text: The Company's CISO has a Bachelor of Engineering degree in information technology and more than 25 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team have also been instructed to elevate any potential cybersecurity issues, whether internal or at a third-party with whom we do business, to the CISO.


text: The Incident Response Team and the non-management employees who support the Incident Response Team are best positioned to identify, assess, respond to and galvanize both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident Response Team are notified and a preliminary assessment of the situation is made. Designated individuals within the Incident Response Team will notify the Chief Executive Officer, and if the situation so warrants, the Board of Directors, cybersecurity experts, outside counsel and other advisors to help further assess and formulate an appropriate response to the situation. A strong working relationship exists between the legal, accounting/finance, IT and business departments so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM

secItem: Item 1C


text: We understand the importance of maintaining an active cybersecurity risk management and strategy program. As an emerging technology company, we understand that we may face cyber threats that range from common cyberattacks, such as ransomware, to more advanced attacks such as advanced persistent threats perpetrated by nation-state actors and other highly organized actors. Our cybersecurity risk management program is guided by industry standards, such as the National Institute of Standards and Technology ("NIST"). We strategically partner with industry leading external vendors to perform cybersecurity assessments, as well as regular penetration testing to better understand our potential vulnerabilities, threat vectors, and impact on critical assets or operations. As part of these processes, our cybersecurity team identifies and prioritizes risks to devise our annual cybersecurity mitigation strategy and address operational risks. Our cybersecurity program is organized around the following key areas:

companyName: Archer Aviation Inc.

ticker: ACHR


text: Risk Management and Strategy Insider Risk Management. We recognize that not all threats are external. We have an insider risk management program and are working to improve our data loss protection technology to protect our critical data.


text: Security Awareness Education. Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees.


text: Technical Safeguards. We have improved our endpoint security postures through the implementation of an Enterprise Mobile Management system, and continue to increase our investment in strengthening email, DNS, and other network security services.


text: Threat Detection and Response. In addition to aligning our cybersecurity risk management program to NIST standards, we have also engaged with third party providers of security information and event management and cybersecurity services to provide continuous monitoring and operational threat detection and response. Our partners integrate threat intelligence into their platforms, providing us with a proactive view of possible threats.


text: We have implemented a holistic review of incident response, with workflows in place for cybersecurity incidents, including provisions for assessing materiality, and defined escalation procedures.


text: Third Party Risk Management. To manage third-party risks, our cybersecurity team evaluates our partners, to provide an additional layer of scrutiny, and supervises and identifies material risks associated with the use of third-party service providers. These processes include a review of security controls and supplier contractual obligations for security and data protection requirements.


text: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including with respect to risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss, technology and cybersecurity risks and the risk assessment and risk management policies, practices, programs and/or procedures that we have adopted to monitor, control, mitigate and manage such risks. Our Board of Directors is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy and evolving threat landscape as well as bolstering existing cybersecurity knowledge and continued education of recent cybersecurity trends.


text: We are developing processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats. As our first key investment, we have hired our Director of Information Security with over 20 plus years of information security experience to oversee our cybersecurity program. Our Director of Information Security reports up to our Chief Information Officer. Together our Director of Information Security and Chief Information Officer have over 40 years of combined experience.


text: Risk Management and Strategy Managing Material Risks & Integrated Risk Management We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: We conduct regular risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, attack surface state and threat modeling, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We perform internal audits of our cybersecurity procedures, review data access rights, conduct system vulnerability scans and prepare incident logs, alerts and threat reviews. We received ISO 27001 certification in 2014 and are subject to annual ISO 27001 standard compliance monitoring audits and periodic customer security audits.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Operations Officer ("COO"), to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and a dedicated Grid University training department. Personnel at all levels and departments are made aware of our cybersecurity policies through multiple channels of communication and training.


text: Engage Third-parties on Risk Management We engage third party auditors in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as with monitoring and testing our safeguards at different levels. We require each third-party service provider to ensure that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity incident that had any significant impact on our operations or financial standing.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Failure to comply with laws and regulations relating to privacy, data protection, and cybersecurity could lead to government enforcement actions, private litigation and adverse publicity".


