text: As reflected in the audit committee charter, the audit committee oversees our processes and policies relating to certain risk assessment and risk management matters, including with respect to cybersecurity risks. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management on areas of material risk to our company. Our audit committee discusses our cybersecurity program at least annually, receives updates on relevant developments and considers steps that our management has taken to monitor and seek to mitigate any risk exposures.


text: Cyber Risk Management and Strategy We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. Management of cybersecurity risks is a component of our overall risk management strategy, which is overseen by our senior management team and our board of directors. We rely on a managed IT service provider with a longstanding relationship with the Company to help manage cybersecurity risks. Our managed IT service provider conducts testing of our controls and environment, including penetration testing, to identify and remediate cybersecurity risks.

companyName: Terreno Realty Corp

ticker: TRNO

secItem: Item 1C


text: We have an employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions. Before contracting with certain third parties, such as our local property managers, or purchasing third party technology or other solutions that involve exposure to sensitive company or tenant information, we conduct diligence on those third parties, which includes a security review. We maintain back-ups and disaster recovery plans to restore our information in the event of an incident.


text: Additionally, as a public company, we are subject to Sarbanes-Oxley Act ("SOX") requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting.


text: Related to Cybersecurity Risks Our third-party managed IT service provider reports to our Chief Financial Officer, Chief Accounting Officer, and Chief Operating Officer on cybersecurity matters, including cybersecurity risks. These senior executives are involved in management of information security procedures and periodically brief the board of directors on information security matters.


text: Our board of directors plays an important role in our risk oversight and discharges its duties both as a full board and through its committees. Our board is involved in risk oversight through its direct decision-making authority with respect to certain significant matters and review of our overall business strategy, as well as indirectly through the further oversight of management delegated to each of the board's committees. Our board of directors relies on management to bring significant matters impacting our company to its attention but has processes for receiving information regarding such matters and providing oversight.


text: PECO's cybersecurity program is generally based on the National Institute of Standards and Technology cybersecurity framework ("NIST CSF") with the intention of preventing, identifying, detecting, and mitigating cybersecurity risks. This does not imply that we meet or comply with any particular technical standards, specifications, frameworks, or requirements including the NIST CSF, only that we use the NIST CSF as a guide. Our program focuses on people, processes, and technologies and includes training of associates, periodic workforce testing, and the deployment and monitoring of technical security solutions and controls.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our management team, including the Chief Information Officer ("CIO"), is responsible for identifying and managing our material risks from cybersecurity threats. The CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both the PECO cybersecurity team and our retained external cybersecurity consultants. The management team, led by the CIO and cybersecurity team, stay informed about cybersecurity risk including prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the PECO environment. The CIO works closely with members of PECO's cybersecurity team, who have years of experience working in cybersecurity, possessing industry certifications such as Certified Information Systems Security Professional ("CISSP") and Security+, and pursuing advanced degrees and studies in the field. Cybersecurity team members participate in recurring cybersecurity team meetings with the CIO and provide monthly executive leadership updates. The Board oversees our cybersecurity program and is periodically briefed by management, including the CIO, on cybersecurity risks and initiatives. In addition, management updates the Board as necessary regarding any significant cybersecurity incidents.


text: The cybersecurity team delivers cybersecurity training to associates, including security videos and informational tips, new hire training, out-of-band cybersecurity alerts, and simulated phishing campaigns with teachable moments and focused training, all designed to provide security specific knowledge to our associates. Positive reinforcement is utilized and encourages associates' participation, in addition to required periodic training. The PECO cybersecurity team participates in cybersecurity training, activities, and events to stay current with the evolution of security threats, security solutions, best practices, and the risks facing PECO.


text: At PECO, we are committed to protecting the confidentiality and integrity of our data and systems. Among other things, our key contracts contain requirements that counterparties maintain standards of data security and privacy compliance.


text: PECO maintains, internally publishes, and annually reviews its cybersecurity policies and procedures, which includes an incident response plan. Additionally, PECO engages with external cybersecurity experts to conduct annual penetration testing, provide monitoring of the environment, conduct tabletop exercises, and for dedicated incident response and advanced forensics capabilities. In addition to internal audits and external reviews, assessments have included the NIST CSF, cybersecurity maturity assessment, and Center for Internet Security Benchmarks to identify opportunities for enhancement.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our financial results and business operations. See "Item 1A. Risk Factors – Risks Related to Business Continuity".


