coordinate the evaluation and response to such threats and incidents as necessary. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the rest of the cybersecurity management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to other members of senior management and the Audit Committee when appropriate. Such plans also dictate notification responses to Company management based on the severity of the incident.


text: The CISO has worked in the information security field for over 15 years and holds an undergraduate degree in computer systems management and master's degrees in both cybersecurity and technology management. He has also attained multiple cybersecurity-related professional certifications and licenses, including Certified Information Systems Security Professional, and is an adjunct professor of cybersecurity at New York University and Fordham University.


text: While we have experienced cybersecurity incidents in the past, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, financial condition, cash flows or reputation. However, cybersecurity threats and/or incidents could have a material effect on the Company. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the cybersecurity risks we face, see "Item 1A. Risk Factors— Risks Related to Technology, Security and Intellectual Property" of this Annual Report on Form 10-K.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners, and employees toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, procedures, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks, and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, threat monitoring and tabletop exercises to inform our risk identification and assessment.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST and Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we also perform periodic risk assessments, which includes cybersecurity risks, monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; through our policies, practices, and/or contracts (as applicable), require employees and certain third parties to treat confidential information and data with care; periodically update our relevant policies and procedures; employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools and knowledge necessary to identify or address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices; conduct regular phishing email simulations to enhance awareness and responsiveness to possible threats; conduct annual cybersecurity training for our board of directors and senior management; run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; engage consultants to help us oversee and manage cybersecurity risks, processes, and incident response measures; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan outlines and coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. Our incident response plan further outlines the roles and responsibilities of various employees, managers, and senior leadership with respect to performing a materiality assessment and responding to cybersecurity events that are deemed material, as well as provides rapid escalation procedures after a cybersecurity incident. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g. legal), as well as senior leadership and our board of directors, as appropriate.


text: Our cyber risk management program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services. The risk management program is focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. Regular assessments, including penetration tests, are performed. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking basis.


text: As part of the above processes, we regularly engage with consultants, and other third parties, review our cybersecurity program to help identify areas for continued focus, improvement, and compliance. We engage them, specifically, to assist us with cybersecurity risk assessments, external threat environment reviews, internal cybersecurity policy compliance and near-term incident response. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our key suppliers, which have access to consumer, patient, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We periodically perform diligence on certain third parties that have access to our systems, data, or facilities that house such systems or data; and we monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under the heading "Actual or attempted security incidents or breaches, loss of data, or other disruptions could expose us to material liability and materially and adversely affect our business, financial condition, and our reputation," which disclosures are incorporated by reference herein.


text: We have not experienced any material cybersecurity incidents. As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, we are aware that changes in our IT systems, including those provided by third parties, could expose us to risk in the future. These threats pose a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Cybersecurity attacks could also include attacks targeting patient, employee, or customer data or the security, integrity, and/or reliability of the hardware and software we utilize in our business operations. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing will be sufficient to protect and mitigate associated risks to our systems, information, or other property. For more information, see the risk factors included in Item 1A of this Annual Report.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, covering topics such as data security posture, any results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity dashboard and/or other materials discussing current and emerging material cybersecurity threat risks and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments, and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Information Security Officer and/or General Counsel and Chief Privacy Officer. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Our Chief Information Security Officer advises our Board on the specific vulnerabilities we identified and the controls we put in place to mitigate our risk.


text: Our cybersecurity program is managed by a dedicated team, which is led by our Chief Information Security Officer, (CISO who reports to the Chief Operating Officer and has to the ability to communicate directly to our CEO if necessary). Our CISO has over 20 years of IT experience, including over 18 years of cybersecurity experience, holds an M.S. degree in Information Security, and is a Certified Information Systems Security Professional (CISSP). Our General Counsel and Chief Privacy Officer is an attorney with 18 years of experience, including experience in privacy matters. They are also a Certified Information Privacy Professional (CIPP/US/E), a Certified Privacy Manager (CIPM), and a Privacy Law Specialist (PLS) with the International Association of Privacy Professionals (IAPP). As discussed above, our CISO and/or General Counsel and Chief Privacy Officer report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: In addition, our cybersecurity risk management and data strategy processes are further overseen by certain management team members. Together with CISO and our General Counsel and Chief Privacy Officer, these management team members are regularly informed about and routinely monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their ongoing management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Such individuals have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.


text: The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program, which is supported by third parties, is designed to allow us to identify, assess, and manage cybersecurity risks. Our external partners include professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and security testing firms. We completed an external lead assessment to assess cybersecurity risks across our business that is informed by the Center for Internet Security Controls. Our Senior Director of IT has years of experience leading cybersecurity teams. We provide cybersecurity training to our employees to address matters such as phishing, email security, and training on data privacy.

companyName: Akero Therapeutics, Inc.


text: To operate our business, we utilize third-party service providers to perform various functions, such as outsourced business-critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery to third parties, corporate productivity services, and other functions. We engage reliable, reputable service providers that maintain cybersecurity programs and we conduct cybersecurity reviews as part of our quality assessment processes.


