text: The Audit and Risk Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats, and is regularly briefed on the Company's Cybersecurity Program by the Vice President of Information Technology and/or Director of IT Security, Risk and Compliance. These briefs include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: The Director of IT Security, Risk and Compliance implements and oversees our processes for regularly monitoring our information systems and detecting and reporting cybersecurity incidents. That process includes convening an incident response team composed of the Director of IT Security, Risk and Compliance, Vice President of Information Technology, Chief Compliance Officer, and General Counsel. The incident response team is responsible for overseeing the assessment of and response to any cybersecurity incident and for monitoring the Company's mitigation and remediation efforts. The incident response team is also responsible for informing executive management, the Audit and Risk Committee and, where appropriate, the Board of Directors, regarding the detection, mitigation, and remediation of cybersecurity incidents.

companyName: Bioventus Inc.

ticker: BVS

secItem: Item 1C


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and to protect the confidentiality, integrity, and availability of its data.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: The Company has integrated cybersecurity risk management into its broader enterprise risk management ("ERM") through defined training and incident response plans. The incident response plan defines the objectives, roles and responsibilities and scope of our incident response program, is designed to detect actual or potential cybersecurity events and is triggered by Endpoint Detection and Response ("EDR") system behavior monitoring. Once initiated, the incident response plan consists of several phases, which includes i) detecting a significant observable event, ii) examining a security related event with potential negative IT consequences for the company and iii) analyzing the risk of the event and the degree of remediation required. The Company has developed an incident management plan that operates within the incident response plan to help define the objectives, roles, responsibilities, and scope of our incident response plan.


text: In addition, the Company's training and response methodology includes regular end user cybersecurity updates, phishing tests and online trainings. We believe that these measures helps promote a company-wide culture of appropriate cybersecurity risk management, as well as ensure that cybersecurity considerations are an integral part of the Company's ERM decision-making processes at every level. The Company considers industry best practices to continuously evaluate and address cybersecurity risks in alignment with its business objectives and operational needs.


text: The full Board of Directors is responsible for the oversight of the Company's cybersecurity risk management. The Board is updated by the EVP, Global Supply Chain & Import regularly to remain informed on the Company's efforts in managing risks associated with cybersecurity threats.


text: The Company's Infrastructure Director is responsible for managing cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Infrastructure Director has 20 years of experience in the creation and management of enterprise security risk programs. The Infrastructure Director reports to the Chief Information Officer, who actively engages to monitor IT activities and has 40 years of Enterprise Security Management Experience as well as membership in a CIO peer group that reviews local cybersecurity concerns on a regular basis. The Chief Information Officer in turn reports to the EVP, Global Supply Chain & Import who is responsible for the Company's management of cybersecurity risk. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the appropriate Business Team Member in accordance with the Company's Incident Management Plan.


text: The Company engages with third-party experts, including cybersecurity focused Security Operations Center (SOC) and leading-edge (EDR) providers, to assist in evaluating and detecting security risk and initiate corrective actions. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain aligned with industry best practices. The collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: The Company uses third-party service providers in various functions throughout its business. The Company has stringent processes to oversee and manage risk with these third parties. The Company's process includes risk assessment activities, such as security assessments of all third-party providers, policies such as "minimum required access" to ensure compliance with current cybersecurity standards and monitoring activities, such as the review of potential cyber breaches announcements made by the third-party service providers.


text: Notwithstanding the approach we take to cybersecurity risk management, we may be unsuccessful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the by the Risk Management Committee of the Board of Directors. Our Data Breach Response Team performs annual cybersecurity tabletop incident response exercises, pursuant to our Data Breach Response Policy and Plan. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. See our risk factor "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed" in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR


text: Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Our Executive Director of Information and Technology Services ("IT Director"), who reports to our Chief Financial Officer, is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our IT Director has multiple university certifications in advanced cybersecurity with over 30 years' experience in cybersecurity and technology roles, most of which have been held with the Company. Meetings of our Risk Management Committee and Board of Directors include discussions and presentations from management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management on our enterprise risk profile on an annual basis. The Board of Directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats. We also use third party security tools to help identify, assess, mitigate, and remediate cybersecurity threats; however, we cannot guarantee that any third-party tools that we utilize will be successful in all circumstances, and whether such tools are appropriate for their level of risk.