text: Our management team, including the Chief Information Officer ("CIO"), is responsible for identifying and managing our material risks from cybersecurity threats. The CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both the PECO cybersecurity team and our retained external cybersecurity consultants. The management team, led by the CIO and cybersecurity team, stay informed about cybersecurity risk including prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the PECO environment. The CIO works closely with members of PECO's cybersecurity team, who have years of experience working in cybersecurity, possessing industry certifications such as Certified Information Systems Security Professional ("CISSP") and Security+, and pursuing advanced degrees and studies in the field. Cybersecurity team members participate in recurring cybersecurity team meetings with the CIO and provide periodic executive leadership updates. The Audit Committee oversees our cybersecurity program and is periodically briefed by management, including the CIO, on cybersecurity risks and initiatives. In addition, management updates the Board, through the Audit Committee, as necessary regarding any significant cybersecurity incidents.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third-party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: Cybersecurity Program Overview GC Advisors has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. GC Advisors' cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. GC Advisors actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on GC Advisors to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on GC Advisors' risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of GC Advisors when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Financial Officer ("CFO") and Chief Compliance Officer ("CCO") regarding the overall state of GC Advisors' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management GC Advisors' internal cybersecurity team, headed by GC Advisors' Chief Information Officer ("CIO"), are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO and a Disclosure Committee that is headed by the Company's CFO (the "Disclosure Committee"), are responsible for assessing and managing material risks from cybersecurity threats that impact the Company.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over three years and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company for thirteen years and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company, including the CCO and the Company's Disclosure Committee, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of GC Advisors.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on a regular basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over four years and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. "The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Expensify, Inc.

ticker: EXFY


text: We design and assess our program based on applicable laws and regulations, and informed by industry standards and industry-recognized practices. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such laws and regulations and industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factor If we or our third party providers fail to protect our IT Systems against security incidents, or otherwise to protect our Confidential Information, there may be damage to our reputation and brand, material financial penalties, and legal liability, which could substantially harm our business, financial condition, and results of operations.


text: Our Board considers cybersecurity risk as part of its risk oversight function, including oversight of cybersecurity and other information technology risks. The Board oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Compliance Officer and Director of Engineering, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our management team's experience includes a combined two decades of experience in various software development, cybersecurity, product management, and other technology-related roles. Our Chief Compliance Officer and Director of Engineering have each served in a number of significant leadership roles at our company since 2017 and 2013, respectively, including oversight of security, safety, and integrity initiatives Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our program based on applicable laws and regulations, and informed by industry standards and industry-recognized practices including but not limited to following the latest NIST and CISA guidance and SOC 2 Principles and Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such laws and regulations and industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.


text: Our management team, including our Chief Compliance Officer and Director of Engineering, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our Chief Compliance Officer and Director of Engineering have over 8 and 12 years of experience, respectively, in various software development, cybersecurity, product management, and other technology-related roles. Our Chief Compliance Officer and Director of Engineering have each served in a number of significant leadership roles at our company since 2017 and 2013, respectively, including oversight of security, safety, and integrity initiatives.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cyber criminals are becoming more sophisticated and effective every day. All companies utilizing technology are subject to threats or attempts of cybersecurity attacks. Maintaining data privacy and cybersecurity to protect our employees, customers, and business is an integral aspect of our operations. Our approach to data privacy and cybersecurity is defined by our commitment to preserving the trust our employees and customers place in us and focuses on driving continuous improvement as the threat landscape evolves.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Our Audit Committee and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security programs to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and infrastructure.


text: However, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our risk factors identified in Item 1A: Risk Factors included elsewhere in this Report provide further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management Strategy We are guided by our Cybersecurity Charter, which includes our philosophy of information security, identifies the motivation for security, describes information security principles and terms, and defines the scope of information security policies and responsibilities for various functions. We continue to improve the maturity of our cybersecurity program, aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: Our Director of Cybersecurity leads our information security operations, with a focus on identifying, evaluating, mitigating, and reporting on IT and cybersecurity risks that have the potential to threaten Sensata's enterprise information assets and systems. Our cybersecurity and global IT strategy is regularly aligned with business leaders across Sensata through our IT Excellence Committee meetings, conducted 10 times a year, to ensure cyber, IT, and business priorities are communicated and understood throughout the organization.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the NIST, the International Organization for Standardization, and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: • Incident Response: We have an Incident Response Plan ("IRP") to address cybersecurity incidents as defined by Item 106 of Regulation S-K. The IRP includes as a core component an Incident Response Team ("IRT") that utilizes guidelines identified in the IRP to identify, assess, and disclose cybersecurity incidents as applicable. The IRT consists of a core team, which includes representation from IT, Legal, and Human Resources, and an extended team, which includes representation from Enterprise Risk Management, Communications, Investor Relations, Internal Audit, Legal, Accounting, and External Reporting. The core team is involved in all incidents that are classified as significant, requiring a response from the IRT, and it involves components of the extended team as applicable. The IRT allows for broad representation of various areas of expertise for use in executing the IRP. The IRT meets monthly to evaluate the effectiveness of our cybersecurity risk management processes and procedures, including the IRP. The IRP is designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. • Defense and Monitoring: We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, process, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats: We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements, and applicable law, including privacy and other considerations. • Third Party Risk Assessments: We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections.