text: The Company reports on its information security program, including the results of periodic testing, to the Audit Committee of the Board of Directors. Our Board's Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reviews management presentations concerning cybersecurity-related issues, including information security, technology risks, policies, and risk mitigation programs. The Audit Committee reports matters to the Board of Directors as needed. Our Chief Operating Officer, with the support of our Senior Director of Information Technology and third-party consultants, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Operating Officer also works closely with other management positions and external legal counsel to ensure that the Company understands its cybersecurity risk management responsibilities.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Process We have developed and continue to enhance our cybersecurity program to help secure our computer systems, software, networks, and data against material risks from cybersecurity threats, and help manage the material cybersecurity risks associated with our use of third-party service providers.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: BBSI has integrated cybersecurity risk management into our overall risk management framework to identify, assess, and manage cybersecurity risks. As part of our integrated risk management process, our technology and information security team work closely with our management team on an ongoing basis to identify and respond to cybersecurity threats. Our proactive approach to cybersecurity risk management includes cybersecurity risk assessments performed internally by our IT security team and externally by third-party experts, penetration and vulnerability testing using third-party vendors and tools, tabletop exercises that simulate cybersecurity incidents, cybersecurity awareness training, and internal audit assessments of critical IT controls.


text: Use of Cybersecurity Experts Due to the complex and evolving cybersecurity threat landscape, BBSI engages third-party experts to conduct in-depth threat assessments, identify vulnerabilities, monitor and detect threats, and offer strategic insights into our risk management process. Leveraging the knowledge, expertise, and resources of third-party experts, we regularly evaluate our cybersecurity risk management strategy to help us align with best practices and address cybersecurity threats that could impact our ability to achieve our business objectives.


text: Third-Party Service Provider Risk Management We utilize third-party service providers for a variety of reasons, including, without limitation, infrastructure and SaaS cloud computing services, technology and business process service providers, content delivery to customers, back-office support, and other functions. Such providers may have access to information about BBSI or that we hold about our customers, associates or vendors.


text: To mitigate the cybersecurity risk associated with the use of third-party service providers, we tier our third-party service providers based on their risk profile to establish applicable cybersecurity risk review standards and evaluate those providers in accordance with the tiering process. BBSI also relies on its third-party service providers to maintain cybersecurity control environments that address the risks associated with the products and services they provide to BBSI.


text: We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect BBSI, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, third-party relationships, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventative measures against all cyber threats, given the sophistication of the techniques used. For further discussion, see Item 1A. "Risk Factors – Risks Related to Technology."


text: Board Oversight of Cybersecurity Risk Our Board of Directors has a significant role in the oversight of BBSI's cybersecurity risk. The Board's Risk Management Committee provides oversight of BBSI's enterprise-wide risk management framework, including the strategies, policies, procedures, processes, and systems established by management to identify, assess, measure, monitor, and manage cybersecurity and other risks facing the Company. The Board of Directors also periodically receives reports from third-party consultants on the current cybersecurity threat environment, the results of third-party penetration testing, and the evaluation of the Company's cybersecurity preparedness.


text: Management's Role in Assessing and Managing Cybersecurity Risk BBSI's Chief Information Security Officer ("CISO") leads our enterprise information security program and is primarily responsible for the assessment and management of the Company's cybersecurity risks. The CISO has extensive experience in information technology and cybersecurity, including at another publicly traded company. The CISO oversees our cybersecurity risk management framework and manages a team of IT security professionals to identify and prioritize cybersecurity risks. The CISO also utilizes the expertise of third-party security partners to provide threat detection support, vulnerability management, incident response, penetration testing, and consulting services.


text: Ongoing Monitoring and Reporting of Cybersecurity Incidents The Company has an internal security team, supplemented with third-party security partners, to regularly monitor, detect and respond to potential cybersecurity incidents. The Company has a cybersecurity incident reporting protocol that provides a mechanism for the appropriate members of management and the Board to be made aware of cybersecurity incidents. The Company also requires security awareness training for all internal employees to enable employees to understand their role in preventing and reporting cybersecurity incidents.


text: Reporting to the Board of Directors The CISO and Chief Information Officer ("CIO") regularly update the Board's Risk Management Committee on cybersecurity risks that the Company faces and the risk mitigation strategies that the Company employs to respond to those risks, with meetings generally occurring quarterly.


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS) and other applicable industry standards and are integrated into our overall risk management system and processes. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Our information technology systems may fail or experience security breaches and incidents that could adversely impact our business and operations and subject us to liability."

