text: Reporting to Board of Directors The Vice President of IT Security, in his capacity, regularly informs the CIO, Chief Financial Officer ("CFO") and other executive team leaders of aspects related to cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors where appropriate.


text: We have a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our data and systems. We are also subject to mandatory cybersecurity regulatory requirements. Our risk management programs, which address both enterprise and energy commodity risks, provides for evaluating and addressing cybersecurity risks and cybersecurity compliance. As part of our evaluation of cybersecurity risks, we consider cybersecurity risks and threats related to use of third-party service providers. Depending on the third-party service provider, the services provided by such third party and the data stored or to which such third party has access, we require different cybersecurity protections and specific cybersecurity programs that the third party must maintain. Our Utility Members have their own independent cybersecurity programs and procedures.

companyName: Tri-State Generation & Transmission Association, Inc.

secItem: Item 1C


text: Cybersecurity risks with long-term resolutions are evaluated and added to our risk register, which is reviewed and updated by a corporate committee quarterly. This corporate committee, consisting of senior executives and support staff, meets regularly to assess enterprise, including cybersecurity, and energy commodity risks. Our Chief Administrative Officer/CHRO manages our information technology department and has executive oversight of our cybersecurity program. Our Chief Information Officer and Chief Information Security Officer that report directly or indirectly to our Chief Administrative Officer/CHRO are responsible for implementation of our cybersecurity program. Our Chief Information Officer and Chief Information Security Officer have multiple cyber-related certifications from nationally recognized organizations and a combined experience in cybersecurity of 30 years.


text: We interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities. We utilize third-party consultants to evaluate and test our cybersecurity preparedness and participate in national transmission grid security exercises that also address cybersecurity threats. Our security efforts are intended to address evolving and changing cyber threats. We operate a dedicated cyber security center with capabilities to monitor, detect, analyze, mitigate, and respond to cyber threats.


text: The Engineering and Operations Committee of our Board has oversight of our cybersecurity program and the risks from cybersecurity threats. The Engineering and Operations Committee is briefed quarterly with both oral and written reports on cybersecurity including cybersecurity risks. Our Board receives oral briefing on cybersecurity including cybersecurity risks no less than once per year and our Board is provided access to all written reports provided to the Engineering and Operations Committee.


text: We are subject to numerous cybersecurity threats and the cybercriminals are becoming more sophisticated and are increasingly targeting electric utilities. A major cyber incident could result in significant business disruption, compromised or improper disclosure of data, and expenses to repair security breaches or system damage and could lead to litigation, regulatory action, including penalties or fines, and an adverse effect on our financial condition, results of operations, and reputation. See "RISK FACTORS – General Risks" for additional information. While there have been immaterial incidents of phishing and attempted financial fraud across our system, there has been no material impact on business or operations from these attacks. However, we cannot guarantee that security efforts will prevent breaches, operational incidents, or other breakdowns of information technology systems and network infrastructure and cannot provide any assurance that such incidents will not have a material adverse effect in the future.


text: Cybersecurity risks with long-term resolutions are evaluated and added to our risk register, which is reviewed and updated by a corporate committee quarterly. This corporate committee, consisting of senior executives and support staff, meets regularly to assess enterprise, including cybersecurity, and energy commodity risks. Our Chief Administrative Officer/CHRO manages our information technology department and has executive oversight of our cybersecurity program. Our Chief Information and Technology Officer and Chief Information Security Officer that report directly or indirectly to our Chief Administrative Officer/CHRO are responsible for implementation of our cybersecurity program. As of December 31, 2024, o ur Chief Information and Technology Officer and Chief Information Security Officer maintained multiple cyber-related certifications from nationally recognized organizations.


text: We are subject to numerous cybersecurity threats and the cybercriminals are becoming more sophisticated and are increasingly targeting electric utilities. A major cyber incident could result in significant business disruption, compromised or improper disclosure of data, and expenses to repair security breaches or system damage and could lead to litigation, regulatory action, including penalties or fines, and an adverse effect on our financial condition, results of operations, and reputation. See "RISK FACTORS – General Risks" for additional information. While there have been immaterial incidents such as phishing and attempted financial fraud across our system, there has been no material impact on business or operations from these attacks. However, we cannot guarantee that security efforts will prevent breaches, operational incidents, or other breakdowns of information technology systems and network infrastructure and cannot provide any assurance that such incidents will not have a material adverse effect in the future.


text: The following sets forth information regarding our cybersecurity strategy, risk management program and approach to governance as it relates to cybersecurity risks. For additional information on the impact of cybersecurity risks on our business, please refer to Part I, Item 1A. Risk Factors, of this Form 10-K, under the heading "Cybersecurity and Data Risks."

companyName: Surgery Partners, Inc.

ticker: SGRY


text: Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks as well as engage with various third parties to assist in program development, risk evaluation and testing. For example, we have implemented a third-party risk assessment process for certain service providers, suppliers, and vendors, which is conducted during the procurement cycle. Critical vendors are assessed on an annual basis. In addition, all team members are required to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.


text: We promote a company-wide culture of cybersecurity risk management intended to protect the confidentiality, integrity, and availability of our critical systems and the information contained therein. As part of our cybersecurity risk management strategy, our corporate information technology team collaborates cross-functionally with key business leaders within privacy, compliance, finance and operations, among others, to identify, assess, and manage cybersecurity risks relevant to our business. On a quarterly basis, led by the Chief Information Security Officer (CISO) and Privacy Officer, the cybersecurity and privacy governance committee meets, which comprises of our executive and regional leadership teams. This governance committee assists in discussing existing or emerging threats, prioritizing roadmap items and/or budgetary considerations for project work.


