text: We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Our cybersecurity program is led by our chief information officer (CIO), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology (IT) and program management experience and leads a team that has many years of experience with our organization. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews cybersecurity risks at least annually, integrating findings into strategic risk assessments. Our CIO reports to our chief executive officer.

secItem: Item 1C


text: We continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least twice a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to our response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief financial officer, chief operating officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Our IT team is responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our CIO and chief financial officer, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware, and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled " Technology failures or cybersecurity breaches could have a material adverse effect on our operations. " in Item 1A- Risk Factors.


text: We maintain a cybersecurity risk management program designed to mitigate cybersecurity risks through a comprehensive framework that integrates cybersecurity into our overall risk management processes.

companyName: EVgo Inc.

ticker: EVGO


text: Risk Assessment. Our internal cybersecurity team conducts regular assessments designed to assess, identify, and manage material risks from cybersecurity threats and vulnerabilities within our systems and processes. These assessments are part of our ongoing risk management strategy and inform strategic decisions regarding security investments and policy developments. The internal risk assessment process includes periodic reviews of our charging infrastructure, software applications and operational procedures against best practices and address current and potential threats.


text: To augment our internal efforts, we engage third parties to conduct independent assessments of our cybersecurity posture. These external assessments provide an objective review of our security controls, breach readiness and compliance with industry standards and regulations. The insights gained from these audits inform refinements to our risk management strategies with respect to cybersecurity-related threats.


text: Policies and Procedures. We maintain a set of cybersecurity policies and procedures that are regularly reviewed and updated. These policies are crafted in accordance with certain components of the National Institute of Standards and Technology Cybersecurity Framework, which provides a policy foundation for critical infrastructure security. These policies govern our cybersecurity program, including but not limited to access control, system development life cycle management, change management, and incident response.


text: Monitoring Controls. In addition to our cybersecurity policies and procedures, we place significant emphasis on monitoring controls as a critical component of our cybersecurity strategy. These controls are designed to enable us to consistently oversee and evaluate the effectiveness of our cybersecurity measures to help ensure prompt detection of and response to potential threats or anomalies.


text: We maintain a continuous monitoring strategy that utilizes advanced tools and technologies to oversee our network infrastructure and digital assets. This includes data loss prevention controls, system log reviews and unusual activities that could indicate a potential security breach. Automated alert systems deployed as part of our monitoring controls are designed to enable rapid identification and escalation of suspicious activities. These systems are configured to detect a range of cyber threats, from malware infections to unauthorized access attempts.


text: Cyber Incident Response and Reporting. Our Security Incident Response Policy is designed to enable prompt and effective action in the event of a cybersecurity incident to safeguard our information technology systems, customer data and overall business operations. We are cognizant of the ever-evolving landscape of cybersecurity threats and their potential to materially impact our operations. To date, we do not believe that we have experienced any cybersecurity incidents that have had a material adverse effect on our business strategy, operations or financial condition. However, we recognize that cybersecurity threats are a significant risk factor for any organization, especially those involved in digital infrastructure. See Part I, Item 1A, "Risk Factors – Risks Related to Our Business - Our systems are susceptible to various forms of cyber threats, including computer malware, viruses, ransomware, hacking attempts, phishing attacks and other network disruptions. These incidents have the potential to lead to security and privacy breaches, loss of proprietary information and interruptions or delays in our services and operations, any of which could significantly harm our business," for further discussion.


text: Under our Security Incident Response Policy, all of our employees and other personnel are responsible for reporting any known, suspected or possible security events, including those that may have originated with a third-party service provider, to our Information Security Department, which promptly notifies our President, who serves as our Information Security Coordinator. The Information Security Coordinator reviews the initial facts and findings regarding any security events, provides direction to the Information Security Department regarding any additional information that should be obtained, and convenes a meeting of the SIRT to review the matter, including to determine if the event could constitute a security incident.


text: The SIRT is composed of employees with expertise in various aspects of our operations including information security, information technology, DevOps, legal, and EVSE engineering, as well as senior leaders, including our President, Chief Financial Officer and Chief Legal Officer.


