text: Plan outlines steps to investigate, contain, report, and recover from cybersecurity events. We have established internal procedures to investigate, contain, report, and recover from cybersecurity incidents. These procedures are designed to enable a prompt and coordinated response to potential threats. In the event of an incident determined to be material under SEC guidelines, we are prepared to make timely disclosures through current reports (Form 8-K) as required.


text: During the fiscal years ended April 30, 2025 and 2024, we did not identify any cybersecurity incidents that had a material impact on our operations, liquidity, or financial condition. We did observe routine scanning, phishing attempts, and minor technical vulnerabilities, all of which were mitigated without operational disruption or data loss.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT

secItem: Item 1C


text: While no material incidents have occurred, we cannot guarantee that future incidents will not materially affect our company, especially as we expand digital product features, enter new geographic markets, and integrate with third-party systems.


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the headings "Failure of our information systems or those of third parties or breaches of data security could cause significant harm to our business" and "Cybersecurity breaches of our systems and information technology could adversely impact our ability to operate or meet contractual obligations," which should be read in conjunction with the information above.


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Nordicus Partners Corp

ticker: NORD


text: Risk Management and Strategy the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks.


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing, if deemed necessary. We utilize well-known cloud-based technologies and service providers such as Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies. from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition.


text: Our system of internal controls includes consideration of cybersecurity risks. We use technology and control procedures designed to mitigate cybersecurity risks, with our management team working to monitor, identify, assess, and respond to potential cybersecurity incidents that may threaten the Company. The system of controls also focuses on security awareness and training for employees with access to Company systems. Company management periodically reviews system and organization control reports (SOC 1, Type 2) for key outsourced information systems to ensure that third-party data processing is subject to appropriate controls and security measures. have engaged with a third-party information technology firm to assess our vulnerabilities and help us mitigate cybersecurity-related risks.

companyName: U.S. GOLD CORP.

ticker: USAU


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and necessary implementations.


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. Our Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents, if any. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations of April 30, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.

companyName: Landbay Inc

ticker: LNBY


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.


text: In addition, the Board will oversee any cybersecurity risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices.


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.


text: We believe cybersecurity is critical to advancing our technological advancements. As a fintech company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Netcapital Inc.

ticker: NCPL


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks.


text: We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Rocky Mountains Group Ltd


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the system and organization controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such an incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled " Risk Factors " in Governance


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. Our executive management team informs our Audit Committee on cybersecurity risks on a regular basis, at least once per year.


text: The Audit Committee is primarily responsible for assisting our board of directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and reports to our CEO.


text: This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by our group.


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: SPARTA COMMERCIAL SERVICES, INC.

ticker: SRCO


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. Our third-party consultant team is managed by our Vice President Operations who reports to the Chief Executive Officer or the board-level, as appropriate.


text: As of April 30, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: Cybersecurity risk is the risk of harm or loss resulting from misuse or abuse of technology or the unauthorized disclosure of data.

companyName: AIRWA INC.

ticker: YYAI


text: To preserve the confidentiality, integrity, and availability of our information systems, and to safeguard our assets, data, intellectual property, and network infrastructure, while meeting regulatory requirements, it is crucial to effectively manage cybersecurity risk.


text: To achieve this, we have implemented a comprehensive cybersecurity risk management framework, which is integrated into our overall enterprise risk management system and processes and is internally managed.


text: IT staff is tasked with assessing, identifying, and managing cybersecurity threats and is responsible for: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, and services and to our broader enterprise IT environment; of risk-based action plans to manage identified vulnerabilities and implementation of new protocols and infrastructure improvements; incident investigations; threats to sensitive data and unauthorized access to our systems;


text: access control measures to critical IT systems, equipment, and devices, which measures are designed to prevent unauthorized users, and executing protocols to ensure that information regarding cybersecurity incidents is shared promptly with the Board, as appropriate, to allow for risk and materiality assessments and to consider disclosure and notice requirements; and and implementing training on cybersecurity, information security, and threat awareness.


text: There were no cybersecurity incidents during the financial year ended April 30, 2025, that resulted in an interruption to our operations or known losses of any critical data or that otherwise had a material impact on our business strategy, financial condition, or results of operations. However, the scope and impact of any future incident cannot be predicted. See Item 1A, "Risk Factors," for more information on how material cybersecurity attacks might impact our business.


text: Board acknowledges the significance of robust cybersecurity management programs and actively participates in overseeing and reviewing our cybersecurity risk profile and exposures. Our Board receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents. Furthermore, in the event of any significant updates or adjustments to our cybersecurity related policies, our IT staff will present them to the Board for their review and approval.


text: IT staff are responsible for the daily management of our cybersecurity efforts. This includes updates and refinement of cybersecurity policies, execution and management of cybersecurity measures, and the preparation of regular reports on cybersecurity execution. Their primary focus is to consistently update our cybersecurity programs and mitigation strategies, ensuring they align with industry best practices and procedures.