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. Additionally, while we have insurance coverage in place that is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Management is responsible for the day-to-day handling of risks facing our Company Our Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities with respects to cybersecurity to our Audit Committee. Specifically, the Audit Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness. Our cybersecurity team is led by our CISO, who has over 20 years of experience in the cybersecurity space and is a Certified Information Security Manager (CISM). On an annual basis, at minimum, our CISO or Chief Information Officer (CIO) present necessary updates on our cybersecurity risks and any material cybersecurity incidents. These updates include the following: (i) current cybersecurity threats, (ii) an overview of third-party risks, (iii) our cybersecurity roadmap, (iv) the maturity of our cybersecurity programs and/or (v) ongoing regulatory compliance.


text: The following sets forth information regarding our cybersecurity strategy, risk management program and approach to governance as it relates to cybersecurity risks. For additional information on the impact of cybersecurity risks on our business, please refer to Part I, Item 1A. Risk Factors, of this Form 10-K under the heading "Cybersecurity and Data Risks."


text: Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks as well as engage with various third parties to assist in program development, risk evaluation and testing. Our cybersecurity program is predicated on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). At minimum, on an annual basis we measure ourselves against this framework and use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our strategic execution. W e have also implemented a third-party risk assessment process for certain service providers, suppliers, and vendors, which is conducted during the procurement cycle. Critical vendors are assessed on an annual basis. In addition, all team members are required to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.


text: Management is responsible for the day-to-day handling of risks facing our Company. Our Board of Directors as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities with respects to cybersecurity to our Audit Committee. Specifically, the Audit Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness. Our cybersecurity team is led by our CISO, who has over 20 years of experience in the cybersecurity space and is a Certified Information Security Manager (CISM). On an annual basis, at a minimum, our CISO or Chief Information Officer (CIO) present necessary updates on our cybersecurity risks and any material cybersecurity incidents. These updates include the following: (i) current cybersecurity threats, (ii) an overview of third-party risks, (iii) our cybersecurity roadmap, (iv) the maturity of our cybersecurity programs and/or (v) ongoing regulatory compliance.


text: Cyber Risk Management and Strategy LivaNova's enterprise risk management process consists of risk identification, evaluation, control and monitoring, and documentation. The LivaNova Board oversees risk management within the Company, and the CRO provides the framework to identify and reduce risks that may materially impact the Company's business. As part of the CRO's enterprise risk management process, regular inquiries and discussions are held with the CISO, Chief Information Officer, Chief Privacy Officer, and their respective teams to review the cybersecurity risk landscape.

companyName: LivaNova PLC

ticker: LIVN


text: LivaNova's CISO has a Master of Science in Accountancy with a specialization in risk management, in addition to over 15 years of experience in the IT Risk Advisory sector. The CISO leads the Company's information security team, identifies cybersecurity threats, and implements countermeasures in the cybersecurity realm, considering both internal operations and the external landscape. As part of his duties, the CISO provides relevant information to the CRO in their regular discussions. The CISO also manages the Company's ISMS program. Guided by the principles of various industry-leading standards, such as the NIST cybersecurity framework and ISO 27001, the objective of the ISMS program is to continue to strengthen LivaNova's cyber resiliency in connection with its information systems.


text: As part of LivaNova's cyber resiliency strategy and in an effort to mitigate potential cybersecurity risks, the Company employs various measures, including employee training, systems monitoring, testing and maintenance of protective systems, and contingency plans. In addition, the CISO manages a structured cyber incident response program where periodic simulation exercises are performed to prepare and train the Company's cybersecurity incident responders. The Company deploys security tools to help bolster its defense detection capabilities, such as endpoint detection and response tools, security information and event management tools, and 24/7 monitoring. LivaNova regularly evaluates itself for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests.


text: In addition, LivaNova routinely engages with third-party service providers to conduct evaluations of its security controls, whether through penetration testing or consulting on best practices to address new challenges. The Company receives threat intelligence from industry peers, government agencies, industry-specific information sharing and analysis centers, and cybersecurity associations. The Company relies heavily on its supply chain to deliver products and services to its customers, and a cybersecurity incident at a supplier, subcontractor, or service provider could materially adversely impact the Company. The Company assesses third-party cybersecurity controls through its information security program and includes security and privacy addendums to its contracts where applicable.


text: Historically, risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations or financial condition. As previously reported, in November 2023, the Company initiated its cyber response protocol in response to a cybersecurity incident that resulted in a disruption of portions of its information technology systems. Promptly after detecting the issue and per LivaNova's cyber response protocol, the Company began an investigation with assistance from external cybersecurity consultants and coordinated with law enforcement. The Company continues to assess what information was impacted and to implement remediation measures to mitigate the impact of the incident.. While the Company has taken and will continue to take actions to enhance its information security framework, LivaNova cannot determine at this time the extent of the impact from this event on its business, results of operations, cash flows, or financial condition. For further information, please refer to "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Report. Additionally, for a description of the Company's evaluation of its disclosure controls and procedures, management's report on internal control over financial reporting and changes in internal control over financial reporting, see "Item 9A. Controls and Procedures."


text: Cyber Governance On a quarterly basis, the CISO presents key security metrics to the Company's IT Advisory Council, which is composed of functional leaders across the Company and is responsible for IT governance oversight in the Company. Specifically, this IT Advisory Council is responsible for establishing program strategies in alignment with LivaNova's business objectives, as well as providing guidance on the implementation of appropriate and necessary security controls in alignment with the Information Security Policy. Among other things, the IT Advisory Council reviews summaries of information security incidents, audit findings, or other test reports, and ensures appropriate root-cause analyses are performed and corrective actions are taken. It also establishes year-over-year goals, security objectives, and priorities for the information security program.


text: On an annual basis, the CISO reviews the information security program achievements and reports to the Company's IS Executive Committee, which is a cross-functional group composed of the CEO, the CFO, the CLO, and other executive leaders of the Company. Among other things, the IS Executive Committee approves the information security policy and the allocation of budget and resources to information security program initiatives, performs the annual management review of the security program, and reviews corrective action to improve the program.