text: Materiality Assessment, Mitigation and Reporting. Under our Security Incident Response Policy, the SIRT, under the leadership of the Information Security Coordinator, is responsible for promptly assessing the materiality of security events, developing our response to such events and, if a security event is determined to be a material incident, to oversee our disclosures regarding the incident as required by the rule adopted by the SEC related to cybersecurity disclosures. In determining whether a security event could constitute a security incident, the SIRT considers all facts and known information, including (without limitation) the potential harm to customers, employees and other parties; possible effects on our operations, financial statements, brand perception, reputation, customer or vendor relationships and competitiveness; the risk of fraud, extortion or intellectual property theft; litigation, regulatory and other legal risk; and other potential impacts. The Chair of the Audit Committee is informed of the SIRT's review of cybersecurity events and its determinations as to the materiality of such events. The Security Incident Response Policy also includes procedures for the SIRT to coordinate the containment, eradication, mitigation, recovery and remediation related to security events and security incidents and the implementation of procedures and actions designed to prevent additional security events in the future.


text: We also conduct regular cybersecurity training for employees to ensure they are aware of potential cybersecurity threats and understand the role they play in maintaining our defenses. We also monitor evolving regulations and standards to review industry best practices and legal and regulatory obligations.


text: Board Oversight of Cybersecurity. Our Audit Committee, acting pursuant to authority delegated by our full Board of Directors, actively oversees our cybersecurity strategy and risks from cybersecurity threats, as well as our broader enterprise risk management framework. Our cybersecurity team meets biweekly to assess and manage material risks from cybersecurity threats and vulnerabilities, which includes reviewing our risk profile and developing mitigation strategies with respect to those risks. We utilize vulnerability management software, which helps us identify risks within our environment. Our Audit Committee meets quarterly to review cyber security compliance initiatives as they are escalated from our cybersecurity team through management and reviews the enterprise risk matrix prepared by management on an annual basis. Our Information Security Manager has over 15 years of cybersecurity experience in information security and holds CISSP, CRISC, and Security+ certifications and has a MS in Information Assurance. Our Enterprise Risk Committee is briefed quarterly on cybersecurity threats and mitigation strategies by security. Updates include incident trends, compliance status, and responses to emerging threats. Additionally, real-time alerts ensure immediate awareness of critical cybersecurity events.


text: Board's Oversight Role. Our Audit Committee reviews and assesses our risk management program and cybersecurity activities and strategy to help align with our business objectives and compliance with legal and regulatory standards. These updates include reviews of new or evolving cybersecurity threats, our cybersecurity measures, the results of recent third-party security audits, and assessments and oversight of any recent cybersecurity events with certain characteristics that may have occurred. This oversight role includes evaluating the effectiveness of policies and procedures designed to protect our assets and sensitive customer information from cyber threats. The Chair of our Audit Committee regularly reports on our Audit Committee's oversight activities related to enterprise risk management and cybersecurity to our full Board of Directors. The Information Security Coordinator promptly notifies the Chair of our Audit Committee of any significant security events reviewed by the SIRT, the SIRT's determination of whether a security event is reportable on Form 8-K pursuant to the SEC Cyber Rule and the factors underlying that determination. If the SIRT determines that a cybersecurity incident is likely material and therefore reportable on Form 8-K, a draft of the Form 8-K will be provided to our Audit Committee for review and comment prior to us filing the Form 8-K within the deadline specified by the SEC's cybersecurity disclosure rules. Our Audit Committee's active engagement with and oversight of our cybersecurity program helps foster a culture of security awareness throughout our company.


text: In the ordinary course of our business, we collect, maintain and transmit large amounts of confidential information in digital form, including intellectual property, proprietary business information, financial information, personal information, protected health information and data to comply with cGMP and data integrity requirements. It is critical that we do so in a secure manner to maintain data security and data integrity of such information. We have established physical, electronic and organizational measures to safeguard and secure our systems to prevent a data compromise. We have also outsourced elements of our information technology infrastructure and data security processes to a number of expert qualified third-party vendors to help us stay current with data and electronic information security best practices.