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Periodic Assessments: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Our board of directors oversees our risk management program, including the management of cybersecurity threats as part of its general oversight function. Our Audit Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program and receives reports from management concerning our cybersecurity risk management program.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, which includes individuals who have a diverse combination of relevant expertise, experience, education and training, with representation from our IT, finance, legal, human resources, among others. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our IT department have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified.


text: Information Security and Risk Management Overview The Company places a high priority and focus on securing the confidential information it receives and stores about its borrowers, depositors and other customers and employees as well as sensitive information regarding financial transactions and the Company's information systems. This priority and focus starts at the Company's board of directors, which is ultimately responsible for risk oversight, establishing the Company's risk appetite, understanding the Bank's key risks and assuring the risk management strategy, processes and internal controls are appropriate to manage risk, in each case inclusive of cybersecurity risk. The Company's board of directors approves an information security policy and program (the "Information Security Policy and Program"), which contains a statement of the Company's risk appetite with respect to cybersecurity matters, on an annual basis. The Company's risk appetite includes specific information security risk tolerance thresholds and limits established with the approval of the Company's board of directors and executive management. Key risk indicators are monitored by the Risk Oversight Committee of the Company's board of directors (the "Risk Oversight Committee"), which receives quarterly reports from the Company's Chief Risk Officer, Information Security Officer ("ISO") and Enterprise Risk Management Committee regarding management's efforts to protect the Company from cybersecurity threats and the general threat landscape facing companies with operational characteristics similar to the Company's. The Risk Oversight Committee reports quarterly to the Company's board of directors regarding the Company's cybersecurity risk oversight processes as the board of directors seeks to ensure the Company is operating within its stated risk appetite.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: The Company's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse the Company's systems or information. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, security assessments, tabletop exercises, and other exercises focused on evaluating effectiveness of the Company's processes and programs. The Company also deploys technical safeguards that are designed to protect its information systems from cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the Company's business. The Company has also developed and periodically updates incident response plans that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation to the appropriate management committees and to the Risk Oversight Committee and full board of directors as appropriate. These incident response plans are coordinated through the ISO and other key members of management, including the Chief Risk Officer.


text: The Company's board of directors delegates authority to the Risk Oversight Committee to assist the board in carrying out its duties of risk oversight, including with respect to cybersecurity risk. The Risk Oversight Committee provides primary oversight of the Company's enterprise-wide risk posture and the processes established to identify, measure, and monitor the Company's risk level, including in regards to cybersecurity risk. This oversight includes reviewing and approving the Company's risk appetite, including with respect to cybersecurity risk, risk related policies, and reviewing quarterly reporting from management on monitoring of performance of the Company against its risk appetite, including in regards to cybersecurity risk. The Risk Oversight Committee is responsible for the oversight, implementation, and maintenance of the Information Security Policy and Program and has delegated to it specific responsibility for the implementation of the program and reviewing management reports in this area. Quarterly reports are provided to the Company's board of directors that describe the overall status of the Information Security Policy and Program, including, but not limited to: • Decisions about risk management and control; • Results of testing, including regular external and internal penetration testing; • Security breaches or violations and management's responses; and • Recommendations for changes to the Information Security Policy and Program.


text: The Company's Enterprise Risk Management Committee, which is a management committee consisting of certain employees of the Company, including the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Credit Officer, Chief Administrative Officer, Chief Information Officer, and Chief Risk Officer, oversees implementation and monitoring of the Information Security Policy and Program. Testing of the Information Security Policy and Program is accomplished through the use of a comprehensive Information Systems Audit that is performed, at a minimum, on an annual basis by third-party expert consulting firms, the results of which are reviewed with the Risk Oversight Committee and Audit Committee. The Company also conducts an internal and external penetration test, at a minimum, on an annual basis by outside expert consulting firms. In addition, in accordance with the Information Security Policy and Program, the Company's Enterprise Risk Management Committee assesses information security risks on at least an annual basis, or more often in response to changes in products or services that are offered, technological changes, changes in the threat landscape facing the Company, including as a result of cybersecurity incidents affecting financial institutions or their vendors generally or any change that may materially affect the Company's risk environment.


text: The ISO has over 15 years of experience in cybersecurity, and such expertise is primarily related to cybersecurity assurance, compliance, digital forensics, investigations, process design and collegiate instruction. The ISO also holds various certifications in areas relevant to cybersecurity risk monitoring, including, a master's degree in IT security, a bachelor's degree in criminal justice with a minor in business administration, and certifications in IT, cell phone, and mobile device forensics. The ISO, working together with the Company's Chief Information Officer and Chief Risk Officer, handles the development and implementation of the Information Security Policy and Program and, together with the Company's information technology staff and third-party vendors and other outside resources, the ISO monitors the Company's information technology systems for threats and implements changes to those systems in an effort to protect the systems from attack. The ISO also coordinates the risk assessment process, facilitates annual employee training, and prepares an annual report to the Company's board of directors that contains a summary of any cybersecurity incidents occurring during the report year, and an analysis of the results of the Information Systems Audit and the Company's performance against the Information Security Policy and Program. The ISO reports directly to the Bank's Chief Risk Officer, independent of the Company's technology department, and the responsibilities of this role are in conjunction with security, fraud and other special projects concerning risk and operational issues identified. The Bank's Chief Risk Officer reports directly to the Chief Executive Officer.