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: Management and Strategy have recently implemented additional security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack.


text: All employees received cybersecurity training and other education regarding their use of computers, information technology, and sensitive data including specifically how to recognize common attack strategies. As many of our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.


text: Our current cybersecurity management strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic cybersecurity testing. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted internally and with our IT consultants and service providers, as needed. We have recently begun reporting on cybersecurity in reports to the Board of Directors and will continue to do so.


text: Board of Directors is responsible for oversight of cybersecurity risk. Our Chief Financial Officer and Chief Executive Officer are the members of management responsible for managing and assessing our cybersecurity practices and have commenced reporting on such practices and risks. The plan for the future is that they will continue to report to the Board on cybersecurity at least quarterly. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. We believe we are appropriately staffed (as supported by IT consultants and service providers, as needed) to support a healthy cybersecurity posture given our size and scope.


text: Chief Financial Officer, who reports to the Chief Executive Officer, is directly responsible for IT functions and has extensive experience as a chief financial officer, chief operating officer and special projects lead, with expertise in accounting, taxation, business advisory, business risks identification and management and business systems designs across many industries, including the application of IFRS and US GAAP for the life science industry.


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: Deep Green Waste & Recycling, Inc.


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.


text: In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors or an officer appointed by our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats. a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: GLOBALINK INVESTMENT INC.

ticker: GLLI


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. of the date of this report, we have not encountered any cybersecurity incidents since our IPO.


text: Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders.

companyName: BlueOne Card, Inc.

ticker: BCRD


text: We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:


text: Our Board of Directors and senior management are actively involved in overseeing our cybersecurity policies and practices and managing those responsible for coordinating and implementing cybersecurity initiatives across the organization.


text: Risk Assessment and Management: We conduct risk assessments to identify potential cybersecurity threats and vulnerabilities. This includes evaluating the likelihood and potential impact of various threats, such as data breaches, malware attacks, and insider threats. Based on these risk assessments, we develop and implement risk management strategies to mitigate identified risks.


text: Information Security Policies and Procedures: We have established information security policies and procedures that govern the use, protection, and handling of sensitive information. These policies cover areas such as data encryption, access controls, password management, incident response, and employee training.


text: We employ a range of technical measures to secure our network and infrastructure, including firewalls, intrusion detection and prevention systems, and vulnerability assessments. We also use encryption to protect data both in transit and at rest.


text: Employee Training and Awareness: We provide cybersecurity training to employees to raise awareness of the latest threats and best practices for protecting sensitive information. This includes training on how to recognize phishing attempts, handling secure data, and reporting security incidents.


text: We assess the cybersecurity practices of our third-party vendors and service providers, including conducting due diligence on vendors before engaging their services and monitoring their compliance with our security requirements.


text: We comply with all applicable laws and regulations related to cybersecurity, including data protection and privacy laws.


text: While we believe that our current cybersecurity measures are robust, we recognize that the cybersecurity landscape is constantly evolving, and we remain vigilant in monitoring and adapting our practices to address emerging threats. We are committed to maintaining the confidentiality, integrity, and availability of our systems and data and to protecting the interests of our clients and stakeholders.


text: We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature, or collectively, Information Systems and Data.

companyName: BIOMERICA INC

ticker: BMRA


text: Our cybersecurity threat risk management processes include the following, among others: have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management particularly since we utilize a third-party IT managed services vendor. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department and our IT managed services to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: IT managed services vendor implements and maintains various technical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. maintain continuous oversight through regular monitoring, which includes annual evaluations of Service Organization Control (SOC)


text: reports for our providers and the implementation of additional complementary controls as needed. This proactive approach is designed to mitigate risks related to data breaches or other security incidents that could originate from third-party interactions.


text: Board of Directors oversees cybersecurity risk management, including the practices that management implements to prevent, detect and address risks from cybersecurity threats. The Board of Directors receives regular quarterly briefings on cybersecurity risks including any cybersecurity incidents or threats that may occur or have occurred from the CFO. The Board of Directors may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same.


text: For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see "Failures in our information technology and storage systems or data security breaches could significantly disrupt our business or force us


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: Cyber Risk Management and Strategy the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident.


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We utilize well-known cloud-based technologies and service providers such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats. We have a special email encryption from Google that protect against cyberthreats.


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: Risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors— Risks Related to Our Company and Our Business— Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm our business.


text: Risk Management and Strategy have processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our risk management activities are overseen by senior management and are integrated into our overall enterprise risk management framework. As part of this process, management identifies and assesses internal and external cybersecurity risks and the potential impact of such risks on our business.

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: We utilize external information technology consultants to provide technical support for our systems and to advise on security matters. Risks associated with third-party service providers who have access to our data are evaluated during the vendor selection process.


text: To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations, or financial condition. However, we face a variety of cybersecurity threats that are reasonably likely to materially affect our company in the future, which are further described in "Item 1A. Risk Factors."


text: Board of Directors is responsible for the oversight of risks from cybersecurity threats. As the Company does not have a separately constituted audit committee, the entire Board of Directors fulfills this function. The Board receives reports from management on an as-needed basis regarding information technology and security matters, allowing it to monitor the Company's risk management processes.


text: Our senior management is responsible for the day-to-day assessment and management of our cybersecurity risks. This function is led by our Chief Executive Officer and Chief Financial Officer, who have overall responsibility for the Company's risk management. our executive officers are not cybersecurity experts, they have extensive experience in business management and corporate governance.


text: For specific technical expertise, management leverages and consults with our external information technology consultants to advise on threat identification, prevention, and other cybersecurity matters. In the event of a cybersecurity incident, management would be responsible for implementing response procedures and reporting the matter to the Board of Directors.