text: As codified in its charter, the Audit Committee is responsible for reviewing the processes by which cybersecurity risks are managed and reporting any issues that arise out of such reviews to the Board. The CISO provides key security metrics to the Audit Committee on a quarterly basis, and directly to the chair of the Audit Committee on a case-by-case basis, as needed, at any time during the quarter. The Audit Committee reviews these reports, which include, among other things, external events impacting the Company, security incidents, user training statistics, and evaluations of user readiness to address cyber incidents. Notwithstanding the Company's approach to cybersecurity, the Company may not be successful in preventing or mitigating future cybersecurity incidents that could have a material adverse effect on the Company. While LivaNova maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on risks related to cybersecurity and data security, see Item 1A. "Risk Factors – Risks Relating to the Company's Business and Operations."


text: Cyber Risk Management and Strategy LivaNova's enterprise risk management process consists of risk identification, evaluation, control and monitoring, and documentation. The LivaNova Board oversees risk management within the Company, and the legal and compliance teams work in tandem to provide the framework to identify and reduce risks that may materially impact the Company's business. As part of the enterprise risk management process, regular inquiries and discussions are held with, among others, the CISO, Chief Information Officer, Chief Privacy Officer, and their respective teams to review the cybersecurity risk landscape.


text: LivaNova's CISO has a Master of Science in Accountancy with a specialization in risk management, in addition to over 15 years of experience in the IT Risk Advisory sector. The CISO leads the Company's information security team, identifies cybersecurity threats, and implements countermeasures in the cybersecurity realm, considering both internal operations and the external landscape. As part of his duties, the CISO provides relevant information in connection with regular enterprise risk assessments. The CISO also manages the Company's ISMS program. Guided by the principles of various industry-leading standards, such as the NIST cybersecurity framework and ISO 27001, the objective of the ISMS program is to continue to strengthen LivaNova's cyber resiliency in connection with its information technology systems.


text: As part of LivaNova's cyber resiliency strategy and in an effort to mitigate potential cybersecurity risks, the Company employs various measures, including employee training, systems monitoring, testing and maintenance of protective systems, and contingency plans. In addition, the CISO manages a structured cybersecurity incident response program where periodic simulation exercises are performed to prepare and train the Company's cybersecurity incident responders. The Company deploys security tools to help bolster its defense detection capabilities, such as endpoint detection and response tools, security information and event management tools, and 24/7 monitoring. LivaNova regularly evaluates itself for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests.


text: In addition, LivaNova routinely engages with third-party service providers to conduct evaluations of its security controls, whether through penetration testing, security assessments, or consulting on best practices to address new challenges. The Company receives threat intelligence from industry peers, government agencies, industry-specific information sharing and analysis centers, and cybersecurity associations. The Company relies heavily on its supply chain to deliver products and services to its customers, and a cybersecurity incident at a supplier, subcontractor, or service provider could materially adversely impact the Company. The Company assesses third-party cybersecurity controls through its information security program and includes security and privacy addendums to its contracts where applicable.


text: Historically, risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations, or financial condition. As previously disclosed, in November 2023, the Company initiated its cyber response protocol in response to a cybersecurity incident that resulted in a disruption of portions of its information technology systems. Promptly after detecting the issue and per LivaNova's cyber response protocol, the Company began an investigation with assistance from external cybersecurity experts and coordinated with law enforcement. The Company implemented remediation measures to mitigate the impact of the incident. The Company also assessed the nature and scope of the affected data, analyzed its statutory notification obligations, and notified affected individuals and regulators as required by applicable law. The incident has been contained, and the Company's mitigation efforts are considered complete, but any future cybersecurity event has the potential to materially affect the Company's results of operations, cash flows, and financial condition. For further information, please refer to "Part II, Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" and "Note 11. Commitments and Contingencies" in LivaNova's consolidated financial statements in this Report. Additionally, for a description of the Company's evaluation of its disclosure controls and procedures, management's report on internal control over financial reporting, and changes in internal control over financial reporting, see "Part II, Item 9A. Controls and Procedures. "


text: Cyber Governance On a quarterly basis, the CISO presents key security metrics to the Company's IT Advisory Council, which is composed of functional leaders across the Company and is responsible for IT governance oversight in the Company. Specifically, this IT Advisory Council is responsible for establishing program strategies in alignment with LivaNova's business objectives, as well as providing guidance on the implementation of appropriate and necessary security controls in alignment with the Company's Information Security Policy. Among other things, the IT Advisory Council reviews summaries of information security incidents, audit findings, or other test reports, and ensures appropriate root-cause analyses are performed and corrective actions are taken. It also reviews year-over-year goals, security objectives, and priorities for the Company's information security program.


text: On an annual basis, the CISO reviews the information security program achievements and reports with the Company's IS Executive Committee, which is a cross-functional group composed of the CEO, the CFO, the CLO, and other executive leaders of the Company. Among other things, the IS Executive Committee approves the Company's Information Security Policy and the allocation of budget and resources to information security program initiatives, performs the annual management review of the information security program, and reviews corrective actions to improve the program.


text: As codified in its charter, the Audit Committee is responsible for reviewing the processes by which cybersecurity risks are managed and reporting any issues that arise out of such reviews to the Board. The CISO provides key security metrics to the Audit Committee on a quarterly basis, and directly to the chair of the Audit Committee on a case-by-case basis, as needed, at any time during the quarter. The Audit Committee reviews these reports, which include, among other things, external events impacting the Company, cybersecurity incidents, user training statistics, and evaluations of user readiness to address cybersecurity incidents. Notwithstanding the Company's approach to cybersecurity, the Company may not be successful in preventing or mitigating future cybersecurity incidents that could have a material adverse effect on the Company. While LivaNova maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on risks related to cybersecurity and data security, see "Item 1A. Risk Factors – Risks Relating to the Company's Business and Operations."


text: We have developed and implemented a cybersecurity risk management program intended to preserve the confidentiality, integrity and availability of Peloton's systems and information, including our Members' data, APIs and web and mobile applications. Our cybersecurity program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"). We seek to address cybersecurity risks through a comprehensive, cross-functional approach that focuses on protecting the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program is also integrated with Peloton's broader enterprise risk management program, through which we manage business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: While no organization can eliminate cybersecurity risk entirely, we believe our cybersecurity program is reasonably designed to mitigate our cybersecurity and information technology risks. Our cybersecurity program is supported by our information security team, which is primarily responsible for identifying, monitoring and preventing cybersecurity threats and our data privacy team, which is primarily responsible for developing, creating, maintaining and enforcing privacy policies, standards and procedures. Our information security team reviews potential identified incidents through various internal and external resources; identifies potential or actual cybersecurity threats; evaluates and prioritizes threats based on severity; investigates and mitigates the cause and impact of such incidents; administers our documented response procedures with respect to any data breach; and implements safeguards to help prevent recurrence.