text: To date, no attempted cyber-attack or other attempted intrusion on the Company's information technology networks has resulted in a material adverse impact on the operations or financial results of the Company or the Bank.


text: Information Security Training and Awareness Information security awareness training is provided to all employees and Bank business units no less often than annually and focuses on: new hire orientation, the Company's overall information security program, roles and responsibilities of employees during an incident, how to report suspicious activity, and direction of employees to routinely check the Bank's cybersecurity blog for consistent and relevant information.


text: Service Provider Arrangements Management identifies, assesses, controls, monitors and reports on risks related to the Bank's use of third parties per applicable laws, safe and sound business practices, and related supervisory guidance, particularly that of the Interagency Guidance on Third-Party Relationships: Risk Management.


text: It is the policy of the Company to ensure the internal controls and financial condition of a third-party vendor are carefully evaluated prior to the allowance of such support services to begin, and as an on-going condition of continuing support of such products or services. Vendors with access to customer information or direct access to the network are carefully reviewed to ensure that appropriate controls and mechanisms are in place to safeguard confidential information, and the Company's contracts with such vendors include obligations on the part of the vendors to maintain the confidentiality of such information in compliance with applicable legal requirements.


text: Our Information Security Committee (the "ISC") oversees and implements a cybersecurity program that seeks to assess, identify and protect against cyber security threats and detect, respond, and recover from cyber security incidents. The program is modeled upon the National Institute of Standards and Technology Cybersecurity Framework, a well-established and widely adopted framework in the financial services industry. The ISC is chaired by our Chief Information Security Officer ("CISO") and membership includes executive and management level representation from our technology, legal, and compliance departments.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Our cybersecurity program assesses our cybersecurity risk profile through inventories of physical devices, software, and information systems, evaluations of critical third-party systems, and a catalog of security risks. Periodic assessments are conducted to ensure the risk catalog is up to date.


text: We protect our information systems, data, and network through technical and procedural controls and security awareness training. We deploy multiple technical controls to achieve a layered security strategy including systems access controls, firewalls, web application gateways, antivirus software, e-mail filtering, and endpoint protection. Security awareness training is mandatory for all employees and conducted at time of hire and periodically thereafter. The security awareness training program is designed to ensure employees are prepared to identify and avoid cyber risks and may cover topics such as phishing, ransomware, social engineering, public Wi-Fi risks, password security, and mobile device security. Training is supplemented by testing initiatives, including periodic phishing tests, which may result in targeted or remedial training.


text: We use a third-party security operations center and endpoint management and response service to continuously monitor information systems for emergent events including anomalous, suspicious, and unauthorized network activity. Detected events are immediately triaged and evaluated for threat potential and impact. We also engage third-party providers to perform penetration testing designed to identify vulnerabilities for remediation. We rotate penetration testing providers to diversify testing approaches.


text: No known cybersecurity threats or incidents have materially affected, or are likely to materially affect, our business strategy, results of operations, or financial condition. While we maintain robust prevention and detection measures, we cannot eliminate all cybersecurity risks or guarantee absence of undetected incidents. For further details on cybersecurity risks, see "Item 1A. Risk Factors" in this Form 10-K.


text: Role of the Board of Directors and Management Our CISO and Chief Technology Officer ("CTO") oversee the day-to-day technology and security activities. Our CISO has been with the firm since 2013 and has over 20 years of IT experience in various industries. He is a Certified Chief Information Security Officer from the Carnegie Mellon University executive education program, as well as a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Our CTO joined the firm in 2020 with 30 years of IT experience, including over 20 years of executive level technology experience in the asset management industry. Both the CISO and CTO serve on the ISC.


text: The Audit Committee of the Board of Directors oversees our enterprise risk management, which includes cybersecurity. The ISC provides a report on our cybersecurity program to our Board at least annually.


text: Other key functions of the ISC are to align the overall security strategy with business objectives and to oversee the cataloging of cybersecurity risks and assessments. Additional review and oversight is provided by the Enterprise Risk Committee where cybersecurity risk is vetted against other risk categories. Management also maintains a Vendor Oversight Committee which governs the use of third-party vendors and assesses cybersecurity risk related to those vendors. The Enterprise Risk Committee and the Vendor Oversight Committee report their activities to the Audit Committee at least annually.


text: The third-party security operations center, the endpoint managed detection and response service, and third-party penetration testing vendors are overseen by the CISO.


text: In the event of a potential cybersecurity incident, the third-party security operations center is authorized to take preemptive action to address the incident and must promptly notify a member of the ISC. The ISC coordinates the response to and communication of an incident in accordance with our Incident Response Plan ("IRP") and applicable law. The IRP is designed to provide guidance for effective, efficient, and orderly response to a variety of cybersecurity incidents. The ISC is responsible for communication escalation as necessary up to and including to the Board of Directors. The IRP is periodically exercised through tabletop exercises.