companyName: NextCure, Inc.

ticker: NXTC


text: We have implemented processes designed to identify, review and manage risks from potential data breaches, unauthorized occurrences, and other information security losses on or through our information technology systems that could result in adverse effects on the confidentiality, integrity, and availability of our systems and electronic information. These processes are managed and monitored by our information technology (IT) team as managed by our Chief Operating Officer, or "COO". Our COO has experience in overseeing our cybersecurity and information technology programs. We rely heavily on information technology consultants for advice and expertise on monitoring evolving industry standards and to monitor our compliance with applicable policies. Our processes include mechanisms, controls, technologies, and systems designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. With the assistance of our third-party vendors, we conduct regular penetration and vulnerability testing, security audits, and ongoing risk assessments. Our internal information technology team conducts due diligence on key technology vendors, contractors and suppliers. We also conduct periodic employee training on cyber and information security, among other topics, and conduct internal false flag and/or phishing campaigns to identify any employees that might need additional training.


text: Our COO, together with our internal IT team, are responsible for assessing and managing cybersecurity risks. They review at least quarterly with our expert advisors our cybersecurity measures and procedures in view of the Company's cybersecurity risks to anticipate future threats and trends, and determine whether and how to adjust our strategies and processes accordingly. During the year ended December 31, 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We depend on data and our information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."


text: The Board of Directors, with the assistance of the Audit Committee, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our COO. The Board also receives updates from the Audit Committee on cybersecurity risks on at least an annual basis.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Clarus Corp

ticker: CLAR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework) and seek to follow industry best practices to identify, assess, and manage cybersecurity risks relevant to our business.


text: We conduct annual risk assessments to identify cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management and assessment process also encompasses cybersecurity risks associated with our use of third-party service providers.


text: As part of our overall risk management and assessment program, we design, implement, and maintain reasonable safeguards to minimize potential risks, including cybersecurity risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We also regularly provide cybersecurity awareness training to our employees at all levels and departments across the Company. The Company believes that we have allocated adequate resources to address the cybersecurity threats that may reasonably affect us.


text: Our cybersecurity team, consisting of the VP of Information Technology, Director of Information Security, and Director of Infrastructure, is principally responsible for managing our cybersecurity risk assessment processes, our security controls, mitigation process and our response to cybersecurity threats. The Company also participates in a cybersecurity risk insurance policy.


text: For additional information regarding cybersecurity threats that may materially affect the Company, including our business strategy, results of operations, and financial condition, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: One of the functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole and through its committees.


text: In particular, the Audit Committee of our Board of Directors monitors and assesses our financial, legal and operational risks, and receives regular reports from the management team regarding comprehensive organizational risk as well as particular areas of concern, which includes, but is not limited to, cybersecurity risks, related mitigation, and other related responses and activities.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Our information technology, communication networks, enterprise applications, accounting and financial reporting platforms and related systems are integral to our operations. We use these systems, among others, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our operations rely on securing, collecting, storing, transmitting, and processing proprietary and confidential data.

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the compensation and services agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Chief Financial Officer and Senior Vice President-Financial. These officers do not have formal IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is required to, be made).


text: Our internal auditor performs certain procedures to test the integrity and functionality of our IT systems (which includes a high-level review of our cybersecurity defenses). In addition, we have retained a third-party cybersecurity consulting firm that (i) advises us as to cybersecurity matters (including prevailing cybersecurity threats), (ii) performs, on a periodic basis, assessments of our cybersecurity defenses and (iii) on a continuous basis, monitors our IT systems for cybersecurity threats and intrusions.


text: We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report for additional discussions about cybersecurity-related risks.


text: To operate our business, we use certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs and we rely on such providers to maintain appropriate cybersecurity practices.


text: At the Board level, our cybersecurity practices are overseen by the audit committee as part of its oversight of our risk management activities. The committee meets periodically with, among others, our internal auditor and network administrator to review and discuss cybersecurity matters.