text: We believe cybersecurity is critical to advancing our technological developments. As a manufacturing and technology company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: ZRCN Inc.

ticker: ZRCN


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a public company, we must comply with extensive regulations, including requirements for reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.


text: The Audit Committee of our Board of Directors is responsible for overseeing management's processes for identifying and mitigating risks that affect our operations, including cybersecurity risks. Procedures for assessing, identifying and managing cybersecurity-related risks are incorporated into our overall risk management framework. Senior leadership regularly briefs the Audit Committee and the full Board of Directors on our cybersecurity and information security posture and the Audit Committee is apprised of cybersecurity incidents deemed to pose a critical risk to our information technology ("IT") assets or business. We have an incident response playbook that outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying key functional areas, such as legal and financial reporting, as well as senior leadership and the Audit Committee, as appropriate. We rely upon in-house and cybersecurity vendors to monitor our IT systems and assets and have a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: vTv Therapeutics Inc.

ticker: VTVT


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the FDA related to adequately safeguarding patient information. We work with our in-house and cybersecurity vendors on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We have engaged third-parties to conduct evaluations of our security controls, including through penetration testing, independent audits, and consulting on best practices to address new challenges. We require that our employees and subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on our systems and operations.


text: We currently have one full-time employee who manages our day-to-day information technology systems and the third-party vendors engaged to assist in such management, including monitoring and addressing cybersecurity matters and reports to our Chief Financial Officer. Our cybersecurity vendor, which has a SOC 2 Type II Report and is ISO 27001 certified, utilizes industry-leading processes to monitor in real-time cybersecurity threats and risks to our systems. Our in-house IT resource receives immediate notification of incidents and engages regularly with our cybersecurity vendor through weekly and monthly reports and quarterly meetings to address any issues identified through their processes and communicates such issues in accordance with our incident response plan.


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the risks we face from cybersecurity threats, please see the risk factor titled "Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cyber-security" included in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the risks we face from cybersecurity threats, please see the risk factor titled "Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cybersecurity" included in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: Our board of directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), the International Organization for Standardization Information Security Management System Standard (ISO 27001) and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to any cybersecurity incidents.

companyName: Shockwave Medical, Inc.


text: As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with our ERM function, our Chief Information Security Officer ("CISO"), our Chief Digital & Information Officer ("CDIO") and other members of management involved in cybersecurity risk management.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We deploy technical and non-technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We operate a security operations center which monitors our environment in a continuous manner.


text: We have established and maintain business continuity and technical recovery plans of critical systems and resources in the event of a cybersecurity incident that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. We also maintain a cybersecurity insurance policy, though the costs related to cybersecurity threats or disruptions may not be fully insured.


text: We maintain a third-party cyber risk management program to identify and oversee cybersecurity risks presented by third party providers, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In the event we identify a risk, we communicate the risk to the third party and monitor the remediation. In the event of a critical risk that may cause imminent or material damage to us or our customers, our policy provides that we cease operating with such third party until the risk is remediated.


text: We provide regular, mandatory training, including ongoing end-user security awareness training and attack simulation assessments, for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, including through a formal annual risk assessment. These efforts include a wide range of activities, including external audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, endpoint reduction response, security operation centers, vulnerability and patch management programs and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We have not identified risks from known cybersecurity threats that we believe have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: The Board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee receives quarterly reports, and the Board is briefed at least once annually, on cybersecurity risks from the CISO, which address a wide range of topics including the status and specific metrics on our cybersecurity program, recent developments, evolving standards and regulations, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee would receive prompt and timely information regarding any future cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board and the Audit Committee discuss our approach to cybersecurity risk management with our CISO, CDIO and other members of management involved in cybersecurity risk management regularly.


text: The CISO and CDIO work collaboratively across the business to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any future cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the organization are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CDIO are informed about, and monitor the prevention, detection, mitigation and remediation, of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Our CISO has served in various leadership roles in information security, including serving as the Chief Information Security Officer at two other companies. Our CISO holds an undergraduate degree in Information Systems and a master's degree in Cybersecurity and Information Assurance and has obtained multiple professional security certifications including Certified Chief Information Security Officer. Our CDIO holds an undergraduate degree in Management Information Systems with minors in Computer Science and Economics and has served in various leadership roles in information technology, including serving as the Chief Information Officer of two public companies.


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized activity on or conducted through our production and information systems that may result in adverse effects on the confidentiality, integrity, or availability of our systems or any information residing therein.

companyName: Samsara Inc.

ticker: IOT


text: We routinely conduct risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change that may affect production and information systems that are vulnerable to such cybersecurity threats and assessments in the event Samsara-specific or industrywide relevant vulnerabilities are discovered. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether, and if so, how, to design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. For example, to advance and demonstrate our commitment to data security and privacy, we have achieved four cybersecurity-related certifications under standards promulgated by the International Organization for Standardization (ISO). We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (our "CISO"), who reports to our Chief Information Officer, to manage the cybersecurity-related risk assessment and mitigation process.


text: As part of our overall risk management system, we regularly monitor and test our safeguards and train our personnel on these and other safeguards, in collaboration with our human resources, business technology, and management teams. Personnel across the company are made aware of our cybersecurity policies and procedures through training.