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Management's Role Managing Risk Our CISO and our management committee on cybersecurity, which includes our CEO, COO and IT Director, are primarily responsible to assess and manage our material risks from cybersecurity threats. They are assisted by dedicated information security and IT staff, our Data Protection Officer ("DPO"), HR Director, and legal and finance representatives. Our current management committee on cybersecurity includes dedicated full-time specialists in relevant fields ranging from code, application, system, and network security to computer forensics, data privacy and applied cryptography, physical security, social engineering and red teaming. Our CISO who has been leading the team for over a decade, has 20+ years of industry experience, is a Certified Information Systems Security Professional and lead ISO 27001 auditor, and has authored five books on information security auditing strategy, wired and wireless network security, and penetration testing.


text: Our CISO and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness.


text: Reporting to Board of Directors Our COO reports to our audit committee on a quarterly basis regarding the Company's current cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, customer escalations and requests, cybersecurity systems testing, relevant threat landscape and activities of third parties, security controls implementation status and the implementation of any new cybersecurity tools. Our audit committee regularly reports its activities, including review of cybersecurity matters, to our board of directors.


text: The Company maintains an Information Security Program to safeguard all WSFS information assets against unauthorized use, disclosure, modification, damage, or loss. Information Security, in conjunction with Operations, Technology, and Executive Leadership, work together to provide and maintain security processes and procedures pursuant to which the Company will: • Ensure the security and confidentiality of customer and bank records covered by law. • Protect against any anticipated threats or hazards to the security of such records. • Protect against the unauthorized access or use of such records or information in ways that could result in substantial harm to the Company, our Customers, and Associates. • Establish guidelines and practices for ensuring Information Technology compliance to external and regulatory requirements. • Ensure proper and effective Business Continuity and Disaster Recovery programs are implemented and tested.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: The Company's Chief Information Security Officer (CISO) is designated as the program coordinator responsible for coordinating and overseeing the program.


text: Our Information Security Department performs annual risk assessments to evaluate the effectiveness of the controls as set forth in the Information Security Program to support the requirements under Gramm-Leach Bliley Act (GLBA), and Federal Financial Institutions Examination Council (FFIEC) Guidance on Securing Customer Information. The focus areas include: • technology systems used for information that is collected, processed and stored; • assessing internal and external cybersecurity threats and vulnerabilities; • performing regular penetration and controls testing; • evaluation and assessment of impact should the information or systems become compromised; • evaluation for the effectiveness of the governance structure for Information security risk management.


text: Internal and external Penetration Testing is performed annually. Tests are conducted or reviewed by independent third parties or qualified Associates independent of those that develop or maintain the security program. Testing is performed annually by third party auditors contracted through the Company's Risk Management Department. Management reviews test results promptly and ensures that appropriate steps are taken to address adverse test results. Remediation efforts are organized and made available to the Risk committee of the Board of Directors (Risk Committee) as well as for review by third party auditors and examiners.


text: The Company has implemented a Cybersecurity Incident Response Plan (CSIRP), which is integrated into its Master Business Continuity Plan, to identify, assess and respond to cybersecurity threats. The CSIRP provides a well-defined, consistent, and organized approach to information security related incidents and is supplemented by playbooks designed to respond to specific attacks. The CSIRP requires approval by the Executive Leadership Team under the Cybersecurity Committee and is governed by the Continuity of Operations Policy that is approved annually by the Board of Directors.


text: The Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition.


text: Our Information Security Policy and Information Security Program are the standards used to protect the Bank's confidential information. The Information Security Policy is annually reviewed, updated, and approved by the Risk Committee and the Board of Directors.