text: Education, training and preparedness are important elements of our cybersecurity program. Peloton requires new employees to undertake a cybersecurity training and provides regular training updates to other employees. Additional trainings are mandatory for those employees who handle confidential (including personal) information.


text: We perform due diligence regarding our third-party suppliers, service providers and other business partners. This may include requiring evidence demonstrating third parties' ability to meet our cybersecurity and data handling requirements. In addition, Peloton's business partners who process data are contractually obligated to notify us if they experience certain incidents impacting our or our Members' data. Our ability to monitor the cybersecurity practices of third parties is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, network or other cybersecurity assets owned or controlled by third parties.


text: We regularly perform internal testing and engage independent third parties to perform audits and assessments as we deem appropriate. For example, our alignment with NIST standards has been reviewed by an industry-leading auditing firm. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur. We continue to invest in our cybersecurity program and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "–Any major disruption or failure of our information technology systems or websites, or our failure to successfully implement upgrades and new technology effectively, could adversely affect our business and operations", "–Cybersecurity risks could adversely affect our business and disrupt our operations", "–Our business is subject to the risk of earthquakes, fire, power outages, floods, hurricanes, public health crises, ransomware and other cybersecurity attacks, labor disputes, and other catastrophic events, and to interruption by man-made problems such as terrorism and international geopolitical conflicts", "–We collect, store, process, and use personal data and other Member data, which subjects us to legal obligations and laws and regulations related to security and privacy, and any actual or perceived failure to meet those obligations could harm our business", under the heading "Risk Factors—Risks Related to Our Business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: While everyone at Peloton has a role in managing cybersecurity risks, our Board of Directors and senior management team are actively involved in the oversight of our cybersecurity program. Our Board of Directors and the Audit Committee of our Board of Directors oversee Peloton's cybersecurity matters through regular reports and reviews, as well as reporting on material cybersecurity incidents. These include presentations by the Company's Senior Vice President, Chief Security and Trust Officer ("CISO") to the Audit Committee on a quarterly basis, along with ad hoc reports on cybersecurity incidents, threat detection and mitigation plans to the Audit Committee, our Board of Directors and our executive team.


text: Our CISO leads our information security team and has more than 20 years of cybersecurity experience across four public companies. He is supported by our Vice President of Privacy Compliance, who leads our data privacy team. Our cybersecurity program is supported by other members of our senior management team as well, including our Chief Legal Officer and members of Peloton's disclosure committee. Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process. The CISO also provides updates to Peloton's senior management regarding cybersecurity risks, and meets regularly with Peloton's finance, enterprise technology, disclosure and internal audit teams.


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "–Any major disruption or failure of our information technology systems or websites, or our failure to successfully implement upgrades and new technology effectively, could adversely affect our business and operations", "–Cybersecurity risks could adversely affect our business and disrupt our operations", "–Our business is subject to the risk of earthquakes, fire, power outages, floods, hurricanes, public health crises, ransomware and other cybersecurity attacks, labor disputes, and other catastrophic events, and to interruption by man-made problems such as terrorism and international geopolitical conflicts", "–We collect, store, process, and use personal data and other Member data, which subjects us to legal obligations and laws and regulations related to security and privacy, and any actual or perceived failure to meet those obligations could harm our business", "–Our growing use of artificial intelligence and machine learning technologies may present additional risks and challenges, which could result in reputational and competitive harm, legal liability and adversely affect our results of operations ", under the heading "Risk Factors—Risks Related to Our Business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: We have implemented and maintain a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats to (i) our information systems and data, which include critical computer networks, third-party hosted services, communications systems, hardware and software, and (ii) critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customers' data. Our cybersecurity program includes an information security policy, access management policies, an open-source policy, security incident response processes, and a supply chain policy, in addition to the secure design and vendor management programs described below. For a description of the risks from cybersecurity threats that may materially affect us, see the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Snowflake Inc.

ticker: SNOW


text: Our information systems generally fall into two categories: our platform and our corporate systems. Each category has dedicated teams and processes in place to address cybersecurity risk. Our product security team, which reports into our EVP, Engineering, works alongside our product and engineering teams to address how security is designed into our platform. Our corporate security team, which reports to our Chief Information Security Officer within our Chief Financial Officer's organization, is responsible for the secure design of our corporate systems. In addition, our Chief Information Security Officer manages a global security team that performs certain cybersecurity functions for both our platform and corporate systems, including certification management, incident response, threat detection, analytics, and offensive security (such as simulations and penetration tests).


text: We actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats we discover or that are reported to us, and reports and services that identify threats. We monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases. We also have a bug bounty program.


text: Our security teams work with management to prioritize our risk management processes and mitigate cybersecurity threats, including those that may materially impact our business. Our assessment and management of material risks from cybersecurity threats is a key risk area within our enterprise risk management program. Our Chief Information and Data Officer, Chief Information Security Officer, and EVP, Engineering are responsible for management of cybersecurity risk under our enterprise risk management program, and senior management and the audit committee of our board of directors receive reports on the key risks and the effectiveness of our management of such enterprise risks. In addition, key cybersecurity risks are assessed as part of our internal audit program. We have completed various security audits and certifications, including SOC 2 Type II, SOC 1 Type II, PCI-DSS, HITRUST, FedRAMP High, and ISO/IEC 27001. We also employ a shared responsibility model where our customers are responsible for using and configuring our platform in a manner that meets applicable cybersecurity standards. As part of this shared security model, customers have sole responsibility for creating and securing their access credentials for our platform.