text: We are regularly audited and assessed pursuant to the System and Organization Controls (SOC 2) established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We regularly use the Cybersecurity Framework published by the National Institute of Standards and Technology–a framework of standards, guidelines, and best cybersecurity practices–to evaluate our security program and to plan improvement.


text: We engage assessors, consultants, outside counsel, and other third parties in connection with our cybersecurity-related risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. For example, we engage independent entities to conduct platform, infrastructure, and hardware-level penetration tests on at least an annual basis.


text: Like other technology companies, we have faced and expect to face cybersecurity threats on an ongoing basis. As of the date of this Annual Report on Form 10-K, however, we do not believe that any prior cybersecurity-related threats or incidents have materially affected our company. In addition, we require other third-party service providers with access to our systems or processing sensitive data for us to certify that they have the ability to implement and maintain reasonable and appropriate security measures, consistent with all applicable laws, in connection with providing services to us, and to promptly report any suspected breach of their security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," including "Risk Factors—Risks Related to Our Business, Industry, and Operations: If we experience a security breach or incident affecting our customers' assets or data, our data or IoT devices, our Data Platform, or other systems, our Connected Operations Cloud may be perceived as not being secure or safe, our reputation may be harmed, and our business could be materially and adversely affected." and elsewhere in this Annual Report on Form 10-K.


text: A key function of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight responsibilities as a whole, as well as through our Audit Committee.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO, as of the date of this report, has experience in cybersecurity leadership roles at Microsoft Corporation, where he helped drive core security programs for the Windows operating system, including platform integrity, cryptography, data protection, identity and access control. He also held a leadership role in the mergers and acquisition security program at Salesforce, Inc., which included the assessment and remediation of security of potential and approved acquisitions. After he obtained his Bachelor of Science Degree in Electrical Engineering, he served for eight years as a Nuclear Submarine Officer for the U.S. Navy. He also has a Master of Business Administration degree.


text: Our CISO is supported by a team of personnel with experience in cybersecurity, including at other public companies in the technology industry.


text: Our CISO oversees our cybersecurity policies and processes, including those described in the section titled "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: • Ongoing threat intelligence monitoring aimed at helping Samsara identify threats that may impact Samsara's production and information environments; • Mechanisms for real-time or otherwise prompt reporting through multiple channels, including e-mail and instant messaging to a team of on-call incident responders; • Supplemental retrospective reviews of reported incidents to identify trends and track resolution of incidents identified during the incident review process; • Routine product reviews to assess progress on key security initiatives, along with assessing existing and emerging product-related risks; and • Annual tabletop exercises in which we test our incident response procedures with management representatives from across the company.


text: Our CISO provides periodic briefings to our Audit Committee regarding cybersecurity risks and activities, including recent cybersecurity incidents and related responses, cybersecurity systems testing, cybersecurity training efficacy, and cybersecurity risks. As necessary, our Audit Committee provides periodic updates to our Board of Directors on such reports. In addition, our CISO provides periodic briefings to the Board of Directors on cybersecurity risks and activities.


text: Following these risk assessments, we evaluate whether, and if so, how, to design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (our "CISO"), who reports to our Chief Information Officer, to manage the cybersecurity-related risk assessment and mitigation process.


text: To advance and demonstrate our commitment to data security and privacy, we have achieved four cybersecurity-related certifications under standards promulgated by the International Organization for Standardization (ISO). Additionally, we are regularly audited and assessed pursuant to the System and Organization Controls (SOC 2) established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We regularly use the Cybersecurity Framework published by the National Institute of Standards and Technology–a framework of standards, guidelines, and best cybersecurity practices–to evaluate our security program and to plan improvement.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," including "Risk Factors—Risks Related to Our Business, Industry, and Operations: If we experience a security breach or incident affecting our customers' assets or data, our data or IoT devices, our Data Platform, or other systems, our Connected Operations Platform may be perceived as not being secure or safe, our reputation may be harmed, and our business could be materially and adversely affected." and elsewhere in this Annual Report on Form 10-K.


text: We maintain a cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats, including by regularly assessing risks from cybersecurity threats and monitoring our information systems for potential vulnerabilities. Our cybersecurity program is designed to align with the National Institute of Standards and Technology Cybersecurity Framework.

companyName: RMR GROUP INC.

ticker: RMR


text: We take various actions designed to maintain and protect the operation and security of our information technology and systems, including the data maintained in those systems. We conduct data security education and testing for our employees, in addition to penetration testing and unannounced email phishing exercises. Additionally, we have implemented a third-party risk management process for third party service providers and vendors. Extensive security questionnaires are issued to third party providers and vendors, the responses to which are weighted and reviewed by our security and compliance team. High risk vendors are reviewed at least biennially and new vendors that interact with our data are assessed as part of our vendor procurement process. In the event of a cybersecurity incident, we have a detailed incident response plan in place for contacting authorities and informing key stakeholders. In addition, we have engaged a qualified third party who conducted an external assessment of our cybersecurity controls.