text: • Training and Awareness: We have robust cybersecurity training programs with frequent touch points for all employees to empower them to act responsibly and keep cybersecurity top of mind. We use monthly activities to keep employees engaged with cybersecurity, including newsletters, articles on the Sensata intranet, and mock phishing campaigns. We regularly update our comprehensive training program, which covers a wide variety of topics, from protecting work machines and personal information to social innovation and how employees can protect their digital lives at home. • Supplier Engagement: We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided. • Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, our risk register, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management. • Technical Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.


text: Our Board of Directors, in coordination with each of our Board Committees, is responsible for oversight of our enterprise risk management activities. The Nominating and Governance committee receives an update on the Company's risk management process at least annually, including interaction of cybersecurity with our overall risks. The Board of Directors oversees risks from cybersecurity threats through report out from the Audit Committee, which monitors cybersecurity incidents and management's response to such incidents.


text: Our Audit Committee directly oversees our cybersecurity program. Quarterly reports are delivered to the Audit Committee by the Chief Information & Digital Officer ("CIDO") and/or the Director of Cybersecurity at least four times per year. These reports include information about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. These reports also include updates on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our CIDO has served in various roles in IT and information security for over 20. She holds an undergraduate degree in information management and technology. Our Director of Cybersecurity has served in various roles in IT and information security for over 18 years, including in the military and the healthcare and retail industries.


text: Cybersecurity Incidents In the event of a cybersecurity incident, our response and mitigation efforts are guided by the IRP, which provides guidance on how to respond to, and recover from, a significant cyber incident requiring an organized response. We continue to conduct tabletop exercises testing the principles and procedures set forth in our IRP based on lessons learned.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information about cybersecurity risks relating to our business, refer to Item 1A: Risk Factors included elsewhere in this Report.


text: Our Director of Cybersecurity leads our information security operations, with a focus on identifying, evaluating, mitigating, and reporting on IT and cybersecurity risks that have the potential to threaten Sensata's enterprise information assets and systems. Our cybersecurity and global IT strategy is regularly aligned with business leaders across Sensata through our IT Excellence Committee meetings, conducted 8 times a year, to ensure cyber, IT, and business priorities are communicated and understood throughout the organization.


text: Our Board of Directors, in coordination with each of our Board Committees, is responsible for oversight of our enterprise risk management activities. The Nominating and Governance committee receives an update on the Company's risk management process quarterly, including interaction of cybersecurity with our overall risks. The Board of Directors oversees risks from cybersecurity threats through report out from the Audit Committee, which monitors cybersecurity incidents and management's response to such incidents.


text: Our CIDO has served in various roles in IT and information security for more than 20 years. She holds an undergraduate degree in information management and technology. Our Director of Cybersecurity has served in various roles in IT and information security for more than 18 years, including in the military and the healthcare and retail industries.


text: We regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face, and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents. We have experienced breaches of, and unauthorized access to, our internal systems in the past and we believe such breaches and unauthorized access and other incidents may happen again in the future. As of the date of the filing of this Annual Report on Form 10-K, we do not believe these risks from cybersecurity threats, including the results of prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, but there can be no guarantee that we will not experience such a security breach or incident in the future. Refer to Part 1, Item 1A "Risk Factors" of this Annual Report on Form 10-K for additional information regarding cybersecurity risks related to our systems, products, and network.

companyName: Cloudflare, Inc.

ticker: NET


text: Particularly in light of the extensive cybersecurity risks facing our company and the fact that we provide cybersecurity products to our customers, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our internal systems, our global network, and our customers' data. We have established a multi-layered approach to manage our cybersecurity risks with preventative and detective capabilities enabled in our network and internal systems that are designed to protect against cyber threats. This approach to cybersecurity includes, among other things, annual and periodic enterprise-wide risk assessments; ongoing collaboration with our product and engineering teams for the purpose of securing our products, systems, data, and global network; a vulnerability management program focused on proactively identifying, triaging and mitigating security vulnerabilities within our systems, network and data through ongoing testing, penetration tests and other simulations; regularly required security training for all employees; and a comprehensive incident response process to identify, contain, and remediate cybersecurity incidents. We also engage with external cybersecurity assessors and consultants in evaluating and testing our risk management systems. These processes are integrated into our overall risk management systems and processes to promote a company-wide culture of cybersecurity risk management.