text: Each of our platform and corporate systems involves the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. We also use vendors to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats to our platform and corporate systems, including consulting firms, external legal counsel, incident response vendors, penetration test providers, auditors, monitoring technology, and cybersecurity data providers. We have a vendor management program under which our corporate security, product security, and legal teams evaluate cybersecurity risks presented by our use of vendors. Depending on the nature of the technology or services provided, the sensitivity of the information systems and data at issue, and the identity of the vendor, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks. For higher-risk vendors, this process includes a vendor security questionnaire, an evaluation of the vendor's security program and security documentation, and the imposition of contractual obligations related to cybersecurity on the vendor. All vendors are required to undergo this review, which is in addition to the applicable security reviews conducted by our product security and corporate security teams described above.


text: Our board of directors has a cybersecurity committee of the board to assist it in fulfilling its oversight responsibility with respect to the management of cybersecurity risks related to our products and services as well as our information technology and network systems. The responsibilities of the cybersecurity committee include overseeing our implementation and maintenance of cybersecurity measures, data governance, and compliance with applicable information security laws. The cybersecurity committee receives reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them and has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation. In addition, our audit committee has oversight responsibility over our internal financial controls and our enterprise risk management program, including disclosure controls related to cybersecurity. Finally, management periodically provides cybersecurity briefings to the entire board of directors.


text: The members of management who are primarily responsible for assessing and managing our material risks from cybersecurity threats are Brad Jones, our Chief Information Security Officer, and Grzegorz Czajkowski, our EVP, Engineering & Support. Mr. Jones joined Snowflake in 2023 and previously served in various cybersecurity roles for over 12 years across multiple technology sectors, including manufacturing, software, and services. Mr. Jones reports to Sunny Bedi, who has served as our Chief Information and Data Officer since 2020 and, prior to joining us, served as VP of Corporate IT / Head of Global IT at NVIDIA, where his responsibilities included managing IT security. Mr. Czajkowski joined Snowflake as SVP, Engineering & Support in 2019 and, prior to joining us, served in various roles at Google, including as VP Engineering where he was responsible for a portfolio of Google Cloud data analytics and for internal services addressing data analytics needs of Google's businesses. Each of Messrs. Jones and Czajkowski is responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to management depending on the circumstances, including the individuals named above, who work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our security incident response plan provides for reporting certain cybersecurity incidents to our board of directors.


text: We have implemented and maintain a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats to (i) our information systems and data, which include critical computer networks, third-party hosted services, communications systems, hardware and software, and (ii) critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customers' data. Our cybersecurity program includes an information security policy, access management policies, an open-source policy, security incident response processes, and a supply chain policy, in addition to the secure design and vendor management programs described below. For a description of the risks from cybersecurity threats that may materially affect us, see the risk factor titled "If we, our customers, or third-party service providers experience an actual or perceived security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not being secure, our reputation may be harmed, demand for our platform may be reduced, and we may incur significant liabilities. " in the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.


text: Our information systems generally fall into two categories: our platform and our corporate systems. Each category has dedicated teams and processes in place to address cybersecurity risk. Our product security team, which reports into our SVP, Engineering and Support, works alongside our product and engineering teams to address how security is designed into our platform. Our corporate security team, which reports to our Chief Information Security Officer, is responsible for the secure design of our corporate systems. In addition, our Chief Information Security Officer manages a global security team that performs certain cybersecurity functions for both our platform and corporate systems, including certification management, incident response, threat detection, analytics, and offensive security (such as simulations and penetration tests).


text: Our security teams work with management to prioritize our risk management processes and mitigate cybersecurity threats, including those that may materially impact our business. Our assessment and management of material risks from cybersecurity threats is a key risk area within our enterprise risk management program. Our Chief Information Security Officer and SVP, Engineering and Support are responsible for management of cybersecurity risk under our enterprise risk management program, and senior management and the audit committee of our board of directors receive reports on the key risks and the effectiveness of our management of such enterprise risks. In addition, key cybersecurity risks are assessed as part of our internal audit program. We have completed various security audits and certifications, including SOC 2 Type II, SOC 1 Type II, PCI-DSS, HITRUST, FedRAMP High, and ISO/IEC 27001. We also employ a shared responsibility cybersecurity model where our customers are responsible for using and configuring our platform in a manner that meets applicable cybersecurity standards and requirements. As part of this shared responsibility cybersecurity model, customers have sole responsibility for creating and securing their access credentials for our platform.


text: Our platform and corporate systems involve the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. We also use vendors to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats to our platform and corporate systems, including consulting firms, external legal counsel, incident response vendors, penetration test providers, auditors, monitoring technology, and cybersecurity data providers. We have a vendor management program under which our corporate security, product security, and legal teams evaluate cybersecurity risks presented by our use of vendors. Depending on the nature of the technology or services provided, the sensitivity of the information systems and data at issue, and the identity of the vendor, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks. For vendors that may pose higher risks, this process includes a vendor security questionnaire, an evaluation of the vendor's security program and security documentation, and the imposition of contractual obligations related to cybersecurity on the vendor. All vendors are required to undergo this review, which is in addition to the applicable security reviews that may be conducted by our product security and corporate security teams described above.


text: Our board of directors has formed a cybersecurity committee of the board to assist it in fulfilling its oversight responsibility with respect to the management of cybersecurity risks related to our products and services as well as our information technology and network systems. The responsibilities of the cybersecurity committee include overseeing our implementation and maintenance of cybersecurity measures, data governance, compliance with applicable information security laws, and overseeing disclosure controls relating to cybersecurity. The cybersecurity committee receives reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them and has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation. In addition, our audit committee has oversight responsibility over our internal financial controls and our enterprise risk management program. Finally, management periodically provides cybersecurity briefings to the entire board of directors.