text: Cybersecurity Risk, Management, and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. The Information Security Officer is primarily responsible for administering, updating and enforcing the cybersecurity components of the risk management strategy and reports to the Chief Risk Officer. The Information Security Officer periodically collaborates with third-party service providers and industry groups to discuss cybersecurity trends and best practices. The Information Security Officer is supported by the Chief Technology Officer, who reports directly to the Chief Financial Officer. The Chief Technology Officer oversees our Information Technology department, comprising our first line of defense.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. To manage cybersecurity risk, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. The cybersecurity strategy is memorialized within the Company's information security program. The program incorporates regulatory guidance and industry standards while leveraging information from industry associations, third-party benchmarking, audits, threat intelligence and peer industry groups. The information security program is reviewed by the Chief Risk Officer and presented to the Risk, Compliance and Planning Committee to periodically account for the changes in the cyber threat landscape. It is also periodically assessed by the Internal Audit department.


text: The Company has deployed an in-depth cybersecurity strategy to protect its assets, which includes a diverse preventive and detective tool set to stop, monitor, and alert management of suspicious activities and potential advanced persistent threats. We have implemented other preventive technologies and mitigating processes that include on-going education and training for employees, periodic tabletop exercises and recovery tests, and regular infrastructure penetration tests conducted by cybersecurity professionals and third-party specialists. Our internal and external auditors, along with independent external partners, periodically assess our processes, systems and controls for design and operating effectiveness, and provide recommendations to bolster our cybersecurity program. In addition, employees are subjected to regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. We also monitor our email gateways for malicious phishing emails and monitor remote connections through a secure virtual private network. Like many companies, we rely on third-party vendor solutions to support our operations. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence. We have a vendor management program in place to assess and manage risks associated with third-party service providers.


text: To prepare to respond to incidents, the Enterprise Risk Management Committee periodically reviews and updates our cyber Incident Response Plan ("IRP"). The IRP provides a framework to address potential and actual cybersecurity incidents to include assessment to recovery by our Incident Response Team and notification to the appropriate management and board committees and regulatory agencies. The Incident Response Team is comprised of representatives from various departments including Information Security, Information Technology, Risk Management, Legal, Operations, Marketing and Accounting. Our Information Security Officer manages the IRP and coordinates with senior level management and multiple areas of the company in execution of the plan. While we have experienced cybersecurity incidents, we have not, to our knowledge, experienced an incident materially affecting, or reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our Information Security Officer is accountable for managing the information security department and executing the information security program. The information security department is responsible for cybersecurity risk assessments, alert monitoring, incident response, vulnerability assessment, threat intelligence, identity access governance, and third-party information security risk management. The department consists of information security professionals with varying levels of education, experience and certifications. Our information security department is further supported by our first line of defense, the Information Technology department and a third-party managed service security provider. The information technology department is responsible for the patch and vulnerability management, identity and access management, endpoint and network security, IT asset management program, and backups and recovery operations.


text: The Risk, Compliance and Planning Committee of our Board of Directors provides oversight of the information security program including cybersecurity and is chaired by an independent director. Cybersecurity metrics are reported to the committee quarterly. Additionally, management has established an Information Technology Executive Steering Committee focused on technology impact, and an Enterprise Risk Management Committee focused on business and risk impact, both consisting of executives and department leaders across multiple domains. These committees generally meet quarterly and more frequently when warranted. The information security department holds a monthly security meeting with the managers from the information technology department to discuss significant security incidents and status of the threat landscape. The Information Security Officer reports significant cybersecurity or privacy incidents and the state of the information security program to the Risk, Compliance and Planning Committee of the board on a quarterly basis. The Risk, Compliance and Planning Committee of the Board of Directors provide a report of activities to the full board at each quarterly board meeting.


text: The Company's Information Security strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. The Company's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. The Company implements risk-based controls to protect the Company's information, information systems, business operations, products and related services, and the information of the Company's customers. The Company has adopted security-control principles based on the Federal Financial Institutions Examination Council (FFIEC) Cyber Security Assessment Tool (CAT), and other industry-recognized standards, and contractual requirements, as applicable. The Company also leverages industry associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds, and other similar resources to inform the Company's cybersecurity processes and allocate resources.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: The Company maintains security programs that include physical, administrative and technical safeguards, and the Company maintains plans and procedures whose objective is to help the Company prevent and timely and effectively respond to cybersecurity threats or incidents. Through the Company's cybersecurity risk management process, the Company continuously monitors cybersecurity vulnerabilities and potential attack vectors to Company systems, and the Company evaluates the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. The Company continues to integrate the Company's cyber practice within the Company's Risk Oversight Committee, and Enterprise Risk Management program, both of which are overseen by the Company's Board of Directors and provide frameworks for identifying and tracking cyber-related business and compliance risks across the Organization. The Company periodically engages third-party consultants to assist us in assessing, enhancing, implementing, and monitoring the Company's cybersecurity risk management programs and responding to any incidents.


text: As part of the Company's cybersecurity risk management process, the Company conducts an annual "tabletop" exercise during which the Company simulates cybersecurity incidents to ensure that the Company is prepared to respond to such an incident and to highlight any areas for potential improvement in the Company's cyber incident preparedness. This exercise is conducted at both the technical level and senior management level. In addition, all employees are required to pass mandatory cybersecurity training courses on an annual basis and receive bi-weekly phishing simulations to provide "experiential learning" on how to recognize phishing attempts.