text: The CISO reports security related incidents, findings, changes, etc. to the Risk Committee, on an annual basis or quarterly as needed. This information is communicated through the Company's Risk Department. The CISO has more than 25 years of experience in the information security field, including 20 years at WSFS, and holds several professional certifications and memberships in the Information Security, IT, and financial services fields.


text: The Board and Senior Management are charged with the ultimate responsibility for understanding the company's risk environment. A Management Risk Committee, chaired by our Chief Risk Officer (CRO), is responsible to oversee the Company's risk management program on an enterprise-wide basis.


text: The Company has dedicated incident management and response teams in place to facilitate response protocols and execute designed strategies necessary to mitigate business risk and support recovery initiatives. The Incident Management Team structure is based on the Incident Command System and follows a flexible, adaptable approach with response team membership designed to support expanding response team needs. An Incident Response Task Force (IRTF) is in place to oversees the assessment of cybersecurity incidents and operational response needs. The CISO and the Head of Regulatory Affairs/Relations co-lead IRTF response.


text: The CSIRP includes a framework to timely report cybersecurity incidents to our Executive Leadership Team. The severity of an incident is based on perceived impacts that include the severity of damage, compromise, or loss, and probability of further exploitation or escalation. The Chief Information Officer (CIO) and CRO are notified of all incidents that are determined to be significant. based on perceived impacts of the incident or event. The Chief Executive Officer and Board of Directors are notified of these incidents by the CIO and CRO as necessary.


text: For further information on risks to the Company from cybersecurity threats, see "System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation and other potential losses" under Item 1A. Risk Factors."


text: Astrana, like the rest of the healthcare industry, continues to innovate and rely on digital technology, further increasing the importance of cybersecurity to the business. The world is seeing an increase in cyberattacks by nation-states, hacktivists, organized cybercriminal groups, and insider threat actors, all of which may, among other avenues of attack, be using artificial intelligence ("AI") and distributed hosted environments across different geographies to attack their victims. These threat actors may be individuals or part of a cyber organized crime group that leverages large-scale Cybercrime-as-a-Service ("CaaS") subscriptions to quickly scale the impact of attacks and avoid disruption to their operations.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The Company's digital systems are distributed across various architectures, including on-premises, hosted, Software-as-a-Service ("SaaS"), and other architectures operated by third-party service providers. If these architectures and third-party environments fail to operate as contracted, Astrana's systems could stop functioning for some time, placing Astrana's strategy, data, clients, and users at risk.


text: As noted in Item 1 and Item 1A of Part I of this report, a breach of Astrana's network, hosted service providers, or vendor systems may expose Astrana to a risk of loss or misuse of information, litigation, and potential liability. Therefore, the Company has a team of experienced professionals with expertise in cybersecurity leadership, risk management, incident response, and security operations overseeing Astrana's program. This team is responsible for developing and implementing our cybersecurity strategy, identifying and mitigating risks, and responding to incidents. Astrana utilizes external resources from reputable cybersecurity firms to supplement certain Chief Information Security Officer ("CISO") functions, including risk assessments, strategy, and security, while integrating these activities with Astrana's risk management processes. Astrana assesses third-party cybersecurity controls through cybersecurity questionnaires and includes security and privacy addendums to our contracts, where applicable.


text: To address cybersecurity, privacy, and overall business risk adequately, Astrana employs a consistent risk management process that assigns risks to functional owners. Risks can be strategic (e.g., loss of market share, technology shifts), reputational (e.g., loss of trust, revenue decline), regulatory (e.g., regulatory fines, business restrictions), or operational (e.g., operational downtime, productivity loss) in nature.