text: The members of management who are primarily responsible for assessing and managing our material risks from cybersecurity threats are our Chief Information Security Officer and our SVP, Engineering and Support. Our Chief Information Security Officer joined Snowflake in 2023 and previously served in various cybersecurity roles for over 12 years across multiple technology sectors, including manufacturing, software, and services. Our SVP, Engineering and Support joined Snowflake as VP of AI Engineering in 2023 in connection with our acquisition of Neeva, where he served as the head of engineering and, prior to that, he served in various roles at Google, including as VP Engineering in various technical leadership roles. Each of our Chief Information Security Officer and SVP, Engineering and Support is responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to management depending on the circumstances, including the individuals named above, who work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our security incident response plan provides for reporting certain cybersecurity incidents to the cybersecurity committee of the board.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate key personnel, including our Director of Operations, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are expected to be in compliance with our cybersecurity policies.


text: We engage consultants and auditors in connection with our risk assessment processes. These service providers assist us designing and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to affirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function through its audit committee.


text: Our Chief Financial Officer and members of our audit committee are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers that may bring more expertise regarding cybersecurity matters.


text: Our Chief Financial Officer and members of our audit committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Financial Officer and members of our audit committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following:


text: Our cyber security consultants operate a remote monitoring and management system which enables continuous monitoring of IT components, provides IT maintenance, and installs and maintains security and recovery capabilities including: patch management, antivirus, cloud data back up, and mobile device management.


text: Our cyber security consultants continuously monitor our environment for issues and alerts. The security tools that are installed in our systems and devices give them insight into possible suspicious behaviors. When warranted, the cyber security consultants will work with the IT support team to respond to possible security incidents as rapidly as possible.


text: Remediation: When necessary, our cyber security consultants are prepared to respond as a CIRT (Computer Incident Response Team). If necessary, security experts are prepared to perform DFS (Digital Forensics Sciences) on devices that might have been compromised.


text: Our Chief Financial Officer and key personnel provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the Board on such reports.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors, primarily through its audit committee.

companyName: Lithium Corp

ticker: LTUM


text: Board of Directors The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks, when applicable, from cybersecurity threats by the Company's Chief Executive Officer. Updates on cybersecurity matters, including material risks and threats, are provided to the Company's audit committee, and the audit committee provides updates to the Company's board of directors at regular board meetings.


text: Under the oversight of the audit committee of the Company's board of directors, the Company's Chief Executive Officer is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.


text: The audit committee of the Company's board of directors, with the assistance of the Company's Chief Executive Officer, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.


text: We are a holding company. Yubo Beijing has implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and its critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data related to its stem cell bank and customers of its light application products and health related services (collectively, the "Information Systems and Data").

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: The cybersecurity function within Yubo Beijing helps identify, assess and manage its cybersecurity threats and risks. The cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to management. Yubo Beijing implements and maintains various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to the Information Systems and Data, including, for example: an incident response policy, incident detection and response, data encryption, network security controls, system monitoring, penetration testing, employee training, a dedicated cybersecurity staff member, and physical security mechanisms.


text: Yubo Beijing's assessment and management of material risks from cybersecurity threats are integrated into its overall risk management processes. For example, the cybersecurity function works with management to prioritize the risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to its business.


text: Yubo Beijing uses third-party service providers to assist it from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. Yubo Beijing also uses third-party service providers to perform a variety of functions throughout its business, such as application providers and hosting companies. Yubo Beijing manages cybersecurity risks associated with its use of these providers by reviewing their security assessments and applicable reports.


text: Our Board considers cybersecurity risk as part of its risk oversight function and is responsible for overseeing the cybersecurity and other information technology risks. Our board also oversees Yubo Beijing's management's implementation of the cybersecurity risk management program.


text: The Board receives periodical reports from Yubo Beijing's management on cybersecurity risks. In addition, Yubo Beijing's management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Board also receives briefings from Yubo Beijing's management on the cyber risk management program. Board members receive presentations on cybersecurity topics certain Yubo Beijing's management, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Yubo Beijing's management team is responsible for assessing and managing the material risks from cybersecurity threats. The team has primary responsibility for its overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants. Yubo Beijing's management team's experience includes decades of managing public pharmaceutical companies, including their related information technology and cybersecurity risk management programs.


text: Yubo Beijing's management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Yubo Beijing; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company has cloud based security, and their computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers.

companyName: CitroTech Inc.

ticker: CITR


text: We are currently seeking and investigating potential assets, property or businesses to acquire, and currently have no material business operations. As such, we have very limited information technology systems and infrastructure in place to assist with our search with potential assets, property or businesses to acquire. Further, we have very limited cybersecurity measures in place, such as, firewalls and intrusion detection systems.

companyName: Xenous Holdings, Inc.

ticker: XITO


text: However, there can be no assurance that these measures will be effective in preventing or mitigating the impact of a cyber-attack or data breach. We cannot predict the occurrence, timing, or severity of cybersecurity incidents, but we remain committed to protecting our information assets and maintaining the trust of our stakeholders.


text: The Company's process for assessing, identifying, and managing material risks from cybersecurity threats is as follows: the Company has cloud-based security, our computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers. The Company has engaged any third-party consultants with regard to our cloud-based cybersecurity. We have had no current or previous cybersecurity incidents that have materially affected or were likely to materially affect the Company's business strategy, results of operations or financial condition.

companyName: My City Builders, Inc.

ticker: MYCB


text: The Company's management team and board of directors jointly oversee the Company's cybersecurity. The third party consultants provide monthly online security reports as well as any web based security updates and possible threats to be aware of.


text: We are an early stage biopharmaceutical company and we are focused on developing our patented DehydraTECH technology. We do not sell products and therefore do not maintain customer lists or similar personal information. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently. We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. To this end, we utilize an outsourced information technology consultant, who we believe has sufficient experience and expertise with regard to cybersecurity matters, to implement systems and procedures designed to reduce, respond to and monitor for cybersecurity threats and vulnerabilities. Our outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems monthly and has implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition.

companyName: Lexaria Bioscience Corp.

ticker: LEXX


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: Risks Associated with our Business and Industry.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: The Company has cloud-based security, and their computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers.

companyName: Pacific Sports Exchange Inc.

ticker: PSPX


companyName: BALLY, CORP.

ticker: BLYQ


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate key personnel, including our Director of Operations, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are expected to be in compliance with our cybersecurity policies.