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information on cybersecurity risks and potential related impacts on us, see Part I, Item 1A. Risk Factors, "We rely on information technology and systems in our operations, and any material failure, inadequacy, interruption or security breach of that technology or those systems could materially harm our business."


text: Our Board of Directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. Our Audit Committee takes a leading role in oversight of risk management, including risks related to cybersecurity, and receives reports from our management regarding cybersecurity risks and countermeasures being undertaken or considered by us, including updates on the internal and external cybersecurity landscape and relevant technical developments and more frequent reports as it may direct or as warranted. Our cybersecurity program is led by our Chief Information Officer, or CIO, who has over two decades of relevant experience in information technology and cybersecurity and has primary responsibility for assessing and managing material risks from cybersecurity threats and overseeing our cybersecurity team. Our CIO has previously held senior information technology and security roles, including as CIO of a global real estate firm and of a real estate investment trust. Our Director of Information Security and our cybersecurity team are responsible for, among other things, information technology failure mitigation and business continuity, cybersecurity threat detection and incident response and continuous network monitoring. Our cybersecurity team members have a broad array of relevant skills and expertise and have obtained, or are working to obtain, relevant information security certifications, including Certified Information Systems Security Professional, Certified Information Systems Auditor and Certified Risk and Information Systems Control certifications. Our Director of Information Security assembles our incident response and investigative teams and informs our CIO if an incident occurs. Investigative findings are reported to our executive leadership and to the relevant authorities if warranted. Our CIO works closely with our senior management, including cross-functional leaders in our human resources, legal and corporate communications departments, to develop and advance our cybersecurity strategy and reports to our Audit Committee on cybersecurity matters.


text: As our technology-enabled background and identity verification services involve the collection and transmission of confidential and sensitive information of our clients and their users and existing and potential employees, managing cybersecurity risks is a key component of our enterprise risk management plan. We have a comprehensive risk management and governance strategy in place to assess, identify and manage cybersecurity risks to our business and our proprietary technology platform.

companyName: Sterling Check Corp.


text: Our cybersecurity program is designed to protect our information systems from cybersecurity threats and to ensure the confidentiality, integrity and availability of systems and information used, owned or managed by the Company related to our employees, our clients and their users and existing and potential employees. This involves a comprehensive and ongoing effort to protect against, detect and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • policies, procedures and protocols concerning information security and data protection; • regular employee security awareness trainings; • regular employee "phishing" trainings; • regular third-party audits of our cybersecurity program; • an incident response plan that sets forth the steps to be taken following an actual or suspected cybersecurity incident or other data-related event; • periodic tabletop exercises associated with our incident response plan and processes; and • tools designed to detect and prevent cybersecurity incidents.


text: As part of our enterprise risk management program, we use the results of both internal and external information security audits, and data associated with our analysis of cybersecurity metrics within our information technology environment to inform and direct our overall cybersecurity strategy. Each year, we engage auditors to perform recognized standard audits related to cybersecurity, including a System and Organization Controls ("SOC") 2 review to test our information technology system internal controls. In addition, we engage other third-parties, from time to time and on an as needed basis, in the performance of tests and assessments associated with the cybersecurity of our operating environment. We maintain a centrally-managed third-party risk management process that includes a cybersecurity assessment performed during the procurement process and periodically thereafter of third-party service providers that may have access to sensitive information and/or systems, or applications that we have determined to be important to our operations.


text: Material Effects from Risks of Cybersecurity Threats From time to time, we experience data and cybersecurity incidents. To date, we have not experienced any risks from cybersecurity threats (including as a result of prior incidents) that have materially affected or to our knowledge are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Any future actual or perceived cybersecurity incidents, including the failure to protect the confidentiality, integrity, availability and privacy of our data and electronic transactions, or any misuse of our information services by our clients, employees, vendors or hackers, could cause significant harm to our business and reputation and result in significant liability. Such liability could include harm to our brand and reputation and cause us to lose existing clients and market share and fail to win new clients, and may require expenditure of significant costs and operational consequences in connection with investigating, mitigating, remediating, eliminating, and putting in place additional measures designed to prevent future actual or perceived cybersecurity incidents.


text: Role of Management Our Technology & Security Team, which is led by our Chief Technology Officer ("CTO"), Ivneet Kaur, oversees our cybersecurity program. Ms. Kaur has over 20-years' experience in leading global technology & security teams, including in the financial services and consumer reporting industries. She holds a Masters degree in Engineering Management from the University of College Park, Maryland and a Masters in Software Systems from Kurukshetra University in India. Members of our Technology & Security Team hold industry certifications such as CISSP, Security+, and GIAC.


text: Under our incident response plan, the Technology & Security Team is tasked with identifying and responding to actual or suspected cybersecurity incidents or other data-related events, as well as escalating qualifying incidents and events to a cross-functional leadership team, which includes representation from Technology, Security, Privacy and executive leadership, including our Chief Legal & Risk Officer. The leadership team is responsible for supervising incident response, remediation and compliance with any notification and disclosure obligations with respect to any incidents that have been escalated in accordance with our incident response plan. The Technology & Security Team conducts regular security assessments and employee security awareness trainings and tracks cybersecurity events through the preparation of quarterly status reports and metrics. The team presents these reports and metrics, together with additional internal metrics associated with the status of the Company's cybersecurity program and updates on the status associated with enterprise risk mitigation for technology-based programs, including cybersecurity initiatives, to the Audit Committee of the Board of Directors (the "Board") at least bi-annually. Additionally, the Company's Enterprise Risk Management Team ("ERM Team"), which is responsible for assisting the Company in identifying, assessing, managing, mitigating and reporting on top enterprise risks (including cybersecurity risks), provides updates to the Audit Committee at least bi-annually.