text: The cybersecurity team collaborates with leaders in management to assess materiality, align on a remediation roadmap, and comply with disclosure requirements. On an ongoing basis, the board of directors and the audit committee oversee Astrana's cybersecurity risks and remediation strategies to prevent and mitigate cyberattacks.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We have developed policies and processes for assessing, identifying, and managing material risk from cybersecurity threats informed by industry-recognized standards. We have integrated these processes into our overall risk management systems and programs. Our cybersecurity program includes, among other things: procedures to assess material risk from cybersecurity threats, protocols to monitor any potential unauthorized access to, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein, mechanisms to safeguard network infrastructure, mandatory employee training on information security, and assessing the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. As part of our risk management process, we have engaged and expect to continue to engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process is also designed to address cybersecurity risks associated with our use of third-party service providers, and includes procedures such as reviewing security audits and controls of these providers during the onboarding process.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: In connection with these risk assessments, we design, implement and maintain reasonable safeguards to minimize the identified risks and address identified gaps in existing safeguards, update existing safeguards as necessary and monitor the effectiveness of our safeguards.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including as a result of any previous cybersecurity incidents) that have materially affected our business strategy, our results of operations or our financial condition, but there can be no guarantee that we will not experience a cybersecurity incident in the future. We can give no assurance that we have detected or protected against all cybersecurity threats or cybersecurity incidents.


text: For further discussion of cybersecurity risks, please see our Risk Factors discussion under the heading, "Risks Related to Our Intellectual Property, Technology and Cybersecurity."


text: Our Board of Directors (the "Board") has oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them, and engages in discussions with management regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks. These discussions include a review of our cybersecurity-related risk assessment and risk management policies.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management, along with our information technology department, is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances. Our information technology department works with management, including the Chief Operating Officer and Chief Financial Officer, to help mitigate and remediate cybersecurity incidents of which they are notified. Our information technology department, led by our director of information technology, includes individuals with over 20 years of prior work experience in various roles involving security, compliance, systems and risk management implementation. In addition, our incident response processes include procedures for reporting material cybersecurity incidents to the Audit Committee for material cybersecurity incidents.


text: As a healthcare provider, cybersecurity, data protection, safeguarding patient information and the integrity of our information systems is of the utmost priority. We have developed and maintain a Cybersecurity and Data Protection Program which aligns with industry-standard frameworks and applicable regulatory requirements, integrates with our overall risk management process, and aims to ensure cybersecurity concerns are a requisite element for decision-making at all levels of our business.

companyName: RadNet, Inc.

ticker: RDNT


text: RadNet's Cybersecurity and Data Protection Program assesses, identifies and manages threats to our information systems and evaluates cybersecurity risks associated with our vendors and third-party partners. We are focused on detecting, preventing and responding to cyber threats, maintaining the privacy and protection of sensitive information, and maintaining the durability and resiliency of our information and data processing systems.


text: Our approach to designing, operating and measuring the effectiveness of our program leverages experienced internal resources, industry-recognized cybersecurity consultants, assessors, healthcare and industry-specific cybersecurity working groups and threat-intelligence platforms, federal law enforcement and CISA partnerships. We use these resources and partnerships, along with our internal expertise, to develop specialized insights pertinent to our business's cyber-risk, and tailor our cybersecurity strategy to best safeguard our systems and data.


text: We staff an internal cybersecurity team and maintain a third-party managed security operations center which in-concert provide 24x7x365 real-time detection and response. These teams are always connected and routinely respond to perceived threats within minutes. Time to detect and respond metrics are continuously evaluated for opportunities to enhance our program.


text: Cyber-awareness training and testing is a key component of RadNet's Cybersecurity and Data Protection Program. Every employee is required to complete cyber-related training (including third-parties who access our systems) and successfully complete testing throughout the year in addition to monthly phishing tests. Furthermore, we require all system users to complete annual Patient Privacy and Patient Data Breach training and testing to meet RadNet compliance standards.


text: We benchmark and evaluate our Cybersecurity and Data Protection Program and data protection maturity against the NIST Cybersecurity Framework and the HIPAA Security Rule. Consistent with these frameworks, our program includes recurring third-party assessments and a vendor risk management program. Our vendor risk management program conducts security assessments to determine a risk profile of potential vendors and third-party partners and integrates ongoing monitoring and periodic re-assessments to ensure compliance with RadNet's security standards. RadNet's Vendor Risk Management Team works closely with RadNet Legal, Compliance and Operations teams to address data safety, compliance and legal requirements for each of our vendor/partner engagements.