text: We are aware of the risks associated with engaging third-party service providers, so we have implemented processes to oversee and manage these risks. We conduct security assessments of third-party providers who may have access to sensitive information before engagement and maintain ongoing monitoring of their compliance with our cybersecurity standards. The monitoring includes periodic reviews conducted by our security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Our Board of Directors, including through its audit committee, oversees our enterprise risk management processes, including our cybersecurity risk exposure and the steps management has taken to monitor, control, and address such exposure. The audit committee regularly reviews and discusses with our senior management, our internal audit team, and our independent auditor, our policies and processes designed to identify, monitor, and address enterprise risks, including risks from cybersecurity threats and incidents. This oversight and review of our risks from cybersecurity threats includes, among other things, our SVP, Chief Security Officer (CSO) providing regular quarterly briefings to our Board of Directors regarding cybersecurity threats, processes for preventing and/or addressing current threats, ongoing cybersecurity initiatives and strategy and regulatory compliance; our internal audit team reporting on a quarterly basis to the audit committee regarding cybersecurity and other enterprise risk management efforts and related audits and management action plans to mitigate risks by internal audits; and periodic other updates to our Board of Directors by our CEO and CSO in the event of specific critical cybersecurity threats.


text: Our CSO, who reports regularly and directly to our CEO, has primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CSO, who joined us in 2023, has over 20 years of experience assessing and managing cybersecurity programs and cybersecurity risk at a number of different companies. Our internal security leadership team that reports to our CSO regularly communicates and meets to discuss cybersecurity threats and risk management, the effectiveness of our internal security programs, and cybersecurity emerging trends, risks, and incidents that may require increased focus. In addition, our internal audit team regularly reviews cybersecurity risks with our security team as part of our ongoing enterprise risk management program and conducts internal audits on various areas of cybersecurity risk. In addition, our CEO chairs an internal compliance committee that includes our CSO and other members of our security team and meets at least quarterly to review compliance with various laws, rules, and regulations applicable to our company, including with respect to cybersecurity matters.


text: We recognize the increasing significance that cybersecurity has to our operations and the success of our business, as well as the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. We process and maintain sensitive data on our Clients and members, including in the form of PHI and PII. In addition, we maintain intellectual property for our solutions and personal information of our employees. Because of the data we manage, we are subject to various cybersecurity threats that, if they materialized, could adversely affect our business, employees, Clients, and members through impacts to the confidentiality, integrity, and/or availability of our systems. We maintain a cybersecurity program and controls as part of our enterprise risk management program in an effort to reduce the risk of exposure of our information and systems.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: To assess, identify, and manage the risks of cybersecurity threats to our information system, we maintain a cybersecurity program, including policies and controls, which are regularly reviewed through internal and external assessments. We leverage several industry frameworks for adopting and assessing controls, such as HIPAA, the National Institute of Standards and Technology Cybersecurity Framework, and HITRUST. We have an active HITRUST certification and Service Organization Control ("SOC") 2 Type II security compliance that are issued by external entities.


text: We have controls in place intended to assess our cybersecurity posture and prevent successful access to our critical systems, including, but not limited to: vulnerability scanning on systems and applications; endpoint detection capabilities to identify malware and other indicators of threat activity; multifactor authentication; and blocking of malicious e-mail. In addition, we also provide annual cybersecurity awareness training for our employees. Further, we engage with an external security firm to perform regular penetration testing. We subject our critical third-party service providers to risk assessment prior to engagement, and periodically thereafter, to identify material risks. Additionally, we have a process to engage with these third parties to understand potential impacts of, and remediation efforts associated with, critical vulnerabilities.


text: To stay abreast of the evolving threat landscape, we actively engage with key vendors, industry information sharing, and intelligence and law enforcement communities. These engagements serve as inputs into understanding techniques and tactics being used by threat actors and in expanding the countermeasures we use to protect Teladoc Health.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have a documented security incident response plan that provides a consistent approach to identifying and classifying the incident as well as a defined escalation process to management to assess the materiality.


text: Despite the efforts outlined above, we cannot ensure that we will not be subject to any cybersecurity incidents or threats. See "Risk Factors Risks Related to Information Technology" for additional information. To date, management has not determined that any cybersecurity incidents the Company has experienced would have resulted in, or are reasonably likely to result in, a material impact to its financial condition, results of operations, or business strategy.


text: Cybersecurity risk oversight continues to remain a top priority for our Board. The audit committee of our Board maintains primary responsibility related to overseeing our cybersecurity risk as part of its program of regular risk management oversight. This includes, but is not limited to, the overall maturity and strategy of our cybersecurity program.


text: We have a rigorous and comprehensive cybersecurity program managed by a dedicated team of subject matter experts and is led by our Chief Information Security Officer ("CISO"), who has extensive cybersecurity experience. We have implemented telehealth industry standard processes, policies, and tools, including regularly scheduled vulnerability scanning and third-party penetration testing to reduce the risk of vulnerabilities in our system.