text: The Corporation's cybersecurity risk management program is designed to assess, identify, and manage material risks from cybersecurity threats and is an integral part of the overall risk management program. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. The Corporation assesses its cyber security procedures and controls on an on-going basis as safeguarding its systems and data is critical to its operations and business strategy.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: The Corporation uses third-party vendors, including a managed security service provider, to assist in monitoring, detecting, and managing cyber threats. The Board of Directors has established risk management guidelines for third-party vendors. Further, the Corporation conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. The Corporation generally has agreements in place with its service providers that include requirements related to cybersecurity and data privacy. Due diligence and oversight procedures may include, but are not limited to, reviews of financial information, internal control reports, business continuity and disaster recovery plans, and information security and cyber security policies and associated tests of effectiveness. The Corporation cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cyber incident from impacting our systems or information. Additionally, the Corporation may not be able to obtain adequate or any reimbursement from its insurance coverage or from its service providers in the event it should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, the Corporation may be held responsible for cyber incidents attributed to its service providers in relation to any data that the Corporation shares with them.


text: During 2024, the Corporation did not experience a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Corporation, including its business strategy, results of consolidated operations or financial condition. Refer to the risk factor captioned "Cyber Security Risks and Technology Dependence" in Part I, Item 1A. "Risk Factors" for additional information.


text: The Board of Directors provides oversight of the risk management program and setting the Corporation's cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. The Board has appointed a Risk Management Committee currently made up of six members of the Board with governance and oversight of the Corporation's enterprise-wide risk management program. The members of the Risk Management Committee collectively have years of business management and professional experience in the banking industry and other industries including exposure to cyber risk management considerations. The Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters. In fulfilling its role, the Risk Management Committee is actively engaged with management regarding cyber security procedures and controls to manage and mitigate cybersecurity-related risks. Management provides at least quarterly information security reports to the Risk Management Committee who provides a report to the Board of its discussions and decisions. These reports to the Risk Management Committee address management's efforts to monitor, detect and prevent cyber threats. In addition, the Board of Directors is engaged, as needed, in accordance with the Incident Response Plan.


text: The Corporation has an information security program that is primarily managed by the Information Security Department, which is led by the Chief Risk Management Officer and the Director of Information Security and supported by the Information Technology Operations Department, which is led by the Chief Information Officer. The Information Security Department is led by the Director of Information Security, and is responsible for day-to-day management of the information security program including system monitoring, vulnerability scans, employee security training including phishing exercises, security controls, and building strong relationships with security vendors. The Chief Risk Management Officer, the Chief Information Officer, the Director of Information Security and the other members of the Information Security Department are qualified by years of experience, post-secondary education, industry certifications and regular continuing education. A network penetration test and vulnerability assessment are performed at a minimum annually by a third-party vendor. The Information Security Committee is the management committee responsible for the oversight of the Information Security Program and is also responsible for policy development and information security risk assessment. This committee meets at least quarterly to discuss and review the information security program. The Information Security Program is updated at least annually and the Board of Directors, with input from the Risk Management Committee, approves all material changes.


text: The Corporation has an Incident Response Plan that provides a documented guideline for handling potential threats and taking appropriate measures including timely notification and escalation to executive leadership and the Board of Directors. The Incident Response Plan is managed by the Incident Response Team which includes the Director of Information Security, Chief Risk Management Officer, Chief Information Officer, and other essential members of management. The Incident Response Plan is reviewed and tested at least annually.


text: We operate through our subsidiaries and receive services through our intercorporate services agreement ("ISA") with Contran (see Note 17 to our Consolidated Financial Statements). We recognize the importance of proactively assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: VALHI INC /DE/

ticker: VHI


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer ("CIO"), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology ("IT"). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating reporting units. Both our CIO and the CompX director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We, Kronos and CompX continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee ("CIDAC") which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief financial officer and CIO, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: We, Kronos and CompX face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- "Risk Factors."