companyName: Beauty Health Co

ticker: SKIN


text: We evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses. We review and test our information technology system on an as-needed basis (and at least on an annual basis) and also utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.


text: Our information technology systems are equipped to detect directed and non-directed attacks such as viruses and malware that can lead to interruptions and delays in the sale and service of our Delivery Systems and Consumables, general business operations, as well as loss, misuse of data, or theft of intellectual property, confidential information, and personal information (of third parties, employees, providers, and end consumers). However, as of the date of this report, these incidents have not had a material impact on our systems or business operations. Any significant disruption to our business operations or access to our systems could lead to a decline in operational effectiveness, result in a loss of our providers, and adversely affect our business and results of operation. In addition, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. For more information about the cybersecurity risks that we face, see the risk factor entitled, "We are increasingly dependent on information technology, and if we are unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program.


text: Management participates in discussions and updates the Audit Committee, as necessary, regarding any material cybersecurity incident as well as incidents with lesser potential impact. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk program on an as-needed basis. Members of our Board of Directors receive presentations on cybersecurity topics from our Chief Information Security Officer, internal staff, or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team (and team personnel who support our information security program) has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity third party vendors and consultants. In addition, our team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external vendors and consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. The team is led by our Vice President - Software, Engineering, and IT, who also currently serves as our Interim Chief Information and Security Officer, and has over 24 years of industry experience leading IT for organizations of similar sizes. Team personnel who support our information security program have relevant educational and industry experience, including holding similar positions at previous large companies and government entities.


text: Cybersecurity risk management is a major component of our overall risk management systems and processes. We have a cybersecurity program and governance structure designed to identify and manage cybersecurity risks and threats. The program encompasses a comprehensive framework that begins with a clear governance structure comprised of our Chief Technical Officer (CTO), Director of Internal Audits, and Senior Director of Compliance, ensuring a holistic approach to risk management. Regular reporting mechanisms to the board and senior management keep all stakeholders informed about the evolving cyber risk landscape and the program's effectiveness.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: The program includes a well-defined risk assessment and analysis process, identifying critical digital assets, conducting thorough threat and vulnerability assessments, and quantifying risks based on potential impact and likelihood. This information prioritizes risks, allowing us to allocate resources effectively and focus on mitigating the most significant threats. Policies and procedures form the foundation of the cyber risk management program, with comprehensive guidelines covering data protection, access controls, incident response, and employee training. Security controls, such as robust identity governance and access controls, AI-based email security solutions, endpoint protection, and network security measures, are implemented to fortify our defenses. An effective incident response plan ensures a swift and coordinated response to security incidents, minimizing potential damages. Continuous monitoring through MDR (Managed Detect and Respond) solutions and staying informed about the latest threat intelligence feeds enhance our ability to detect and respond to evolving cyber threats.


text: As part of our cybersecurity program, we assess the cybersecurity posture of our third-party vendors and partners to ensure they meet our security standards. This includes due diligence during the vendor selection and periodic evaluations throughout our partnerships. Third-party risk management, compliance adherence, and the consideration of cyber insurance contribute to a holistic and proactive approach to cyber risk management. Regular reviews and updates to the program ensure its relevance and effectiveness in the face of emerging threats, fostering a culture of continuous improvement and resilience.


text: We have not identified any risks from cybersecurity threats including those ones resulted from previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our business is substantially dependent upon our computer systems, devices and networks to collect, process and store the data necessary to conduct most aspects of our business. We have developed and maintain a cybersecurity program, which includes people, processes, and technology aimed at defending our computer systems, devices and networks against increasingly sophisticated threats.