text: Our CISO regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Technology Officer, the Chief Information Officer, Deputy Chief Legal Officer, and Chief Compliance Officer, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.


text: Our CISO regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Technology Officer, the Chief Information Officer, and Chief Compliance Officer, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.


text: We have implemented and maintain a formal information security management program designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, services, and data. Our information security management program includes a dedicated security team led by our Head of Security that is responsible for implementing security controls and monitoring for suspicious activity. Our information security management program also includes a cybersecurity risk management process which aims to identify and assess material risks from cybersecurity threats, including from vulnerabilities within Asana systems and new and emerging threats to Company operations by using automated and manual tools, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, and conducting audits and threat assessments.

companyName: Asana, Inc.

ticker: ASAN


text: We consider our information security management program and the cybersecurity governance structure described below to be part of our overall enterprise risk management program.


text: Depending on the nature of the environment, system and/or data, we implement and maintain various technical and organizational measures, processes, standards and/or policies designed to manage and mitigate cybersecurity risks, including, for example, as may be appropriate: employee training, software design review, static code analysis, coordinated vulnerability disclosure and bug bounty program, penetration testing performed by an outside assessment firm, vulnerability scanning and management, endpoint and network security monitoring, access controls, vendor risk management, asset management, and software updates and patching.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including as applicable to our environments, systems, and data. These third-party service providers may include, but are not limited to, cybersecurity consultants, cybersecurity software providers, cybersecurity assessment firms, and forensic investigators.


text: To operate our business, we also use third-party vendors to perform a variety of functions, including but not limited to, developing aspects of our platform, hosting and delivering our platform and related services, supporting the sale and marketing of our products and services, and providing technical and customer support. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the vendor, our vendor management process may involve different measures designed to help identify, assess, and manage cybersecurity risks associated with the vendor, such as conducting risk assessments and re-assessments, reviewing of the vendor's security program, and imposing contractual cybersecurity-related obligations on the vendor. For example, our security, privacy, and IT teams may review the vendor's security protocols, data retention policies and privacy policies, privacy practices, and security track record, and advise on implementation best practices.


text: See the section titled Item IA. Risk Factors, including "If our information technology systems, or those of third parties upon which we rely, or our data are or were compromised or operate in an unintended way, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences", for additional information about the risks from cybersecurity threats that may materially affect our business.


text: The Audit Committee of our Board of Directors is responsible for assisting the Board in overseeing the Company's risk assessment and risk management processes, including risks related to cybersecurity and data privacy. Our Head of Security, who reports to our Head of Engineering and works with other members of management, manages the Company's cybersecurity program. Our Head of Security holds a master's degree in computer engineering from the Rochester Institute of Technology and has over 15 years of cybersecurity experience. Our Head of Engineering holds a master's degree in computer science from the University of Illinois Urbana-Champaign and has nearly two decades of leadership experience at technology companies overseeing key engineering functions. Our Head of Security provides regular updates to the Audit Committee and the Board on cybersecurity risks faced by the Company and the Company's processes for risk identification, assessment, and management.


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Head of Security, Head of Global Privacy, Head of Engineering, Head of Enterprise Technology & IT, Chief Business Officer, Chief Financial Officer, and General Counsel. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to the Audit Committee.


text: We implement and maintain a formal information security management program designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, services, and data. Our information security management program includes a dedicated security team led by our Head of Security that is responsible for implementing security controls and monitoring for suspicious activity. Our information security management program also includes a cybersecurity risk management process which aims to identify and assess material risks from cybersecurity threats, including from vulnerabilities within Asana systems and new and emerging threats to Company operations by using automated and manual tools, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, and conducting audits and threat assessments.


text: See the section titled Item IA. Risk Factors, including "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised or operate in an unintended way, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences", for additional information about the risks from cybersecurity threats that may materially affect our business.


text: The Audit Committee of our board of directors is responsible for assisting the Board in overseeing the Company's risk assessment and risk management processes, including risks related to cybersecurity and data privacy. Our Head of Security, who reports to our Head of Engineering and works with other members of management, manages the Company's cybersecurity program. Our Head of Security holds a master's degree in computer engineering from the Rochester Institute of Technology and has over 15 years of cybersecurity experience. Our Head of Engineering holds a master's degree in computer science from the University of Illinois Urbana-Champaign and has nearly two decades of leadership experience at technology companies overseeing key engineering functions. Our Head of Security provides regular updates to the Audit Committee and the Board on cybersecurity risks faced by the Company and the Company's processes for risk identification, assessment, and management.