text: We continuously evaluate the practical effectiveness of our cyber-defenses both internally and externally using a combination of technology-based assessments and recurring third-party audits. Our Critical Incident Response Team periodically conducts cyber-focused tabletop exercises using scenarios drawn from observations of risk indicators and from threat intelligence reports of real-world incidents affecting our industry. Outcomes and insights from tabletop exercises are used to enhance RadNet's Incident Response Plan which is architected following NIST guidelines and reviewed annually and updated periodically as needed.


text: Our program's overall maturity and operational readiness are regularly evaluated internally by RadNet IT Governance and Compliance teams and by independent expert auditors using the NIST's Cybersecurity Framework. Our program, and the results of the evaluation and testing efforts, are regularly reviewed by our senior management and members of our Board of Directors.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. However, cybersecurity threats have the potential to interrupt our operations or cause significant financial hardship. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.


text: RadNet is committed to appropriate cybersecurity governance and oversight. Our Cybersecurity and Data Protection Program is the principal responsibility of our Chief Information Officer and Chief Information Security Officer, each of whom have over 20 years of experience in information systems, including cybersecurity training and experience. Additionally, RadNet's CIO and CISO work closely with our executive management, legal and compliance leaders, and meet regularly to discuss cybersecurity matters and risks.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Audit Committee of our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, and internal audits of our program. Our Audit Committee also receives regular cybersecurity updates and education on a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident report and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: The Company maintains a robust enterprise-wide information security program aimed at assessing, identifying, and effectively managing cybersecurity risks, threats, and incidents. The Company has integrated cybersecurity risk management into its broader risk management framework to promote cybersecurity risk management company-wide.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Third-Party Engagement The Company engages a range of third-party advisory service providers, including cybersecurity assessors, consultants, and auditors, to conduct recurrent evaluations of its cybersecurity controls. These reviews are a critical component of the ongoing risk assessment process within the cybersecurity function and include periodic evaluations of internal controls aimed at mitigating cybersecurity threats. These assessments often include penetration tests, evaluations of the Company's cyber program maturity, and assessments of progress toward future-state cyber initiatives, among other considerations. The results of these reviews are reviewed with management and the Company's Board of Directors (the "Board").


text: Oversee Third-party Risk The Company implements processes to oversee and manage the risks inherent with third-party service providers, including conducting thorough security assessments prior to engagement. This is designed to mitigate risks related to data breaches or other security incidents originating from third party providers.


text: The Company has implemented internal incident response procedures to address potential cyber incidents. These procedures are designed to analyze, contain, and remediate any cyber incidents that may circumvent existing safeguards. The incident response procedures encompass a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal (including the Board) and external communication and disclosure protocols. The Company also maintains data backup procedures in the event of a cybersecurity incident and for a business continuity plan in the event of business interruption. Examples of our backup procedures include regularly scheduled backups for various systems, critical system log files, and applications backup.


text: Governance & Board Oversight The cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"). The CISO plays a pivotal role in informing the audit committee and the Board on cybersecurity risks.


text: The audit committee is primarily responsible for the Board's cybersecurity risk oversight. Management, including the CISO, provide comprehensive briefings to the audit committee on cybersecurity risks on a regular basis, and the audit committee reports to the Board at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the full Board is regularly briefed on updates related Global Information Security Program and the Company's Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions. In addition to scheduled meetings, the audit committee and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain.


text: Management's Role Managing Risk The CISO possesses more than 10 years of relevant expertise in cybersecurity; and holds a Certified Information Systems Security Professional ("CISSP") certification. Other members of the Company's information security team also hold certifications such as CISSP, Certified Information Security Manager ("CISM"), Certified Ethical Hacker ("CEH"), and Certified Information Systems Auditor ("CISA").