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats We rely on the cybersecurity strategy and policies implemented by Ares, the parent company of our Advisor. Ares' cybersecurity strategy prioritizes the detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Ares' enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Ares' cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Ares has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: Ares' cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Ares prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor or Ares. Ares' cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity threats, including those which may impact us, our Advisor or Ares, is integrated into Ares' Enterprise Risk Management program, which is overseen by the Ares Enterprise Risk Committee (the "Ares ERC"), as discussed below. In addition, Ares periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Ares cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training, including for all of the employees of Ares. Ares' cybersecurity training programs also include annual certification requirements for employees of Ares with respect to certain policies supporting the cybersecurity program including the Information Security and Electronic Communications policy, Data Protection policy and Privacy Policy. Ares undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Ares' and our critical third-party service providers and other partners. Ares also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, our Advisor or Ares, Ares has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Ares, including coordinating with the relevant members of our Advisor. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Ares' Chief Information Security Officer ("CISO"), and, as appropriate, escalation to the full Ares ERC and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Ares, as well as to the audit committee of our board of directors and to our full board of directors, if appropriate.


text: Material Impact of Risks from Cybersecurity Threats In the last three fiscal years, we have not experienced a material information security breach incident that has materially affected our business strategy, results of operations or financial conditions. The expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Our General Business Operations and Our Corporate Structure—Security incidents or cyber-attacks could adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by Ares' dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Ares' CISO, who has a Master's degree in Cybersecurity from Brown University and over 25 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Ares CISO reports cybersecurity updates to the Ares ERC. The Ares ERC is a committee that governs and oversees the Ares Enterprise Risk Program, including cybersecurity. The Ares ERC includes members of Ares' senior executive management, including its CEO, Co-Presidents, CFO, General Counsel, Global Chief Compliance Officer and Head of Enterprise Risk, who acts as chairperson of the Ares ERC. The Ares ERC, through regular consultation with the Ares internal cybersecurity team and representatives from our Advisor, assesses, discusses, and prioritizes Ares' approach to high-level risks, mitigating controls, and ongoing cybersecurity efforts.


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares' Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Material Impact of Risks from Cybersecurity Threats In the last three fiscal years, we have not experienced a material information security breach incident that has materially affected our business strategy, results of operations or financial conditions. The expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—Security incidents or cyber-attacks could adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We operate through our subsidiaries and affiliate and receive services through our intercorporate services agreement (ISA) with Contran (see Note 16 to our Consolidated Financial Statements). We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: NL INDUSTRIES INC

ticker: NL


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer ( CIO), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating business segments. Both our CIO and the director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership, and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: The Company has incorporated evaluation of cybersecurity threats into its overall risk management strategy. As such, Willdan has established a cybersecurity program designed to address applicable legal requirements. Through its internally dedicated cybersecurity team, combined with cybersecurity-specific technologies and external cybersecurity service professionals, the Company assesses, identifies, and manages material risks from cybersecurity threats to its critical computer networks, hardware and software, and data.

companyName: Willdan Group, Inc.

ticker: WLDN


text: The Company's cybersecurity team helps identify and assess risks from cybersecurity threats by monitoring and evaluating the Company's threat environment using various methods. Through the use of internal and external risk assessment audits of certain environments aimed at identifying potential areas of cybersecurity risk, external and internal monitoring alerts, and other external and internal tools (such as next generation endpoint security (EDR/XDR), SASE framework, next-gen firewalls, and external-party monitoring of endpoint and cloud security environments), the Company performs ongoing assessments of its cybersecurity risks that are designed to take into account the rapidly evolving cybersecurity threat landscape. Further, in conjunction with its ISO 27001 and SOC2 certifications, the Company undergoes annual external audits that include reviews of its cybersecurity risk assessment processes and policies.


text: In an attempt to manage and mitigate material risks from cybersecurity threats, the Company's cybersecurity risk management process includes certain preventive measures, detective controls, and incident response procedures, depending on the environment and systems. This includes implementing security controls in certain environments and systems, ongoing monitoring of certain environments and systems, adopting response protocols for security incidents, and maintaining cybersecurity insurance. The Company's cybersecurity risk management approach is periodically reviewed by management and certain external service professionals to assess whether any changes are needed to reflect changing threats.


text: In addition, assessment and management of material risks from cybersecurity threats are integrated into the Company's risk management strategy. For example, our cybersecurity team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation, impact our ability to operate, and other material adverse consequences.