text: The Company has established a cybersecurity vendor risk management program, which is a cross-functional program that forms part of the Company's Enterprise Risk Management program and is supported by the Company's security, compliance, and third-party partners. Through this evolving program, the Company assesses the risks from cybersecurity threats that impact the Company's third-party service providers with whom the Company shares personal identifying and confidential information. The Company continues to evolve the oversight processes to mature how the Company identifies and manages cybersecurity risks associated with the products or services the Company procures from third parties.


text: The Company has experienced, and may in the future experience, whether directly or through the Company's third-party partners, cybersecurity incidents. While prior incidents have not materially affected the Company's business strategy, results of operations or financial condition, and although the Company's processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect the Company's business strategy, results of operations or financial condition.


text: The Company's Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function. The Company's Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Risk Oversight Committee and Audit Committee, and each committee reports on its activities and findings to the Board on a quarterly cadence. The Audit Committee is charged with reviewing the Company's cybersecurity processes for assessing key strategic, operational, and compliance risks. The Company's Information Security Officer provides presentations to the Risk Oversight Committee and the Board, on cybersecurity risks quarterly. These briefings may include assessments of cyber risks, the threat landscape, updates on incidents, and reports on the Company's investments in cybersecurity risk mitigation and governance. In the event of a potentially material cybersecurity event, the Incident Response Team (IRT) is notified and briefed, and meetings with that team and/or Executive Committee members are held, with the Board of Directors being briefed, as appropriate.


text: The Company's Information Security Officer (ISO), James Hinks, leads our cybersecurity program and oversees the Company's Security Operations Team (SOC), supporting our security functions of identifying, preventing, detecting, responding, and recovering. The SOC team comprises personnel with extensive experience in information technology across the private and public sectors. Mr. Hinks holds multiple security accreditations and 25 years of experience in cybersecurity, software development, systems, networking, and other technology-related roles within public and private industries, with 15 years in IT leadership roles. Mr. Hinks has been employed with the Company since 2019, overseeing information security, disaster recovery, vendor management, and physical security.


text: Primerica has processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats which are integrated into Primerica's enterprise risk management system. Primerica's enterprise risk management and internal audit functions conduct regular assessments and audits of risks from cybersecurity threats and report the results to the Board of Directors at least quarterly. The Board considers cybersecurity risk as part of its business strategy, risk management, and financial oversight.

companyName: Primerica, Inc.

ticker: PRI


text: Primerica institutes a three-lines-of-defense model for information security risk assurance, in which management owns the risk, our enterprise risk management team assesses the risk and oversees compliance with internal guidelines and policies, and our internal audit team reviews the effectiveness of the first two lines of defense. Management works with external assessors, consultants, auditors, and other third parties from time to time in conducting maturity and technical assessments.


text: Primerica has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. The Company maintains a policy governing information security, which includes risk assessment policies and procedures relating to third-party vendors, as well as a data loss prevention policy. The Company's policies address technical requirements needed to protect the environments in which data is processed, as well as how it is maintained, governed, and protected. Primerica also imposes mandatory privacy and information security controls and data security protection requirements on the independent contractor sales force. We train all regular employees in information security and privacy-related risks and we perform regular tests to determine whether our employees can recognize phishing emails. Similarly, our annual compliance training for the independent sales representatives includes training on maintaining data security and privacy.


text: We have an incident response plan designed to help us monitor the prevention, detection, mitigation, and remediation of information security incidents. The incident response plan documents the roles and responsibilities of Primerica personnel in responding to information security incidents, including the process by which the Chief Information Security Officer, the Chief Information Officer, senior management, and the Board is informed about such incidents.


text: The Chief Information Security Officer leads the Company's Incident Advisory Committee ("IAC"), which is notified in the event of high or medium severity incidents. The IAC includes representatives from information technology, legal, and often the impacted business unit. The Incident Response Team ("IRT") consists of the IAC and a larger group of managers that is typically notified of more significant incidents. The IRT reports findings to management and the Board as necessary. Each IRT member has specific responsibilities related to his or her function at the Company. On a semi-annual basis, the IRT and management undertake facilitator-led trainings and simulations of information security incidents.


text: Previous cybersecurity incidents have not materially affected the Company. For a discussion of risks to the Company related to cybersecurity threats, see "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity", which is incorporated herein by reference.


text: The Board of Directors has responsibility for oversight of risks from cybersecurity threats. The Board receives a quarterly report from the Chief Information Officer and Chief Information Security Officer on risks from cybersecurity threats and, under the Company's incident reporting plan, the Board is informed by management of certain cybersecurity incidents as appropriate. In 2024, the Board participated in a facilitator-led training and simulation of an information security incident.