text: We engage consultants and auditors in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to affirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our Board is the informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function through its audit committee.


text: Our Chief Financial Officer and members of our audit committee are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers that may bring more expertise regarding cybersecurity matters.


text: Our Chief Financial Officer and members of our audit committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Financial Officer and members of our audit committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following:


text: Our cyber security consultants operate a remote monitoring and management system which enables continuous monitoring of IT components, provides IT maintenance, and installs and maintains security and recovery capabilities, including patch management, antivirus, cloud data back up, and mobile device management.


text: Our cyber security consultants continuously monitor our environment for issues and alerts. The security tools that are installed in our systems and devices give them insight into possible suspicious behaviors. When warranted, the cyber security consultants will work with the IT support team to respond to possible security incidents as rapidly as possible.


text: Remediation: When necessary, our cyber security consultants are prepared to respond as a CIRT (Computer Incident Response Team). If necessary, security experts are prepared to perform DFS (Digital Forensics Sciences) on devices that might have been compromised.


text: Our Chief Financial Officer and key personnel provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the Board on such reports.


text: We are a holding company. Yubo Beijing has implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and its critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data related to its stem cell bank and customers of its light application products and health related services (collectively, the "Information Systems and Data").


text: The cybersecurity function within Yubo Beijing helps identify, assess and manage its cybersecurity threats and risks. The cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to management. Yubo Beijing implements and maintains various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to the Information Systems and Data, including, for example: an incident response policy, incident detection and response, data encryption, network security controls, system monitoring, penetration testing, employee training, a dedicated cybersecurity staff member, and physical security mechanisms.


text: Yubo Beijing's assessment and management of material risks from cybersecurity threats are integrated into its overall risk management processes. For example, the cybersecurity function works with management to prioritize the risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to its business.


text: Yubo Beijing uses third-party service providers to assist it from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. Yubo Beijing also uses third-party service providers to perform a variety of functions throughout its business, such as application providers and hosting companies. Yubo Beijing manages cybersecurity risks associated with its use of these providers by reviewing their security assessments and applicable reports.


text: Our Board considers cybersecurity risk as part of its risk oversight function and is responsible for overseeing the cybersecurity and other information technology risks. Our Board also oversees Yubo Beijing's management's implementation of the cybersecurity risk management program.


text: Our Board receives periodical reports from Yubo Beijing's management on cybersecurity risks. In addition, Yubo Beijing's management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our Board also receives briefings from Yubo Beijing's management on the cyber risk management program. Board members receive presentations on cybersecurity topics certain Yubo Beijing's management, internal security staff or external experts as part of our Board's continuing education on topics that impact public companies.


text: Yubo Beijing's management team is responsible for assessing and managing the material risks from cybersecurity threats. The team has primary responsibility for its overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants. Yubo Beijing's management team's experience includes decades of managing public pharmaceutical companies, including their related information technology and cybersecurity risk management programs.


text: Yubo Beijing's management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Yubo Beijing; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company has cloud-based security, and their computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors, primarily through its audit committee.


text: Board of Directors The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks, when applicable, from cybersecurity threats by the Company's Chief Executive Officer. Updates on cybersecurity matters, including material risks and threats, are provided to the Company's audit committee, and the audit committee provides updates to the Company's board of directors at regular board meetings.


text: Under the oversight of the audit committee of the Company's board of directors, the Company's Chief Executive Officer is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.


text: The audit committee of the Company's board of directors, with the assistance of the Company's Chief Executive Officer, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.


text: We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: LINGERIE FIGHTING CHAMPIONSHIPS, INC.

ticker: BOTY


text: We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have a trained group of people to carry out the activities of monitoring and detection of cybersecurity threats and respond to any cybersecurity threats or incidents. The Head of IT department is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners. The Head of IT Department reports to our Chief Executive Officer who reports to the Audit Committee at the board-level, as appropriate.


text: As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and financial statements.


companyName: STARGUIDE GROUP, INC.

ticker: STRG


text: As of January 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: We are currently seeking and investigating potential assets, property or businesses to acquire, and currently have no material business operations. As such, we have very limited information technology systems and infrastructure in place to assist with our search with potential assets, property or businesses to acquire. Further, we have very limited cybersecurity measures in place, such as, firewalls and intrusion detection systems.


text: However, there can be no assurance that these measures will be effective in preventing or mitigating the impact of a cyber-attack or data breach. We cannot predict the occurrence, timing, or severity of cybersecurity incidents, but we remain committed to protecting our information assets and maintaining the trust of our stakeholders.


companyName: PetroGas Co

ticker: PTCO


text: As of March 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


companyName: Natural Resource Holdings, Inc.

ticker: NRHI


text: As of April 30, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


companyName: Caro Holdings Inc.

ticker: CAHO


companyName: P2 Solar, Inc.

ticker: PTOS


companyName: Greentech Innovations, Inc.

ticker: GTIC


text: As of March 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and financial statements.


text: We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.

companyName: GIVBUX, INC.

ticker: GBUX


text: The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.


text: Our Chief Technical Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.


text: We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches.


text: A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date, the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.


text: We are in the process of implementing a structured cybersecurity risk management framework designed to assess, identify, and manage material risks from cybersecurity threats. These processes are being integrated into our overall enterprise risk management system to ensure that cybersecurity considerations are embedded within broader risk assessment and mitigation efforts. As part of this framework, we plan to engage qualified third-party consultants and auditors to assist in identifying risks, validating controls, and supporting continuous improvement. We also intend to establish oversight procedures to evaluate and monitor risks associated with our use of third-party service providers.

companyName: VERDE RESOURCES, INC.

ticker: VRDR


text: Cybersecurity Risks To date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. While we recognize that evolving cybersecurity threats could pose risks, we currently believe such risks are not reasonably likely to materially affect our performance.


text: Our Board of Directors retains overall responsibility for oversight of cybersecurity risks. Once formed, we intend to formally delegated this oversight function to the audit committee, which will receive regular reports from management regarding cybersecurity risk assessments, monitoring activities, and incident response planning. We intend to update the audit committee as frequently as warranted by material developments, but in no event less often than annually.