text: Lightbridge utilizes third-party vendors to manage its Information Technology (IT) systems and has a Managed Service Provider (MSP) for general administration of the IT process including providing a Chief Information Security Officer (CISO), who is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The MSP utilizes a Security Information and Event Management (SIEM) system to monitor the IT Infrastructure. This and other third-party security applications provide reports that include but are not limited to Endpoint protection, Employee Security scores, Phishing reports, Dark Web scanning and Vulnerability scanning. The CISO reports to our CFO. This CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the industry, many of whom hold cybersecurity certifications, and through the use of technological tools and software and results from third-party audits. The CISO issues quarterly reports and reports to the CFO, as appropriate, providing updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Company requires its employees to take a yearly cyber training course and its employees are also required to sign confidentiality agreements for purposes including ensuring cybersecurity.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because Lightbridge recognizes the significance of these threats to our operational integrity and stakeholder confidence. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance that equips them to oversee cybersecurity risks effectively. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework. The CFO reports to the Audit Committee regarding cybersecurity risks and provides a comprehensive briefing to the Audit Committee on a regular basis as needed, with a minimum frequency of once per year. The CFO also maintains an ongoing dialogue regarding emerging or potential cybersecurity risks and cybersecurity incidents.


text: We periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: CREATIVE MEDICAL TECHNOLOGY HOLDINGS, INC.

ticker: CELZ


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.


text: As discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business. Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.


text: Board Oversight of Cybersecurity Matters The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining a robust cybersecurity risk management strategy and governance program in order to safeguard the confidentiality, integrity and availability of the Company's systems and information. The Board's Audit Committee is tasked with overseeing cybersecurity threats, risk management strategy and governance. The management of cybersecurity risk has been integrated into the Company's overall risk management processes.

companyName: CAMBER ENERGY, INC.

ticker: CEIN


text: Management of Cybersecurity Matters The Company's management is responsible for assessing, identifying and managing cybersecurity risks, threats and incidents. The Company has no internal IT function and engages third party providers that possess the requisite skills, systems and processes to effectively manage day-to-day IT operations, including cybersecurity. This includes, but is not limited to:


text: Employing appropriate incident prevention and detection software (e.g., antivirus, anti-malware, firewall, endpoint detection and response, identity and access management, multifactor authentication, virtual private network, web content filter, spam filter, data loss protection software, security information and event management software); Employing industry-standard encryption protocols; Employing backup/disaster recovery software; Conducting regular vulnerability scans of Company systems and networks.


text: Cybersecurity incidents are communicated to the Company's senior management, including the CEO and CFO, who direct the Company's response with the assistance of third-party specialists. Management notifies the Audit Committee of any cybersecurity incidents, including the nature of the incident, the Company's remediation actions and any required improvements and changes to systems and processes.


text: Material Impact on Company The Company has not been materially affected by, and is not likely to be materially affected by, any significant cybersecurity incidents.


text: We maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.

companyName: VOLITIONRX LTD

ticker: VNRX


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include, among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of privacy or security laws and related litigation and legal risk, and reputational risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee of our board of directors as part of the committee's involvement in managing and overseeing cybersecurity risks.


text: Our cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section entitled " Risk Factors — Failure in our information technology, storage systems or our clinical laboratory equipment could significantly disrupt our operations and our research and development efforts " included within this Report.


text: Our board of directors is actively involved in overseeing risks from cybersecurity threats. At least once a year, the board of directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of our business strategy. Additionally, our board has delegated to our Audit Committee the authority to oversee and review the adequacy of our cybersecurity, information and technology security, and data privacy programs, procedures, and policies. Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.


text: The Audit Committee regularly receives updates from management with respect to the Company's efforts to manage data protection, cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to our Audit Committee include updates on our data security posture, results from internal audit and third-party assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The committee also regularly engages with our Group IT Manager on technology risk-related topics.


text: Our processes also allow for our board of directors and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While the Audit Committee conducts meetings regularly, the committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the committee. The Company's policy is for the board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing updates regarding any such risk, in accordance with our data breach reporting procedure and GDPR.


text: Cybersecurity is an area of increasing concern to management and our investors. By design, our device and software (LuViva) are not connected to the internet. Patient results cannot be saved to the device and must first be downloaded to a flash drive and then transferred to another computer or cloud-based system to be saved. The design of our product limits our exposure to the compliance requirements of NIST 800 - 171. Our Company generally keeps all employee personally identifiable information with our payroll service provider. Each year the provider furnishes us with their SOC report which includes their cybersecurity policies and procedures.