text: Primerica's senior executive leadership is actively involved in managing material risks from cybersecurity threats. Primerica's cybersecurity operations risk steering group is chaired by the Chief Insurance Officer and holds quarterly meetings. It includes key executives from the Company's technology, security, privacy, and legal teams, coordinates corporate security initiatives and provides high-level guidance on technology-and security-related issues. The Chief Information Security Officer has responsibility for assessing and managing the Company's material risks from cybersecurity threats. The Chief Information Security Officer has served in various roles in information technology and information security for 36 years, including serving as the Company's Chief Information Security Officer for over 24 years.


text: As discussed in the "Item 1A. Risk Factors – Privacy, Cybersecurity, Technology, and Data Protection Risks," we face certain ongoing risks from cybersecurity threats and recognize the critical importance of effective cybersecurity risk management in today's interconnected digital landscape. As part of our commitment to safeguarding our operations, sensitive data, and stakeholder trust, we have implemented robust cybersecurity practices and governance.

companyName: ICF International, Inc.

ticker: ICFI


text: We regularly assess and identify potential cybersecurity risks that could impact our business, financial condition, or reputation. Our risk assessment process includes: • Enterprise Risk Management: We maintain an enterprise risk management process that embeds cybersecurity within the risk assessment strategy. • Threat Landscape Analysis: We monitor emerging threats, vulnerabilities, and attack vectors relevant to our industry and business operations. • Risk Scenarios: We evaluate potential scenarios, with considerations to both internal and external threats, to understand their potential impact. • Risk Quantification: We assess the likelihood and potential financial, operational, and reputational impact of identified risks.


text: Our risk mitigation strategy focuses on measures to prevent, detect, and respond to cybersecurity incidents. The primary components of our risk mitigation strategy include: • Security Controls: We maintain a comprehensive set of controls aligned with industry standards such as the National Institute of Standards and Technology ("NIST") and the International Organization of Standards ("ISO") 27001 to protect our systems, networks, and data. • Incident Response Plan: We have a well-defined incident response plan that outlines roles, responsibilities, and procedures for handling cybersecurity incidents. • Employee Training and Awareness: We have training programs to ensure that our employees understand their role in maintaining a secure environment and recognize potential threats. • Third-Party Risk Assessment and Management: We assess and manage cybersecurity risks associated with our vendors, partners, and service providers.


text: Our approach to information security follows a defense-in-depth methodology in which security is embedded throughout the system architecture. Technical controls rely on proven technologies, such as network-based intrusion detection systems, next generation firewalls with advanced threat detection, secure server networks, demilitarized zones, and endpoint detection and response capabilities. Security techniques, such as encryption at rest and encryption in transit, are used to incorporate relevant practices. We undergo annual third-party security assessments such as security control compliance reviews, incident response exercises, penetration testing, and red team drills to maintain the effectiveness of the security program.


text: Our critical corporate information systems are maintained in a commercial grade data center with climate controls, fire suppression, redundant power, and several telecommunication options. The data center is designed to host mission-critical computer systems with fully redundant subsystems and compartmentalized security zones. Our primary data center also undergoes independent assessment on an annual basis. Our computing infrastructures are protected by multiple independent layers of security measures managed by the corporate information security department. Our approach to accessing protected networks is based on the principle of least privilege.


text: Notwithstanding the vigorous approach we take to cybersecurity, we may not always be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, we have not identified cybersecurity risks, threats, or incidents that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.


text: Our Board, directly or through its committees, is responsible for the oversight of the Company's overall enterprise risk management program, which includes cybersecurity risks. Our Audit Committee regularly reviews and evaluates cybersecurity risks and the procedures and policies implemented by management to identify, manage, and mitigate such risks.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our current Chief Information Officer (the "CIO"), the Deputy Chief Information Office (the "Deputy CIO") and the Chief Information Security Officer (the "CISO") have primary oversight of material risks from cybersecurity threats. The CIO has decades of professional experience across various engineering, business and management roles. Our Deputy CIO has over 30 years of experience leading implementation of various IT infrastructure and systems, and our CISO has over 20 years of specific cybersecurity experience and is responsible for maintaining compliance with applicable security requirements. They have a combined tenure of over three decades with the Company in various progressive management roles in information systems and technology and information security. They conduct regular meetings with the Audit Committee and the Board to communicate updates on cybersecurity risks, incidents, and mitigation efforts. The CISO and our security staff provide ongoing support to internal operations and oversight to our systems that offer services to our clients within our enterprise network. Our security staff is also augmented through an industry-recognized security operations center where systems are continuously monitored.


text: Premier's risk management program is designed to identify, measure, prioritize, and manage risk, including information security and cybersecurity risk, in relation to the Company's desired risk appetite established by its Board of Directors. Premier uses a risk-based approach to manage and mitigate threats to information technology resources. Periodic risks assessments are conducted to identify, assess, and reduce information security and cybersecurity risks to acceptable levels.