companyName: Fat Brands, Inc

ticker: FATAQ


text: We recognize the importance of protecting both our information and operations from threats that could disrupt our business, put our assets at risk or compromise our customer and employee data. Our cybersecurity program is implemented and maintained using information security tools, policies and a dedicated team responsible for monitoring our networks, providing training to our employees, analyzing the evolution of new threats and strategies for mitigating such threats and seeking to continually harden our cybersecurity posture. The program is periodically exercised, reviewed, updated, and vetted through third-party audits, assessments, and tests with the goal of validating its effectiveness in reducing risk, as well as evaluating its compliance with legal and regulatory requirements. We assess, identify and manage our material risks from cybersecurity threats by employing the following: • Identification of critical systems – we seek to identify which operational or information technology, if compromised or exploited, would result in operational disruption or data compromise. We aim to protect the entire environment at an enterprise level where practical, combined with additional layered, risk-based controls designed to safeguard against cybersecurity threats. This strategic, defense-in-depth, and risk-based approach to cybersecurity provides a methodology designed to identify, protect, detect, respond, and recover from cybersecurity incidents. • Network segmentation – we use a combination of firewalls and routers to provide network segmentation seeking to provide us with network zone protection. • Access controls – we leverage several security capabilities to attempt to enforce access, authorization and authentication to relevant systems, technology, and controls. A least-privilege methodology is applied for localized client workstations, servers, and applications. Security capabilities for access control include physical, administrative, and technical controls that combine to provide a defense-in-depth approach designed to protect our cyber assets from unauthorized use. • Continuous monitoring, detection, and auditing – we employ various technologies, tactics, and procedures aimed to continuously monitor, baseline, and detect threats, and audit our network and systems. In addition, we use a combination of technology tools with outside managed security service providers designed to capture, analyze and respond to security anomalies. • Patch management – we use a network vulnerability scanning tool that continually scans, and reports identified vulnerabilities in servers and workstations in certain networks. Vulnerability scanner reports are used to drive patching and remediation efforts and are also used as a tool to evaluate the effectiveness of efforts to seek to ensure patches are applied timely. Application and infrastructure subject matter experts subscribe to various third-party vendor security notifications to receive proactive notifications on, among other things, bugs, security flaws and mitigations, related to operational and information systems.


text: The above cybersecurity risk management processes are integrated into our overall risk management program. Cybersecurity threats are understood to be wide reaching and to intersect with various other enterprise risks. In addition to assessing our own cybersecurity preparedness, we also consider cybersecurity risks associated with our use of third-party service providers based on the potential impact of a disruption of the services to our operations and the sensitivity of data shared with the service providers.


text: We regularly engage independent third parties to periodically assess our cybersecurity posture. These assessments include penetration tests, purple team activities, health checks and point-specific technical cybersecurity assessments of key systems. Some of these assessments are performed with internal audit oversight and tested in regular intervals.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Our Board of Directors oversees the execution of our cybersecurity strategy and the assessment of cybersecurity risks, along with the actions that we take seeking to mitigate and address those cybersecurity risks. Our Chief Information Officer (CIO) oversees our cybersecurity activities and leads our team of cybersecurity professionals responsible for our cybersecurity program and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our cybersecurity programs. Our CIO and other cybersecurity professionals provide periodic updates regarding cybersecurity risks to our Cyber Incident Response Steering Committee and Board of Directors.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. We have developed an enterprise risk management program ("ERM") designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the board of directors and our management. The program is designed to identify and assess risks most critical to our success including through an analysis of the likelihood of occurrence and potential impact of each risk. The executive leadership team, including our Chief Executive Officer, and our management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing, managing and mitigating risks with Board appropriate oversight.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: Our cybersecurity risk management includes enterprise-wide monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on our services, systems, resources, or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Our cybersecurity monitoring and identification efforts include the use of a third- party managed detect and response security service to monitor and take action as necessary, with the response ranging from automated processes to immediately block and remove undesired risks to cybersecurity team review and action, depending on the nature and severity of the risk. We have a Cybersecurity Incident Response Plan which provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, and includes activating crisis, or business continuity recovery plans, as appropriate. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.


text: We do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected us. However, the sophistication of cyber threats continues to increase, and the preventative actions that we have taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: Our Audit Committee and board of directors provide ultimate oversight of our cybersecurity risk management. Our Chief Information Security Officer, who also functions as our Chief Information Officer ("CIO"), provides quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as our processes, program and initiatives for managing these risks. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity.