text: The Company's Chief Information Officer ("CIO") and CISO work closely with other management positions, including the Chief Financial Officer, Chief Legal Officer, Head of Internal Audit, and Internal Communications, to evaluate cybersecurity risks in alignment with our business objectives and operational needs.


text: The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology ("NIST") security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to ensure the efficacy of our security measures.


text: Furthermore, the program includes a formal information security training program that includes comprehensive security awareness initiatives and training modules, addressing critical areas such as phishing attacks and best practices for email security.


text: Impact of Cybersecurity Threats As previously disclosed, we have experienced significant cyber incidents in the past, including in April 2023, that have impacted our operations and financial results. The related expense is reflected in "Acquisition, cyber incident, and other, net" on the Consolidated Statement of Operations for the year ended December 31, 2023, and the reserve balance is included in "Accounts payable and accrued expenses" in our Consolidated Balance Sheets as of December 31, 2023. For additional information regarding such risks and the affects thereof on our business strategy, operations and financial condition, see Part I, Item 1A, Risk Factors – "A failure of our information technology systems, cybersecurity attacks or a breach of our information security systems, networks or processes could cause business disruptions and the loss of confidential information and may materially adversely affect our business."


text: The Company has a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, which includes a cybersecurity Incident Response Plan ("IRP"). Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Cybersecurity Risk Identification and Management We design and assess our program based on the Center for Internet Security Critical Security Controls Version 8 (CIS V8). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS V8 controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • third party risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • end-user testing to assess the effectiveness of our security measures; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including mandatory computer-based training, phishing awareness campaigns, and internal communications; • a cybersecurity IRP that includes procedures designed for identifying, analyzing, containing, remedying and otherwise responding to cybersecurity incidents; • testing of our incident response readiness through Disaster Recovery and Business Continuity Plan exercises; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor-Risks Related to Our Stores and Operations-We and our vendors rely on information technology, and any material failure, inadequacy, interruption or security incident affecting that technology could harm our business, results of operations and financial condition."


text: Our management team, including our Senior Vice President of Information Systems and Vice President of Information Security and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team overseeing cybersecurity has over 25+ years of technology and cybersecurity experience and certain of our team hold various cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company is able to identify cybersecurity breaches through various channels, including but not limited to automated event detection alerts, reports from employees, notifications from external entities such as third-party IT service providers, and proactive threat investigations in collaboration with our external partners. Upon spotting a potential cybersecurity breach, including those involving third-party cyber events, the Company's designated incident response team outlined in the IRP adheres to the policy's protocols to investigate the suspected incident. This investigation entails determining the nature of the event (e.g., ransomware attack or breach of personal data), evaluating the severity of the incident, and gauging the sensitivity of any compromised data.


text: In the event of a cybersecurity breach, our primary objective is to swiftly contain it by the procedures detailed in our IRP. Once containment is achieved, our focus shifts to remediation and recovery efforts. These actions are tailored to the specifics of the breach and may involve tasks such as rebuilding systems or hosts, replacing compromised files with clean versions, verifying the integrity of affected files or data, enhancing network surveillance or logging to detect future attacks, adjusting administrative account privileges, fortifying network security like firewall configurations, and providing additional training to employees. Additionally, we carry cybersecurity insurance to cover certain expenses associated with security lapses and specified cyber incidents that disrupt our network or those of our vendors, subject to predefined limits and exclusions.


text: Our IRP includes clear communication guidelines, outlining procedures for engaging executive management, internal and external legal counsel, the Audit Committee, and the Board. These protocols also encompass a framework for evaluating our regulatory reporting obligations to entities such as the SEC in the aftermath of a cybersecurity incident.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program on a quarterly basis. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Systems as well as our Vice President of Information Security and Compliance, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: As part of our board refreshment efforts in recent years, we have added directors with information technology governance skills. Currently, five members of our board, including all four members of our Audit Committee, have cybersecurity experience from their principal occupation, other professional experience or third-party director education courses on cybersecurity, including cyber risk governance, and data privacy and security issues and trends.