companyName: GUIDED THERAPEUTICS INC

ticker: GTHP


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks, while we engage consultants who are responsible for day-to-day assessment and management of cybersecurity risks and who report regularly to the board of directors. We have previously experienced cybersecurity incidents, from time to time. These incidents have not materially affected our business strategy, results of operations or financial condition. We are not currently aware of any cybersecurity incidents that would have a material effect on our business strategy, results of operations or financial condition. Nevertheless, there is always a risk that a phishing attempt, ransomware or other attack by a bad actor could have a material adverse effect on our financial position or results of operations. Based on information currently available, management does not believe that there is a reasonably likely risk of these issues, nevertheless the possibility of one occurring cannot be completely ruled out.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. We have a set of Company-wide policies and procedures outlined in our Employee Handbook that directly or indirectly relate to cybersecurity risks. These policies go through an internal review process and are approved by appropriate members of management.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: The Company's EVP of Technology is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our EVP of Technology has over two decades of experience as a senior executive in technology-driven enterprises with expertise across cybersecurity, compliance, manufacturing process engineering, database architecture, interface programming and more.


text: The Company assesses the cybersecurity preparedness of third-party vendors by obtaining SOC 1 or SOC 2 reports. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Board and Audit Committee participates in discussions with management regarding cybersecurity risks and performs a review at least annually of the Company's cybersecurity program. This includes discussions of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.


text: We are subject to cyber incidents and will continue to be exposed to cyber incidents in the normal course of our business. Although, such risks have not materially affected us, including our business strategy, financial condition, results of operations, or cash flows. The extensive approach we take to cybersecurity may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A – Risk Factors for a discussion of cybersecurity risks.


text: Oversight of cybersecurity infrastructure is managed by members of our management team, including our Chief Executive Officer and Chief Data Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider routinely reviews and updates our antivirus and antimalware software, monitors our intrusion detection system and intrusion protection system and reviews and cleans our corporate email system. Other than engaging the Service Provider prior to our initial public offering, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Edible Garden AG Inc

ticker: EDBL


text: We believe we have implemented processes that are designed to effectively manage risks from cybersecurity threats. Through our Service Provider, we have established an Incident Response Plan (the "IRP"). The IRP lays out our guidelines for responding to and handling cyber incidents. The IRP helps to ensure a quick and organized response in the event of a cyber incident and helps ensure all necessary members of management are informed so action can be taken as soon as possible. Under the IRP, once a cyber incident is identified, a response team will review the details of the cyber incident, inform management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.


text: We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.


text: Since 2018 the Company has been primarily focused on pursuing FDA Pre-Market Approval (PMA) for its HemoStyp products to enable it to access the Class III surgical markets and has de-emphasized its commercial operations. We have fewer than 10 employees and consultants and currently use third-party vendors and service providers for certain product development and regulatory approval activities. Most of the information generated and collected by the Company is stored and maintained by these third-party vendors and service providers. Each of these providers has demonstrated its own cybersecurity protocols which our management believes to be adequate for protecting the Company's digital files in their possession. Our CEO (who is also one of the Company's directors) and VP of Finance are responsible for assessing and managing cybersecurity risks. Neither of them have cybersecurity expertise. Due to the current small size and limited commercial operations of the Company, we have no formal cybersecurity policies and processes in place, however, the Board and management believe cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: United Health Products, Inc.

ticker: UEEC


text: Cybersecurity threats have not materially affected, and are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition while we are strategically focused on pursuing FDA PMA approval and have minimal commercial operations. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third-party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations. There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including their policies, controls or procedures, will be effective in protecting the Company's systems and information.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations.

companyName: BioCorRx Inc.

ticker: BICX


text: Our cybersecurity risk management methodology includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;


text: individuals, including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board oversees management's implementation of our cybersecurity risk management methodology. Our Board receives periodic updates from our Chief Executive Officer and more frequently as needed, regarding the overall state of our cybersecurity preparedness, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents. The Board and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for developing and maintaining our overall cybersecurity risk methodology and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.]


text: We maintain a proactive cybersecurity program that is aligned with our business and is dedicated to managing information technologies ("IT") risks to our Company. We have established policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats. These measures are integrated into our overall risk management program and governance structure, demonstrating our commitment to cybersecurity in a manner consistent with our business activities.

companyName: BT Brands, Inc.

ticker: BTBD


text: We employ an array of controls, technologies, and other processes designed to identify, protect against, detect, respond to, and mitigate cybersecurity risks. These measures are in alignment with the frameworks established by the National Institute of Standards and Technology (NIST). Our IT activities are primarily outsourced for monitoring and maintenance to third parties and are subject to independent controls over IT. These controls include but are not limited to, internal reporting, monitoring and detection tools, threat intelligence, and general and role-based training. We consistently evaluate and enhance the effectiveness of our cybersecurity program, ensuring continuous evolution and improvement.