companyName: PREMIER FINANCIAL CORP


text: Premier maintains an active Information Security Policy (the "IS Policy") and associated programs, procedures and standards (collectively with the IS Policy, the "ISPP") in alignment with Federal Financial Institutions Examination Council and National Institute of Standards and Technology guidance to help in the mitigation of risks that may impact the Confidentiality, Integrity and Availability (aka "CIA Triad") of systems and information. The components of the IS Program are reviewed and approved annually by senior management and the IS Policy is reviewed and approved annually by either the Risk Committee of the Board of Directors or the full Board of Directors. These annual reviews and approvals ensure the ISPP meets expectations to safeguard Premier and customer confidential information. The ISPP is subject to annual review by our auditors (both internal and external), the FDIC, and the ODFI to ensure it is in alignment with Premier's internal risk management practices, government regulatory expectations and industry best practices. We use auditors and other third party resources, in addition to internal tools and resources, for security monitoring and testing.


text: Premier maintains an Information Technology Incident Response Policy and an Information Security Incident Response Playbook that together coordinate the identification, reporting and escalation, containment, and remediation responses of any potential information security incident. Each cybersecurity incident is reviewed by the Chief Information Security Officer ("CISO") to determine if the matter needs escalated to the Company's Information Response Team, Information Security Oversight Committee ("ISOC"), Enterprise Risk Management Committee ("ERMC"), or the Board of Directors or Board-level Risk Committee.


text: Premier addresses third-party risks as part of Premier's Vendor Risk Management ("VRM") Policy and Program. The purpose of the VRM is to provide a consistent framework to direct Premier in the assessment, measurement, monitoring and control of risks related to vendors and third parties with whom Premier does business. Premier assesses and monitors the cybersecurity controls of third party service providers and partners. As part of the initial and regular monitoring of the vendor, the Company reviews a vendors internal controls based on the COSO framework in alignment with their formal SOC II assessments. The focus of the review is on a vendor's internal management and security practices including but not limited to, physical/systems security, business resiliency, application programming practices, systems security monitoring, and systems change control/authorization.


text: The VRM currently is managed under the direction of the CISO, with a goal of ensuring that vendors meet obligations associated with the confidentiality, integrity, and availability of Company and customer information. Beginning with the establishment of vendor relationships, vendors are risk rated based on their criticality to the operations of Premier and the sensitivity of the information such vendor has or utilizes to provide services to the Company. These assessments include, but are not limited to, a review of financial, operational and security aspects of the vendor. After the establishment of the vendor relationship, vendors are reevaluated on a regular basis based on their criticality and risk rating, with such reevaluations being conducted either annually, every two years or every three years.


text: Notwithstanding the focus Premier places on cybersecurity, Premier may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Premier Board of Directors has assigned to the Board Risk Committee ("BRC"), along with the ERMC, oversight of risk management, including risks associated with information security and cybersecurity. The BRC is comprised of independent directors of Premier with participation from Premier's executive leadership and additional members of management. The ERMC is chaired by the Chief Risk Officer and, in addition to general oversight of risk management, is responsible for documenting all risks for the organization and reporting to the BRC issues of a critical nature. The ERMC meets monthly and is a cross-functional group comprised of all members of executive leadership and additional members of management from different areas of the Company. The ISOC is responsible for managing and mitigating information security and cybersecurity risks where appropriate and escalates issues to the ERMC. The ISOC is chaired by the CISO and includes select members of executive leadership and representatives from the Risk Management Department and Information Technology Department. The ISOC meets at least monthly. Routine reporting of the status of cybersecurity risks and mitigation activities progress from the ISOC to ERMC and finally to BRC.


text: The information security and third-party risk management programs of the Company are managed by the CISO who is a member of the Company's Risk Management Department, reporting directly to the Company's Chief Risk Officer who reports directly to the Chief Executive Officer. The CISO's responsibilities include: maintaining the information security risk assessment and related reports to management; monitoring reasonably foreseeable threats, internal and external, that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or data systems; overseeing the development, implementation, enforcement and maintenance of the ISPP; implementing appropriate changes to the program in response to industry or regulatory mandates; monitoring the entire ISPP, reviewing it at least annually, and adjusting as necessary for changing regulation, technology, personnel, procedures and business arrangements; reporting the status of the ISPP periodically; ensuring information security awareness training is provided to all employees on a regular basis; ensuring the ISPP assessments are updated to include control changes for existing/new products, processes, and systems reflecting the associated changes to risk and mitigation methodology; providing guidance to management on emerging risks, cyber threats and regulatory changes; and maintaining information security program strategic goals in alignment with IT and PFC business strategy.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Longeveron Inc.

ticker: LGVN


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's General Counsel ("GC"), Chief Technology Officer ("CTO"), other members of management and relevant management committees, including Company's Senior Leadership Team ("SLT"), regarding cybersecurity oversight and risk management. • Collaborative Approach: The Company, through its information technology partner, has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company, through its information technology partner, deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti- malware functionality and access controls, which are evaluated and improved through vulnerability assessments, penetration testing, and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company, with its information technology partner, maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident. • Education and Awareness: The Company, through its information technology partner, provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.