text: Role of the Board of Directors Our Board has delegated responsibility for overseeing our technology, cybersecurity and data privacy programs and controls to the Audit Committee. The Audit Committee evaluates the adequacy of the Company's technology and cybersecurity (including data protection) programs, with the CTO. The CTO provides periodic updates concerning the Company's technology and cybersecurity programs (including data protection) to the full Board on an annual basis.


text: As a medical device manufacturer that directly interacts with both healthcare professionals and patients, we recognize data privacy and cybersecurity as fundamental imperatives. Like all companies of our size, computer system complexity, and geographic reach, our information systems are subject to constant probing from outside actors and potentially vulnerable to internal and external malicious intrusion, cyberattacks and computer viruses. Because the techniques used to obtain unauthorized access or sabotage systems change frequently and, generally, are not recognized until launched against a target, we maintain a multifaceted approach to assessing, identifying and managing our material risks related to cybersecurity threats. This approach is integrated into our overall risk management processes. We use both technology-based solutions (e.g., anti-virus software, automated intrusion detection systems, spam filters, encrypted virtual private networks) and human-based solutions (e.g., data management policies, outside penetration testing, employee training and testing, independent audits) to defend against cybersecurity threats. We reinforce our commitment to a strong cybersecurity culture through security training and awareness programs. Education on topics such as data security, privacy practices, email and mobile security as well as tailored topics such as secure programming for developers make our employees aware of the need to make sound cybersecurity decisions. Our goal is to promote a culture of thorough security and impress upon our employees that everyone has a part to play in securing corporate data and information systems.

companyName: NovoCure Ltd

ticker: NVCR


text: We have obtained both ISO 13485 (quality management systems for medical devices) and ISO 27001 (information security management systems) certifications, which require independent annual auditing to obtain and maintain. In addition to our commitment to secure our employees', customers' and patients' data, as well as intellectual property, we take steps to ensure data integrity and protection standards are maintained throughout our supply chain. We understand that supply chains are vulnerable to increasing risks from cybersecurity threats. Cybersecurity threats to our supply chain are accounted for by performing risk assessments by our dedicated cybersecurity staff. These analyses take into account the type and amount of data being accessed and the supplier's ability to employ and maintain cybersecurity health and is also verified through third-party assessments and certifications. Supply chain vendors are monitored to ensure that risks remain mitigated and mechanisms are in place to allow for tracking and reporting of any material supplier cybersecurity events. Data security requirements are also included in all key vendor contracts. All vendors that handle personal information are required to provide appropriate protection in accordance with our policies and applicable regulations and laws.


text: Our Board of Directors has primary oversight over our risk management activities and has specifically delegated cybersecurity risk management oversight to its Audit Committee, which is comprised entirely of independent directors. At least on a quarterly basis, our information security management provides updates on our cybersecurity activities and to the extent any cybersecurity incidents may have occurred. On at least an annual basis, our information security management team engages in a thorough discussion and review of our cybersecurity practices and procedures that are designed to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our information security management team is led jointly by our Vice President, IT Infrastructure and Cybersecurity and our Director of Privacy.


text: We have dedicated privacy and cybersecurity officers and committees with established processes to assess, identify, manage and investigate all potential privacy and cybersecurity risks and incidents. As a medical device manufacturer with a global presence, we are compliant with privacy laws and regulations in all jurisdictions where we conduct business. In the U.S., the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH" and collectively "HIPAA") provides data privacy and security provisions for safeguarding medical information. Additionally, states in the U.S. are enacting local privacy laws (e.g., California). In the EU, the General Data Protection Regulation ("GDPR") harmonizes data privacy laws and rules on the processing of personal data, including patient and employee data, across the EU. The GDPR has a number of strict data protection and security requirements for companies processing data of EU residents, including when such data is transferred outside of the EU. Additionally, we need to comply with analogous privacy laws in other jurisdictions in which we operate, such as the Israeli Privacy Protection Law, the Asia Pacific Economic Cooperation Privacy Framework, and Japan's Act on the Protection of Personal Information. Our policies and procedures are all designed to ensure compliance with these obligations.


text: We have not encountered any incidents from cybersecurity threats to date, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: Our Cybersecurity and Digital Risk Management ("CDRM") organization, under the leadership of a Global Chief Information Security Officer ("Global CISO"), operates a cybersecurity program that is designed to help us assess, identify, manage, and mitigate risks relating to cybersecurity threats and incidents. We design our cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the NIST Cybersecurity Framework, as guides in supporting our ability to perform such functions.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: CDRM manages our cybersecurity program, including by fostering collaboration with partners across business units and functional areas to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate and manage such risks. Business units and functional areas are responsible for managing risks and implementing our policies and standards within the respective business unit or function. Compliance with our policies and standards is assessed by CDRM in conjunction with our internal audit function, through periodic cybersecurity audits.


text: As part of our cybersecurity program, we maintain a Cyber Risk Management Program that seeks to address key risk management concepts, including mission and vision, escalation path for risk mitigation, risk assessments, and risk treatment. We do so by conducting a variety of planning and preparedness activities, including employing monitoring tools to identify suspicious or anomalous activity, vulnerabilities, or signs of compromise across our networks, systems, and data. We utilize data from attack surface management tools to produce a prioritized set of vulnerabilities for remediation. We also require mandatory cybersecurity training for employees and periodically conduct Company-wide phishing simulations.