text: Our CIO, who reports directly to the CEO, has significant professional experience including senior technical leadership roles at public companies and maintains the certified information systems security professional (CISSP) certification. Under the direction of the CIO, our information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks and conducts regular enterprise-wide training on cybersecurity threats for all employees. This analysis drives our long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the department and are communicated to the board of directors regularly.


text: We are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to identify, classify, and appropriately assess the range of cybersecurity threats that could affect our business and information systems. Accordingly, security incidents are evaluated, classified by severity and prioritized for response, mitigation and remediation. From a high level, our incident response framework consists of five elements: (1) proactively identifying and appropriately managing cybersecurity risks to our systems, assets, data, and other capabilities; (2) designing and implementing the appropriate safeguards to timely deliver business services; (3) implementing systems and processes to detect the occurrence of cybersecurity events; (4) responding to events in a systematic and comprehensive fashion; and (5) utilizing mechanisms to promote system resilience and the restoration of critical business functions that may have been impaired due to a security incident.

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Fundamentally, our information security program is tasked with developing pragmatic strategies for preserving the confidentiality, integrity and availability of Company and customer information. Pursuant to this approach, we have implemented controls to prevent, detect and mitigate cybersecurity risks posed by third parties. We use various tools and methodologies, including a written incident response plan and cybersecurity insurance, to manage and mitigate cybersecurity risk. Those tools and methodologies are evaluated on a regular and continuing basis. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Through both short-term "game day" events and more prolonged campaigns, red team programming is designed to continuously stress test the fortitude of our information security systems and assist in identifying areas of potential vulnerability. Based on the results of these simulated exercises, we aim to harden any identified exposure points and adjust our security processes to ensure dynamism and responsiveness. Along with our in-house cybersecurity capabilities, we also periodically engage third parties to assist with detecting and responding to cybersecurity risks. Third parties may be engaged to assist with procedures including red and blue team training exercises and penetration testing. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Amongst other controls, we maintain policies and practices that monitor, regulate and limit remote access of our information systems.


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. For more information on the risks from cybersecurity threats that we face, refer to Part I, Item 1A. "Risk Factors," of this Annual Report on Form 10-K, including but not limited to the risk factors titled, "We may be vulnerable to both physical and cybersecurity breaches, which could disrupt our operations and have a material adverse effect on our business, financial condition and results of operations" and "We may be exposed to cybersecurity threats and breaches, which could have a material adverse effect on our business, financial condition and results of operations."


text: Our information security team is led by our Chief Information Security Officer and is comprised of dedicated professionals responsible for overseeing cybersecurity risk management and mitigation, incident prevention, detection and remediation. These teams are spearheaded by professionals with decades of cybersecurity leadership experience across multiple industries, including our Chief Technology Officer. Our leadership working group meets on a weekly basis to discuss our approach to the rapidly-evolving cybersecurity landscape. To ensure that our top-level strategy is disseminated throughout the Company, our information security team provides hands-on and often role-specific training and awareness programs to our employees. Our employees with network access participate annually in required training, including spear phishing and other awareness training. We also periodically conduct simulated phishing exercises to practice appropriate response and augment employee awareness of established and emerging cyber threats.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including cybersecurity risk. Our Board of Directors considers cybersecurity risk and mitigation as a critical component of its risk oversight function and intends to further develop specific cybersecurity oversight functions and protocols. Our Board of Directors administers this oversight function directly through the Board of Directors as a whole, as well as through various standing committees of our Board of Directors, including the Audit Committee, that address risks inherent in their respective areas of oversight. In particular, our Board of Directors is responsible for monitoring and assessing strategic risk exposure and our Audit Committee has the responsibility to consider and discuss our major financial risk exposures and the steps our management has taken to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Audit Committee also monitors compliance with legal and regulatory requirements and is charged with oversight of the adequacy of Company's insurance programs, including cyber insurance.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our cybersecurity risk management program includes a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization in order to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment. The information technology and legal departments help identify, assess and manage Sangamo's cybersecurity threats and risks. The information technology department, in coordination with the legal department, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Sangamo's risk profile using various methods including, for example, evaluating threats reported to us, conducting audits, performing threat assessments, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan that includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our board of directors, business continuity plans, encryption of data, network security controls, systems monitoring, employee training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, cybersecurity software providers and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors included in Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."