text: The Company engages third-party cybersecurity consultants and auditors who help the cybersecurity team in identifying, assessing, and managing material risks from cybersecurity threats, including by evaluating and enhancing the Company's cybersecurity posture. The Company also engages third-party service providers to perform a variety of functions throughout its business. The Company performs due diligence before engaging with certain third-party service providers designed to evaluate the service providers' cybersecurity practices, including their security policies, incident response capabilities, and data protection measures; including specific cybersecurity requirements in contracts with certain third-party service providers, such as regarding security standards, data protection, and incident reporting as applicable; and monitoring and auditing certain third-party service providers' cybersecurity practices and compliance with contractual obligations. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, the Company's vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the certain members of Company management, including those who are part of the Company's cybersecurity team. The Company's cybersecurity team is comprised of individuals with expertise in cybersecurity, information technology, risk management, and Company operations. Our cybersecurity team has decades-long experience in cybersecurity and holds industry-standard certifications including Certified Information Systems Security Professional ("CISSP"), and Certified Cloud Security Professional ("CCSP"), among others.


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Company's cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel (collectively, "Executive Management"). Executive Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Board for certain cybersecurity incidents.


text: The Company's Board provides oversight of cybersecurity risk and regularly receives updates from the Company's cybersecurity team. These updates cover topics that include cybersecurity team member updates, cybersecurity infrastructure updates, improvement in cyber-security tools and technologies, cybersecurity framework compliance, cyber-risk hardware/software enhancement updates, cybersecurity threats and mitigation measures, and more. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We recognize the importance of maintaining the trust and confidence of our investors, patients, business partners, and employees. Our board of directors are actively involved in the oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the international organization for standardization. In general, we seek to address cybersecurity risks through a comprehensive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Collaborative Approach We have implemented a comprehensive cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have established and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: We maintain a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers, and other external users of our systems, as well as the systems of third-parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness We provide regular mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools and education to address cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices.


text: One of the key functions of our board of directors is informed oversight of our ERM, including risks from cybersecurity threats. Our board of directors receive regular presentations and reports on our cybersecurity risks, which have pertained to a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third-parties. The board of directors also receive prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed and resolved.


text: On an annual basis, the board of directors discuss our approach to cybersecurity risk management with management which includes our Chief Information Officer ("CIO"). Our CIO has overall operational responsibility for our cybersecurity risk management. To facilitate the success of our cybersecurity risk management program, we have an Infrastructure, Operations & Security Team ("IOS Team") that is tasked with the responsibility to design, implement, and manage systems, processes, and policies to defend against cybersecurity threats and to respond to cybersecurity incidents. Working collaboratively across our Company, the IOS Team implements and maintains a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.


text: WhiteHorse Finance, Inc. (the "Company," "we," "us," or "our") maintains structured processes to proactively assess, identify, manage, and mitigate material risks from cybersecurity threats. The Company's business remains dependent on the communications and information systems of WhiteHorse Advisers, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations and is subject to periodic updates, reviews, and independent assessments.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The program is aligned with the NIST CSF 2.0 framework, providing a structured approach to identify, protect against, detect, respond to, and recover from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. In addition, the Investment Adviser actively monitors the current threat landscape to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Investment Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company, in coordination with the Investment Adviser's risk management, legal, information technology, and compliance teams, conducts ongoing due diligence on third-party service providers (including contractual provisions and regular compliance attestations) to ensure they meet requisite cybersecurity standards. For critical vendors, the Company requires SOC 2 Type II reports or similar independent cybersecurity assessments. In lieu of these reports, vendors may provide compensating materials demonstrating the structure and management of their cybersecurity programs.


text: Board Oversight of Cybersecurity Risks The board of directors of the Company (the " Board ") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Information Security Officer ("CISO") of the Investment Adviser and Chief Compliance Officer ("CCO") of the Company regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and briefing on material risks from cybersecurity threats and material cybersecurity incidents impacting the Company.