text: Day-to-day responsibility for managing cybersecurity risks rests with senior management, including the Chief Operating Officer, with support from external cybersecurity advisors. Management is responsible for overseeing the Company's prevention, detection, and response measures, as well as the development of incident response and recovery plans. Management receives updates from third-party service providers, consultants, and internal staff, and reports these matters to the Board of Directors or the Audit Committee on a scheduled basis.


text: The Company's process for assessing, identifying, and managing material risks from cybersecurity threats is as follows: the Company has cloud-based security, our computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers. The Company has engaged third-party consultants with regard to our cloud-based cybersecurity. We have had no current or previous cybersecurity incidents that have materially affected or were likely to materially affect the Company's business strategy, results of operations or financial condition.


text: The Company's management team and board of directors jointly oversee the Company's cybersecurity. The third-party consultants provide monthly online security reports as well as any web-based security updates and possible threats to be aware of.


text: We are an early stage biopharmaceutical company and we are focused on developing our patented DehydraTECH technology. We do not sell products and therefore do not maintain customer lists or similar personal information. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently. We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. To this end, we utilize an outsourced information technology consultant, who we believe has sufficient experience and expertise with regard to cybersecurity matters, to implement systems and procedures designed to reduce, respond to and monitor for cybersecurity threats and vulnerabilities. Our outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems monthly and has implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: Risks Associated with our Business and Industry.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors ("Board") as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, our Board has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As of the date of this Annual Report, we have not yet adopted a formal, written cybersecurity risk management policy or enterprise-wide cybersecurity governance framework. However, we are aware of the growing risks associated with cybersecurity threats and are in the early stages of assessing and developing appropriate controls to identify and mitigate such risks in proportion to our size, scale, and operational complexity. We intend to implement a formal cybersecurity risk assessment and governance policy by Q1 2026. This process will include third-party vendor risk assessment, incident response protocols, and reporting mechanisms to management and the sole director.

companyName: VITASPRING BIOMEDICAL CO. LTD.


text: While we do not currently have dedicated cybersecurity personnel or a Chief Information Security Officer (CISO), responsibility for cybersecurity-related matters currently resides with our senior management team. Management oversees the implementation of basic safeguards, including secure login credentials, limited network access, and offsite data backups. We rely on third-party cloud-based software and IT vendors for the majority of our infrastructure and data storage, and we depend on their built-in security protocols.


text: We have not yet experienced any known material cybersecurity incidents. However, the lack of a formal cybersecurity risk management framework may expose us to vulnerabilities that could have an adverse effect on our operations, financial position, or reputation if not appropriately addressed in the future. We are currently evaluating the need for a more structured cybersecurity program and anticipate allocating resources to strengthen our risk management processes as we grow.


text: Cybersecurity oversight is provided by our executive officers, who periodically review cybersecurity considerations as part of their general oversight of business operations and IT needs. The Board of Directors has not yet established a dedicated cybersecurity committee or delegated specific oversight responsibility to an existing committee. Cybersecurity risks, to the extent material, are discussed by management with the Board on an ad hoc basis.


text: Our management team is responsible for monitoring industry trends, consulting with outside IT vendors, and taking basic steps to protect company systems and data. Although none of our executive officers have formal cybersecurity credentials, we recognize the importance of increasing our capabilities in this area as we scale our operations and infrastructure.


text: The Company has cloud-based security, and their computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers.


text: We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity incidents or threats. During the reporting period, we have not, to our knowledge, experienced any material cybersecurity threats or incidents.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Company does not currently have processes in place for assessing, identifying or managing material risks from cybersecurity threats, but we intend to implement a formal cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to designing and evaluating our cybersecurity program, we intend to adopt the National Institute of Standards and Technology Cybersecurity Framework (" NIST CSF 2.0 ") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 will be for guidance purposes to frame our risk identification, assessment and management processes and will not equate to compliance with any specific technical standards or requirements.


text: key components of our future cybersecurity program are expected to include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;


text: third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents;


text: with external service providers to evaluate, enhance, or support our security measures; and incident response plan outlining specific procedures for managing cybersecurity incidents.


text: The governance of cybersecurity risks will be a critical function of our Board, which will have a key role in the oversight of cybersecurity and related technology risks. The Board will be tasked with monitoring the effectiveness of our cybersecurity risk management program, once adopted.


text: Board will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cybersecurity incidents and ongoing cybersecurity risk management efforts.


text: The responsibility for day-to-day management of cybersecurity risks lies with the Chief Financial Officer and Chief Executive Officer, with assistance from other members of management and contracted information technology consultants. The Company's contracted information technology consultants consist of highly experienced professionals in the areas of network security and disaster recovery. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach will include regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.


text: Risk Management and Strategy have established processes to assess, identify, and manage cybersecurity risks. These processes are integrated into our overall risk management program and are designed to protect our information assets from internal and external cyber threats and include: implementing physical, procedural, and technical safeguards; developing and maintaining comprehensive response plans;

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: with external cybersecurity experts to enhance our oversight and keep pace with evolving threats; and the cybersecurity capabilities of partners and third-party service providers, both prior to engaging them and on an ongoing basis.


text: Board of Directors provides direct oversight of cybersecurity risk and has delegated to its audit committee the responsibility of reviewing and discussing with management our risk exposures relating to cybersecurity. The Board of Directors and the audit committee will receive regular updates from management on cybersecurity matters and are promptly informed by management about any significant new threats or incidents. In the future, management and our third-party service providers will conduct reviews at least once annually of our cybersecurity readiness to ensure continuous improvement in our cybersecurity strategies.


text: We have implemented mechanisms to monitor and manage cybersecurity threats and incidents, including utilization of tools for continuous monitoring of our IT environment to detect and mitigate threats, a fundamental plan for responding to cyber incidents and training for employees to recognize and report potential cybersecurity incidents and to foster a culture of cybersecurity awareness and vigilance.