text: Our board of directors addresses Sangamo's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President, Information Technology, who has over 20 years of technology experience which includes extensive cybersecurity implementation and oversight.


text: Our Vice President, Information Technology, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Vice President, Information Technology is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for approving budgets related to the foregoing.


text: Our cybersecurity incident response and vulnerability management protocol is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The executive leadership team works with the incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management protocol includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Audit Committee of our Board of Directors receives periodic reports from the Vice President, Information Technology, concerning the Sangamo's significant cybersecurity threats and risk and the processes we have implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Corporation maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Corporation's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Corporation's overall risk management processes, which are overseen by the entire board of directors and not delegated to any committee or subcommittee of the board.

companyName: PENNS WOODS BANCORP INC


text: As part of the Corporation's overall risk management processes, the board of directors has established both a senior management Risk Management Committee and a separate senior management Information Technology Steering Committee. Each of these Committees meets regularly and consists of the Corporation's senior management department heads, plus the Chief Executive Officer and the President and Chief Financial Officer of the Corporation (each of whom also serves as a director of the Corporation). The Information Technology Steering Committee reports directly to the board of directors, with the Corporation's Chief Information Officer ("CIO") presenting to the board a detailed report on information systems and cybersecurity matters at least once annually. The board of directors also receives and reviews copies of minutes of all meetings of both the Risk Management Committee and the Information Technology Steering Committee.


text: The Corporation's information technology resources are managed by a separate Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the CIO, who reports to the Corporation's President and Chief Financial Officer. The present CIO has been employed by the Corporation in the information technology area for twenty-eight years and holds an undergraduate degree in computer science. The Information Technology Department also employs a separate Information Security Officer ("ISO"), whose responsibilities include security relating to the Corporation's information systems. The present ISO is a Certified Information Systems Security Professional and also a Certified Fraud Examiner. The ISO reports directly to the Information Technology Steering Committee and to the Chief Risk Officer. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Corporation's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the CIO and the ISO to both the Risk Management Committee and to the Information Technology Steering Committee, each of which Committees includes the Chief Executive Officer and the President and Chief Financial Officer who are also directors of the Corporation.


text: The Corporation maintains an Incident Response Plan that provides documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the board of directors when appropriate. The Incident Response Plan is managed by the Information Technology Department, including the ISO, and is reviewed and tested at least annually.


text: The Corporation uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Risk Management Committee has established risk management guidelines for third-party vendors. The Corporation conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Corporation's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed at least annually. The Corporation cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Corporation may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Corporation shares with such providers.


text: To date, the Corporation has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations, or financial condition. As discussed under "Risk Factors" in Item 1A, however, the sophistication of cybersecurity threats continues to increase, and the preventative actions taken by the Corporation to reduce the risk of cybersecurity threats or incidents may not be sufficient in a particular circumstance. Accordingly, the Corporation may not be able to anticipate all cybersecurity breaches no matter how well designed or implemented the Corporation's cybersecurity controls and procedures are, and the Corporation may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: We adhere to industry-leading frameworks to safeguard our systems and data. The primary framework we follow is the HITRUST CSF (Common Security Framework). The HITRUST CSF provides a comprehensive, scalable, and technology-neutral approach to regulatory compliance and risk management. It encompasses information security risk management controls, including risk assessment, mitigation, and evaluation. Our processes for assessing, identifying, and managing material cybersecurity risks align with the HITRUST CSF guidelines.


text: We conduct monthly risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology departments. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage assessors, consultants, and auditors in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. For further information, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to our Business: Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, or use or other processing of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers, including our Chief Financial Officer and General Counsel, are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its audit committee.