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. These risks are identified, measured, monitored, and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's oversight, which includes an assessment of our risk environment at least once per year. The review incorporates risk assessment and evaluation. The Audit Committee assists the Board with its oversight of cybersecurity risk. Our CFO reviews the oversight program with the Audit Committee, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third-party advisors.


text: To date, we have not experienced a cybersecurity threat or incident; therefore, there has been no cybersecurity impact on our results of operations or financial condition. However, unauthorized access to our information and systems and other disruptions to our business operations could occur in the future.


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, tests on our systems, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including a third party company, Mission Cloud, to enhance our cybersecurity oversight.

companyName: Freeze Tag, Inc.

ticker: FRZT


text: Our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to management regarding such oversight. The Board of Directors receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Mission Cloud assists us in the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes related to our Amazon Web Services infrastructure, and we leverage that information to assess and help prepare us and our employees to address cybersecurity risks.


text: We are working to continue to improve our overall cybersecurity approach and plan to take any necessary steps to protect our information assets and operations from internal and external cyber threats in the event any such steps are recommended by Mission Cloud or other 3 rd parties that we may engage to assist.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: DYNAMIC AEROSPACE SYSTEMS Corp

ticker: BRQL


text: Our management and the Board recognize the critical importance of maintaining the trust and confidence of our business partners, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board and executive officers are responsible for monitoring and assessing strategic risk exposure, and for the day-to-day management of the material risks that we face. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As a smaller company, we do not have any significant operations and our sole business activity is licensing our technology. However, because we have cash and investments in our bank and brokerage accounts and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As a smaller company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents during the years ended December 31, 2023 and 2022.

companyName: MANHATTAN SCIENTIFICS INC


text: Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. Our most sensitive data is stored in offline air-gapped devices. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: ASP Isotopes Inc.

ticker: ASPI


text: We intend to work with outside counsel and third party service providers in the near term to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting its customers and stakeholders' interests. A cybersecurity policy should be designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: Appsoft Technologies, Inc.

ticker: ASFT


text: At such time as the Company possesses sufficient resources, it will establish a cybersecurity policy appropriate for our business which implements protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. As part of this strategy, we expect to incorporate standard traffic monitoring tools, educate our personnel to identify and report abnormal activities, and partner with reputable service providers capable of upholding security standards equivalent to or exceeding our own.


text: We will seek to integrate these measures into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. We may work with outside consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, we expect that our policy strategy will include a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.


text: Cybersecurity threats have not significantly impacted our operations, and we do not anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, the preventive measures we adopt may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of artificial intelligence ("AI") technologies, and the potential challenges in implementing timely preventive measures.


text: Our Chief Executive Officer will oversee our information security programs, including cybersecurity initiatives, and is integrated into the cybersecurity the incident response process that we adopt. Our board of directors will oversee cybersecurity risk management activities, supported by Company management and external consultants.


text: We do not have any processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: GOLDENWELL BIOTECH, INC.

ticker: GWLL


text: Risks from Cybersecurity Threats To date, we have not yet experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations.


text: Our board of directors (the "Board") is acutely aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence.


text: The Board has oversight of cybersecurity risks and bears the primary responsibility for this domain. The members of our Board do not have experience in enterprise risk management, compliance, corporate governance, technology, or finance to equipping them to oversee cybersecurity risks effectively.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to protect our information systems and protect the confidentiality, integrity, and availability of our data. Presently our information systems are limited to databases maintained by third parties. As a result we have established limited policies and procedures to assess, identify, and manage material risk from cybersecurity threats. We assess risks from cybersecurity threats against our third-party information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats. Presently we do not believe there are any material threats to our systems.

companyName: Qrons Inc.

ticker: QRON


text: Following these risk assessments, if needed, we evaluate whether and/or how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We do not yet have an IT manager given our limited exposure to risks, and therefore the review of our limited systems is undertaken by our Chief Executive Officer (CEO) to manage the risk assessment and mitigation process. When applicable to our corporate structure and when we believe exposure to risks within our systems exceeds the current limited levels of exposure, we will monitor and test our safeguards and train our employees on the implementation of such safeguards, in collaboration with human resources, IT, and management, as available. We aim to promote a company-wide culture of cybersecurity risk management as we grow in size.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2023.


text: Our board of directors, also acting as our audit committee, is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our CEO is responsible for assessing and managing our material risks from cybersecurity threats and conducts this assessment on a regular basis, or at least once per year.


text: Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyber threats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: BioNexus Gene Lab Corp

ticker: BGLC


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our Board of Directors maintains oversight of risks from cybersecurity threats. Our Chief Executive Officer is assigned oversight of cybersecurity risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. These systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We implement generally applicable industry standards and best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems. Our management team oversees our information security policies and procedures. Our maintains a cyber incident reporting and response process and provides management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Jacksam Corp

ticker: JKSM


text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being unsecure, which could harm our business and reputation, and our proprietary business information could be misappropriated which could have an adverse effect on our business and results of operations."