text: To aide in assessing material risks from cybersecurity threats, our enterprise risk management ("ERM") program incorporates cybersecurity risks as part of its process to assess overall risk of the Company. The ERM organization supports management by facilitating a semi-annual risk assessment, which documents the priority and status of these risks and aligns them with our strategic mitigation efforts. ERM is structured using a framework based on guidance from the Committee of Sponsoring Organizations of the Treadway Commission on Enterprise Risk Management Integrating Strategy with Performance.


text: Within CDRM, our Cybersecurity Defense Center ("CDC") has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If we experience a cybersecurity incident, the CDC activates an incident response plan, which includes processes to enable us to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm. Based on initial investigation into such incident's impact to the Company, the actor(s) involved, and other factors, the CDC assigns a severity level to an incident, which dictates the escalation path for a given incident. For incidents rising to higher levels of severity, the Cyber Governance and Incident Disclosure Committee, a cross-functional committee spanning cybersecurity, IT, legal, finance, enterprise risk management, and compliance teams, assesses the severity and potential materiality of such incidents and, as appropriate, escalates to designated members of our senior management for further assessment, response, and remediation. Additionally, we have established a Cyber Crisis Management Team, responsible for addressing and responding to the most severe cyber incidents. If warranted, senior management notifies the Audit Committee and/or the full Board of Directors, as appropriate. Throughout this process, the CDC continues to investigate the incident and, as its understanding of the incident evolves, updates its severity assessment, as necessary.


text: We engage third-party security experts, assessors, and consultants, as appropriate, to assess our cybersecurity risk management processes; support our ongoing certification efforts; help identify areas for continued focus, improvement, and compliance; and support incident response functions, to the extent necessary, all of which support our cybersecurity program. From time to time, we conduct third-party-administered, as well as internally administered, tabletop exercises, which simulate cybersecurity threats, to assess our existing cybersecurity infrastructure and incident response processes. We also periodically conduct offensive security assessments and vulnerability tests, and continuously monitor our computing environments to gain visibility into our security posture and detect vulnerabilities, abnormalities, or signs of compromise. In addition to monitoring risks from threats to our own assets, we administer third-party risk management practices that endeavor to help identify and manage supply chain and vendor risk arising from some of our key suppliers and other service provider organizations. We do so in a variety of ways, such as gathering information on third parties' cybersecurity programs and controls, performing due diligence, undertaking cybersecurity reviews and/or audits, and/or mandating certain contractual requirements, such as notification of cybersecurity incidents.


text: Our Global CISO, who reports to our Chief Operating and Legal Officer ("COLO"), has principal management-level responsibility for our cybersecurity program, which includes assessing and managing our cybersecurity risks, along with developing and implementing cybersecurity processes, policies, and controls that are used for managing cybersecurity risk across the Company. Our Global CISO is supported by the CISO of Cyber Defense and the CISO of Cyber Governance – both of whom have extensive experience in private sector cybersecurity roles – and a team of cybersecurity professionals with relevant educational and industry experience. The Global CISO periodically meets with the Cyber Governance and Incident Disclosure Committee, our enterprise risk management function and chief-level executives to discuss cybersecurity risks, as well as related mitigation and remediation activities. The CDC monitors the prevention, detection, investigation, mitigation, response to, and remediation of cybersecurity incidents, and regularly reports to our CISO of Cyber Defense, who then subsequently reports to the Global CISO.


text: Our Board of Directors is responsible for overseeing cybersecurity risk, primarily through the Audit Committee. Cybersecurity reviews by the Audit Committee and the Board of Directors are scheduled to occur at least quarterly and annually, respectively, or more frequently, as deemed necessary or advisable. Such presentations to the Audit Committee and Board of Directors, as applicable, are made by our COLO and Global CISO and address topics such as cybersecurity threats, incidents, risks, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, and regulatory developments. At times, the Audit Committee may receive additional cybersecurity risk reviews from other members of management and/or internal cybersecurity experts on certain of our key business segments and products. The Audit Committee regularly reports to our Board of Directors regarding the committee's oversight of such cybersecurity matters. Additionally, the COLO and Global CISO may provide ad hoc updates to the Board of Directors and/or the Audit Committee if necessitated by a security incident or other significant developments.


text: HPE, like all organizations operating in the technology landscape, faces significant and persistent cybersecurity risks. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected us, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity program, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could reasonably likely materially affect us. Additional information on the cybersecurity risks we face can be found in the section titled "Risk Factors" in Item 1A of Part I of this Annual Report on Form 10-K.


text: Our prior Global CISO departed HPE at the end of October 2024. We have identified a successor, who will join HPE in January 2025, previously served in relevant leadership positions at other public and private companies, and will bring over two decades of technology experience spanning information security and IT, including serving as CISO at other large companies. In the interim, our CDRM organization has been and will be led by our CISO of Cyber Defense and CISO of Cyber Governance, both reporting directly to our COLO.


text: Our Cybersecurity and Digital Risk Management ("CDRM") organization, under the leadership of a Global Chief Information Security Officer ("Global CISO"), operates a cybersecurity program that is designed to help us identify, assess, manage, and mitigate risks relating to cybersecurity threats and incidents. We design our cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the NIST Cybersecurity Framework, as guidance in supporting our ability to perform such functions.