text: Our Chief Financial Officer and Senior Director of Information Technology are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers. Our Senior Director of Information Technology leads our internal team and has over 20 years of cybersecurity experience, including the last 10 years in leadership positions, enabling him to build and transform successful cybersecurity programs and initiatives across several enterprises. His active associations include Veteran Volunteer Instructor for US Cyber Army Command (ARCYBER), Information Systems Security Association (ISSA), and Forum of Incident Response and Security Teams (FIRST), and has held many technical certifications including Strategic Planning, Policy, and Leadership (GSTRT), Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP). Our third-party vendors include assessors, consultants, and auditors holding (but not limited to) the following relevant certifications: Certified Information Systems Security Architecture Professional (CISSP-ISSAP), Certified in the Governance of Enterprise IT (CGEIT), Certified Data Privacy Solutions Engineer (CDPSE), and Certified Ethical Hacker (C|EH).


text: Our Chief Financial Officer and Senior Director, Information Technology oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Financial Officer and Senior Director, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes company incident management and data protection policies, and applicable cybersecurity incident response playbooks.


text: Our Chief Financial Officer and Senior Director, Information Technology provide periodic briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and the data of our partners ("Information Systems and Data").

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Our Chief Operating Officer ("COO") and our information technology ("IT") department help identify, assess, and manage our cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, evaluating threats reported to us, conducting threat and vulnerability assessments, and performing audits.


text: Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a security incident response plan, disaster recovery and business continuity plans, encryption of data, access controls, asset management, and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT department works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to our board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms such as legal counsel, cybersecurity software providers and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as cloud-based infrastructure hosting, data hosting, and encryption and authentication services. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, which may include regular security assessments, audits, and compliance checks. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect our business and how they may do so, see the section titled "Risk factors" in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, we could experience adverse consequences resulting from such a compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function and is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our COO, Mr. Chris Williams. Mr. Williams has experience in the security of both corporate and technical systems as well as business continuity planning in previous security operations roles at public pharmaceutical companies.


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our COO and senior director of global information technology. Our COO works with our IT department to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to our board of directors for certain cybersecurity incidents.


text: Our board of directors receives periodic reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The operation of our businesses is dependent on the secure functioning of our computer infrastructure, digital information systems, and third-party hosted services. We use these systems to maintain sensitive business and customer data, operate record-keeping and accounting functions, process business transactions, and for other key aspects of our business.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: We rely on a multidisciplinary team, including our information technology ("IT") department, management, and third-party service providers to identify, assess, and manage cybersecurity threats and risks. Our information security program utilizes various security tools and strategies, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We also work with third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, and threat intelligence service providers.


text: Our cybersecurity risk management is integrated into our overall risk management system. Our IT department works closely with our management and other relevant teams to regularly assess and identify possible material risks from cybersecurity threats, including, but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported on at least a quarterly basis to our Executive Compliance Committee, as described further below, to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented.


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risk Factors – We face risks related to our information technology systems, and potential cyber-attacks and security breaches."


text: Our management leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our information security program is coordinated by our IT department, led by our Senior Vice President of Information Technology, who has 27 years of industry experience in IT, with responsibility for enterprise security, and cyber risk management including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Supporting team members have relevant educational and industry experience, including holding similar technology positions at other companies.


text: Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our incident response processes include reporting to the Executive Compliance Committee, which includes our executive officers and leaders from the IT, compliance and legal teams, as well as to the Board for certain cybersecurity incidents.


text: Our Board holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. Members of the Board receive updates on a quarterly basis from senior management and the Executive Compliance Committee, including the reporting of emerging or existing cybersecurity risks, mitigation strategies employed to manage these risks, any cybersecurity and data privacy incidents, and status on key information security initiatives. In addition, our SVP of IT annually provides an overview of our information security program to the Board, including a summary of key performance indicators.


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage such material risks and to safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners and employees.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: The Board of Directors is actively involved in oversight of the Company's risk management framework and the Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration attempts to ensure that cybersecurity considerations are an integral part of decision-making processes throughout the Company. The Company's risk management team works closely with the Company's IT department to continuously evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures that are designed to provide for the prompt escalation of any cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive appropriate information in a timely manner.


text: Due to the complexity and evolving nature of cybersecurity threats, the Company has engaged from time-to-time external experts, including cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. The Company engages these third-parties to conduct regular audits, threat assessments and consultation on security enhancements. These interactions are intended to enable the Company to leverage specialized knowledge and insights, in an attempt to ensure its cybersecurity strategies and processes remain at the forefront of industry practices.