text: The full Board is collectively responsible for oversight of cybersecurity matters and is updated at every Board meeting. In these updates, the Company's management and the Investment Adviser's CISO provide reports on key metrics such as vulnerability scan results, third-party risk assessments, and incident response readiness. The Board also ensures its members receive periodic training or engage external advisors with cybersecurity expertise to strengthen oversight capabilities.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the CISO of the Investment Adviser, manages the Company's cybersecurity program, under the supervision of the Company's Chief Executive Officer. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Investment Adviser's CISO has 23 years of experience actively managing cybersecurity and information security programs for financial services companies with complex and evolving information systems. The Company's CCO has been responsible for this oversight function as CCO of the Company for 10 years and has worked in the financial services industry for over 20 years, during which time the CCO of the Company has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company, in coordination with the Investment Adviser, actively monitors cybersecurity incident prevention, detection, mitigation, and remediation efforts. The CCO of the Company and the CISO of the Investment Adviser jointly lead the incident response process and escalate incidents to the Board in accordance with established escalation protocols, typically within 48 hours after determining that a cybersecurity incident reaches materiality thresholds requiring Board notification.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company is assessed on an ongoing basis, including how such risks may materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. Management of the Company uses both internal and external inputs—such as threat intelligence feeds, penetration test reports, and third-party cybersecurity assessments—to update these risk evaluations. During the reporting period, the Company had not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Although there have been no identified material incidents to date, Management of the Company periodically reviews even non-material incidents and near misses to evaluate risk trends and improve response processes. In the event a cybersecurity incident is deemed potentially material, the Company's incident response plan requires immediate notification to the CCO of the Company, CISO of the Investment Adviser, and the Board, followed by regular status updates until resolution.


text: The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company's risk management strategy.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence tools.


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology, employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act, the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool. Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.


text: The Board Enterprise Risk Management ("ERM") Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls. The Chief Information Officer ("CIO") manages the IT Department and reports to the ERM and Chief Risk Officer ("CRO") on these matters. The CIO also supervises the Information Security Officer ("ISO") who is responsible for implementing and maintaining the Company's Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company's Risk Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The Risk Committee is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank's corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank's Information Technology ("IT") Steering Committee in conjunction with the Bank's Project Management Office oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.


text: The Risk Committee provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the Risk Committee at each meeting. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Risk Committee. Cybersecurity metrics are reported to both management level committees and the ERM Committee and Risk Committee on a quarterly basis.


text: The Board of Directors recognizes the importance of the FFIEC for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: We continually monitor and evaluate the evolving cybersecurity landscape and the potential impact of cybersecurity incidents on our business. We may incur additional costs to enhance our cybersecurity processes and controls, to comply with new or changing laws, regulations, or contractual obligations, or to respond to or recover from cybersecurity incidents. We may also experience reputational harm or loss of customer confidence or trust as a result of cybersecurity incidents. Any of these factors could have a material adverse effect on our business, financial condition, results of operations, and reputation.


text: Despite our efforts to enhance our cybersecurity posture, we cannot guarantee that our processes and controls will be sufficient to prevent or mitigate all cybersecurity risks and threats that we face. We may experience cybersecurity incidents that result in unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; disruption or degradation of our operations; loss of customers or business opportunities; regulatory investigations or enforcement actions; litigation or liability; reputational damage; or increased costs.


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with Enterprise Risk Management, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT Steering Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches; Ensuring that changes to security configurations are documented, approved, and tested; Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs; Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities; Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks;


text: Conducting subsequent penetration testing and vulnerability assessments, as warranted; and Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis, which may identify additional risks or require additional costs to remediate.


text: Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information.


text: In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Vendor Relationships: Risk Management. The Vendor Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO reports to the Board of Directors, directly or through the ERM Committee, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CIO is responsible for implementing and maintaining the IRP, which includes:


text: Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents; Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents;


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures; Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP;


text: Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures and Report up to the Executive Incident Response Committee, as needed.


text: Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Director of Information Technology on the status of our cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: 908 Devices Inc.

ticker: MASS


text: Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer). Currently, the Director of Information Technology role is held by an individual who has approximately 20 years of information technology experience and 11 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.