text: CDRM manages our cybersecurity program, including by fostering collaboration with partners across business units and global functions to identify and assess material cybersecurity threats, evaluate their severity, and establish actions to mitigate and manage such risks. Business units and global functions are responsible for addressing risks and implementing our policies and standards within the respective business unit or function. Compliance with our policies and standards is assessed by our internal audit organization, through periodic cybersecurity audits. The results of these audits, together with our learnings from internal and external threats, drive periodic reassessment of and structured updates to our cybersecurity framework, as deemed necessary or appropriate. As part of our cybersecurity program, we also evaluate data collected from our attack surface management tools using a framework that quantifies the likelihood and severity of risks to produce a prioritized set of vulnerabilities for remediation. We also require mandatory cybersecurity training for employees and periodically conduct Company-wide phishing simulations.


text: Within CDRM, our Cybersecurity Defense Center ("CDC") has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If we experience a cybersecurity incident, the CDC activates our incident response plan, which includes processes to enable us to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm. Additionally, we have established a Cyber Crisis Management Team, which is responsible for addressing and responding to the most severe cyber incidents. If warranted, senior management notifies the Audit Committee and/or the full Board of Directors, as appropriate. Throughout this process, the CDC continues to investigate the incident and, as its understanding of the incident evolves, updates its severity assessment, as necessary.


text: We engage third-party security experts, assessors, and consultants, as appropriate, to assess our cybersecurity risk management processes; support our ongoing certification efforts; help identify areas for continued focus, improvement, and compliance; and support incident response functions, to the extent necessary, all of which support our cybersecurity program. From time to time, we conduct third-party-administered, as well as internally administered, tabletop exercises that simulate cybersecurity threats, to assess our existing cybersecurity infrastructure and incident response processes. We also periodically conduct offensive security assessments and vulnerability tests, and continuously monitor our computing environments to gain visibility into our security posture and detect vulnerabilities, abnormalities, or signs of compromise. In addition to monitoring risks from threats to our own assets, we apply third-party risk management practices that endeavor to help identify and manage supply chain and vendor risk arising from our critical suppliers and other service provider organizations. We do so in a variety of ways, such as gathering information on third parties' cybersecurity programs and controls, performing due diligence, undertaking cybersecurity reviews and/or audits, and/or mandating certain contractual requirements, such as notification of cybersecurity incidents and return or destruction of all HPE data upon termination of the relationship.


text: Our Global CISO, who reports to our Chief Operating and Legal Officer ("COLO"), has principal management-level responsibility for our cybersecurity program, which includes assessing and managing our cybersecurity risks, along with developing and implementing cybersecurity processes, policies, and controls that are used for managing cybersecurity risk across the Company. Our Global CISO joined HPE in January 2025, and previously held relevant leadership positions at other public and private companies. He brings over two decades of technology experience spanning information and cyber security, including serving as CISO at other large companies. Our Global CISO is supported by a leadership team managing Cyber Defense; Governance, Risk, and Compliance; Security Strategy; Cybersecurity Architecture and Engineering; and Identity and Access Management, all of whom have extensive experience in private sector cybersecurity roles. Supporting these leaders is a team of cybersecurity professionals with relevant educational and industry experience. The Global CISO periodically meets with the Cyber Governance and Incident Disclosure Committee, our enterprise risk management function, and chief-level executives, as well as the Audit Committee of our Board of Directors, to discuss cybersecurity risks, as well as related mitigation and remediation activities. The CDC monitors the detection, investigation, mitigation, response to, and remediation of cybersecurity incidents, and regularly reports to our Global CISO, engaging with the Executive Committee and the Cyber Crisis Management Team, as appropriate.


text: Our Board of Directors is responsible for overseeing cybersecurity risk, primarily through the Audit Committee. Cybersecurity reviews by the Audit Committee and the Board of Directors are scheduled to occur at least quarterly and annually, respectively, or more frequently, as deemed necessary or advisable. Such presentations to the Audit Committee and Board of Directors, as applicable, are made by our COLO and Global CISO, utilizing performance metrics established by CDRM and reported through the ERM framework, and address topics such as cybersecurity threats, incidents, risks, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, and regulatory developments. At times, the Audit Committee may receive additional cybersecurity risk reviews from other members of management and/or internal cybersecurity experts on certain of our key business segments and products. The Audit Committee regularly reports to our Board of Directors regarding the committee's oversight of such cybersecurity matters. Additionally, the COLO and Global CISO may provide ad hoc updates to the Board of Directors and/or the Audit Committee if necessitated by a security incident or other significant developments.


text: HPE, like all organizations operating in the technology landscape, faces significant and persistent cybersecurity risks, which influence business strategy and operations. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected us, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity program, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could reasonably likely materially affect us. Additional information on the cybersecurity risks we face can be found in the section titled "Risk Factors" in Item 1A of Part I of this Annual Report on Form 10-K.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: The Company's Chief Financial Officer, or CFO, Information Technology, or IT, manager, legal function and external information technology and cybersecurity service provider help to identify, assess and manage our cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, conducting internal audits, and conducting internal and external threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of data, network security controls, access controls, asset management and disposal, physical security, systems monitoring, employee training, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT manager works with our management team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our management team evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to the Audit Committee of our board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, managed cybersecurity providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosted services, CROs, and CMOs. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A titled "Risks Related to Our Business Operations, Employee Matters and Managing Growth."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.