text: In furtherance of assessing, identifying, and managing material cybersecurity risks; the Company: • Employs advanced technology solutions, such as proactive detection tools, to safeguard our assets and identify threats within its environment. • Conducts routine cyber education and awareness training sessions to empower employees with the necessary knowledge and cultivate a strong security culture across the organization. • Regularly assesses our cybersecurity program against the NIST Cybersecurity Framework, using the findings to develop action plans and track progress to completion. • Organizes tabletop exercises and drills to simulate cyber incidents, enhancing its incident response and recovery capabilities. • Analyzes internal and external cybersecurity incidents and threat intelligence to assess their relevance to its environment and industry, crafting actionable plans accordingly. • Manages an enterprise-wide disaster recovery governance program, including cybersecurity-related standards and compliance procedures. • Performs regular cybersecurity-related disaster recovery testing to ensure the recoverability of its critical systems, supporting business continuity across various lines. • Fosters integration between business units and corporate divisions with its internal cybersecurity team, embedding cybersecurity requirements into operational environments and influencing strategic decisions, budgeting, and processes (e.g., Security by Design). Additionally, senior management, executives, and the Board of Directors consistently review financial planning processes concerning cybersecurity initiatives.


text: Additionally, the Company is aware of the risks associated with third-party service providers, it implements stringent processes to oversee and manage these risks. The Company conducts security assessments of third-party technology providers before engagement and maintains ongoing monitoring to ensure compliance with Company cybersecurity standards. The monitoring includes assessments (e.g., reviewing vendor cybersecurity related attestation and disclosures (SOC 2 Type 2, etc.)) by the Company's Chief Information Officer ("CIO") and on an ongoing basis by its security engineers.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. Notwithstanding that fact, the full Board of Directors has been designated the primary responsibility for oversight of the Company's cybersecurity risk management. As discussed below, members of management report the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports out to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise including, risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.


text: The Board of Directors and the Audit Committee receive briefings from the Company's Senior Vice President and CIO, Executive Vice President and Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to their regularly scheduled meetings, Board members, the CIO, CFO and CEO regularly engage in ad hoc conversations regarding emerging or potential cybersecurity risk and developments in the cybersecurity domain. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board of Directors conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Christos Ruci, the Company's CIO, is the member of the Company's management team primarily responsible for assessing, monitoring and managing the Company cybersecurity program. Mr. Ruci has over 20 years of experience in the field of technology and security including extensive experience as an enterprise CIO, as well as consulting experience advising organizations on their technology and risk profiles. The Company believes Mr. Ruci's in-depth knowledge and experience are instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies.


text: The Company's CIO oversees the day-to-day implementation of the Company's cybersecurity risk management programs, tests its compliance with standards, remediates known risks, and leads its employee training program. The CIO is tasked with keeping informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, in an attempt to assist in effectively preventing, detecting, mitigating, and remediating cybersecurity incidents. The CIO implements and oversees processes for the regular monitoring of the Company's information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is responsible for implementing the Company's incident response plan to mitigate the cybersecurity incident's immediate impact, implement long-term strategies for remediation, and prevent future incidents.


text: The CIO regularly informs the Company's CEO and CFO of material aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: As of the date hereof, the Company has not encountered cybersecurity incidents that the Company believes to have been material to the Company taken as a whole.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GrowGeneration Corp.

ticker: GRWG


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer ("CIO") who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: We engage consultants and other third parties in connection with our risk assessment policies and processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We require third-party service providers to certify their ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect the Company.


text: As part of our overall risk management strategies, we also conduct cybersecurity trainings for personnel at all levels and in all departments.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee. Our CIO provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.


text: Our CIO is primarily responsible to assess and manage our material risks from cybersecurity threats. Our CIO has over 25 years of professional IT experience and has held numerous positions with responsibility for managing network and data security, including in the legal and banking industries.


text: Our CIO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CIO is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include log review from IT and operations teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ESS Tech, Inc.

ticker: GWH


text: We conduct regular technical risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We also conduct periodic programmatic risk assessments including identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Vice President of Information and Business Systems who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and annual policy acknowledgments.