text: We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process, supported by security testing, that is designed to address the treatment of identified security risks based on severity.


text: As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of major third-party vendors and service providers that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems, including through review of applicable certifications, and security reports, and contractual requirements, as appropriate.


text: We have implemented a process to periodically conduct security awareness training for employees and simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.


text: Our Director of Information Technology and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use various internal and external processes and technologies, including third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We have adopted an incident response plan to guide us in responding to cybersecurity incidents and maintain processes to inform and update executive management and the audit committee about security incidents that may pose a significant risk for our business, as applicable.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature, including information regarding our product architecture, software, algorithms, and applications ("Information Systems and Data").

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Our information security function is supported by members of our legal team and a third party service provider, which helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting vulnerability assessments to identify vulnerabilities; and analyzing external threat intelligence feeds.


text: Depending on the environment, product, or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: performing risk analyses, establishing an incident response policy, having vulnerability management processes, and implementing certain security certificates for certain functions of our business; encrypting certain data, using network security controls; segregating data; maintaining access and physical security controls; managing, tracking, and disposing of assets; and monitoring our systems. In addition, we may refer to and perform assessments against the Center for Internet Security's Critical Security Controls to help inform our cybersecurity program, as well as perform assessments such as penetration tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) our information security function works with management, including our Chief Technology Officer ("CTO"), to prioritize our risk management processes and mitigate cybersecurity threats that could more likely lead to a material impact to our business; (3) our senior management/committee evaluates material risks from cybersecurity threats against our overall business objectives and on a quarterly basis reports to the cybersecurity subcommittee of the audit committee of the board of directors, with the cybersecurity subcommittee reporting to the audit committee of the board of directors, which oversees our cybersecurity risk as part of our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; and cybersecurity software and managed cybersecurity service providers. We use third-party service providers to perform a variety of functions throughout our business, such as application providers and public cloud providers, as well as various third-party suppliers that support our manufacturing and development processes. We use certain vendor management processes to manage cybersecurity risks associated with our use of these providers, which includes reviewing the written information security programs of certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. This can extend to contingent workers as well, who are required to complete background investigations and agree to adhere to policies, including for privacy and cybersecurity.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee, and specifically the subcommittee for cybersecurity, is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our legal team along with third-party service providers in coordination with the CTO. The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for potential cybersecurity incidents, approving technical cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our CTO has over 20 years of experience in engineering and information technology management at various organizations. Our CTO collaborates regularly with our third-party service provider who provides a fractional Chief Information Security Officer, who has extensive experience in cybersecurity and a certification as a CISSP.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances in accordance with the incident response policy, including the CTO, CFO, CEO, and others. Our information security function, together with our CTO, works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the cybersecurity subcommittee of the board of directors' audit committee for certain cybersecurity incidents in accordance with the incident response plan. The cybersecurity subcommittee receives periodic reports from the CTO, which reflect input from the third-party service provider, concerning the Company's risk profile, including significant cybersecurity threats and risk and the processes the Company has implemented to address them. The cybersecurity subcommittee also has access to various reports, summaries and presentations related to cybersecurity threats, risk and mitigation.


text: As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we have in the past and also anticipate in the future we will be subject to cybersecurity incidents. We have in place insurance coverage designed to provide coverage in connection with cybersecurity incidents, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; loss of intellectual property or other confidential business information; and other adverse consequences, which may adversely affect our business.


text: We identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and conducting risk assessments.

companyName: Cryoport, Inc.

ticker: CYRX


text: We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.


text: We also engage third parties to assist with cybersecurity risk assessments, incident detection and response, vulnerability management, systems monitoring, and employee training.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect Cryoport, including our business strategy, results of operations, or financial condition. Refer to "Part I, Item 1A—Risk Factors—Risks Related to Our Technology and Intellectual Property—Cyberattacks, data incidents and breaches in the security of our information systems and networks and of the electronic and confidential information in our possession could materially adversely impact our business, financial condition and results of operations, in addition to our reputation and relationships with our employees, customers, suppliers and business partners" in this Form 10-K for additional discussion about cybersecurity-related risks.