text: We engage external cyber vendor consultants, auditors, and other third parties in connection with our risk assessment processes. These service providers assist us to assess, design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We review the ability of third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our Company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Third parties might attempt to gain unauthorized access to our network or seek to compromise our products and services."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk function in coordination with the oversight and periodic review of the audit committee.


text: Our Vice President of Information and Business Systems and members of our management team in accordance with our cybersecurity incident response plan, which includes the following members from the following function – legal, IT, finance, audit, operations, engineering, human resources, communications, and additional executives as applicable under the plan – and external cybersecurity support providers (collectively, "IRP stakeholders"), are primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Vice President of Information and Business Systems and our IRP stakeholders oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Vice President of Information and Business Systems has an advanced degree in management information systems and has managed the Company's IT processes and policies inclusive of cybersecurity matters throughout his tenure at the Company, in addition to many years of prior experience in various technology roles at a large U.S. public company. He is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by working with the IT department and external vendors to implement our security risk management, including through the use of both automated and manual tools and reporting, in accordance with the Company's incident response plan and Company cybersecurity policies.


text: Our Vice President of Information and Business Systems provides quarterly briefings to the audit committee and board of directors regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: TIAA, on behalf of the Account, has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. The Account's business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA, with support from certain of its subsidiaries, manages the Account's day-to-day operations and has implemented a cybersecurity program that applies to the Account.

companyName: TIAA REAL ESTATE ACCOUNT


text: The Account depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. The Account relies on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with the Account's use of such entities.


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA, the Account, and other products, subsidiaries and affiliates of TIAA and their respective third party service providers.


text: This cyber risk management program is integrated into TIAA's overall risk management program. It involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Account relies. TIAA relies on its internal subject matter experts and external experts, as needed, including but not limited to cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, applicable to the Account and other products, subsidiaries, and affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Account in connection with its day-to-day commercial real estate, investment, and other operations.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from TIAA's Cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Account.


text: Management's Role in Cybersecurity Risk Management TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Account. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Account is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Account, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Account are assessed on an ongoing basis, and how such risks could materially affect the Account's business strategy, operational results, and financial condition are regularly evaluated. TIAA maintained appropriate cyber security policies and procedures during the 12-month period covered by this report and there were no material cybersecurity issues that affected the Account. Cybersecurity risk remains heightened to the financial industry, including the Account, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Account's operations and performance. TIAA continues to invest in its cybersecurity program to protect against emerging threats, including threats against third parties and service providers.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Executive Officer.

companyName: Southern States Bancshares, Inc.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The information security program is periodically reviewed with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on- going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Business Continuity Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees. The Business Continuity Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Business Continuity Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. To date, risks from cybersecurity threats have not materially affected our company.


text: Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense program. This endpoint program is monitored 24/7 and would notify IT staff of an incident. Most incidents would be mitigated by monitoring staff of the endpoint program, but IT staff would have to be involved in more severe incidents. This mitigation is resolved from an always updating database. In severe cases, the device that triggers the incident would be locked down and a plan of action would be put in place. The second line of defense is a monitored firewall. This would also notify IT staff of an incident. Last line of defense is IT Staff. The department is augmented by an information security specialist that is on a monthly retainer. Individuals within the department are generally subject to professional education requirements.


text: Our board of directors has approved a committee comprised of directors and management called the Information Technology Committee. This committee provides oversight and governance of the technology program and the information security program. This committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur from time to time in accordance with the Business Continuity Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents.


text: The Company is a late-stage clinical biotechnology company committed to applying scientific leadership in the field of localized cancer reduction leading to anti-cancer immune activation. Currently, management has not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk. Management assesses material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. To this end, the Company utilizes an outsourced information technology consultant to implement systems and procedures designed to reduce, respond to and monitor for cybersecurity threats and vulnerabilities. The outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems and has implemented systems and procedures to mitigate cybersecurity risks that the Company believes are appropriate for a company of our size, stage of growth and financial condition. In addition, the Company carries insurance with coverage for cyber events that it believes is suitable for a company of our size, stage of growth and financial condition.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including the Company's business strategy, results of operations or financial condition.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, the Company's Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology (including cybersecurity) risks. In general, the Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that it collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service provider risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.