text: Ginkgo integrates risk management into its overall cybersecurity strategy, and has implemented processes designed to identify, assess, prioritize and manage risks to protect Ginkgo's data, intellectual property and information assets. As part of our risk governance and management, Ginkgo has developed processes designed to: identify and assess risks, evaluate those risks against pre-defined criteria, develop and implement strategies to address identified risks, monitor and review those risks and communicate risks to relevant stakeholders. Identifying Ginkgo's cybersecurity risks involves a multifaceted approach that encompasses both internal assessments and external information sources. For example, we use security audits conducted by internal and external auditors to assess compliance with security policies and industry frameworks; vulnerability assessments to discover vulnerabilities in networks, systems and applications; penetration testing using simulated cyberattacks to test the resilience of systems and identify weaknesses; and risk assessment processes to evaluate IT infrastructure, including using a risk register to identify risks, likelihood of their occurrence, potential impact, and remediation. We also oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: Cybersecurity risk management is overseen by Ginkgo's Chief Information Security Officer ("CISO"), who is supported by full-time information security staff. The CISO advises the executive team on the development and implementation of the information security program.


text: Ginkgo incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, Ginkgo has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, "Significant disruptions to our and our service providers' information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us."


text: The Board provides regular oversight of the Company's cybersecurity risk management program. The CISO presents to the Board and the audit committee of our Board (the "Audit Committee") at least annually and quarterly updates via business review dashboards. The Board provides guidance to the CISO, including with respect to any changes to business priorities, risk tolerance, or security initiatives. These briefings are also augmented by ongoing and continuous interactions between the Board and the CISO, as needed.


text: Ginkgo's CISO has primary responsibility for assessing and managing Ginkgo's risks from cybersecurity threats. The CISO has over 20 years of pubic- and private-sector experience in information technology and has served as Ginkgo's CISO since 2018. Executive leadership provides oversight and governance through monthly business reviews of the cybersecurity program.


text: Ginkgo also has a Disclosure Committee, which is composed of representatives from executive leadership from various departments across Ginkgo (e.g., legal, finance, accounting). Their role is to determine materiality of a cyber incident and provide guidance with respect to any disclosure obligations resulting from a cyber incident.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers that includes a diligence and contracting process depending on our assessment of each provider's respective criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Because our products collect and store visitor and related information and images, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, including our Vice President of Cybersecurity and Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and IT has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and IT was the Leader of Global Information Security for New Balance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company has established an information security program to assess, identify and manage material risks from cybersecurity threats, which is an integral part of the Company's overall enterprise risk management program. This program is established at the executive level, with regular reporting to, and oversight by, the Company's Board as described below.

companyName: Uniti Group LLC


text: As part of the Company's information security program, the Company maintains written policies and procedures, such as the Information Security Policy and Company's Incident Response Plan, which identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company's Information Security Policy identifies security controls, appropriate use, and user responsibilities for the organization that are in place to identify and manage the risk of a cybersecurity incident.


text: The Company has implemented a set of controls to manage information risk, utilizing controls from multiple security frameworks, specifically ISO 27001, and the Payment Card Industry Data Security Standard (PCI-DSS). The Company also conducts various internal and external information risk assessments each year, which are based on nationally accepted standards, including annual compliance required assessments, such as PCI and SOX audits, as well as ad-hoc assessments driven by emerging risks, changes in the Company's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in the Company's risk portfolio and are then prioritized and addressed as needed through the Company's broader information security programs and policies. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, encryption, and vulnerability and patch management.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. To protect its information and cyber assets, the Company conducts appropriate cybersecurity exercises and training. For example, employees must complete cybersecurity training at least annually, which educates our employees on the Company's policies and procedures for incident reporting, and avoiding common cybersecurity threats such as phishing attacks.


text: Additionally, the Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company's information security program, including to conduct risk assessments, vulnerability scans, and penetration testing based on nationally accepted standards. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, such as requiring an independent assessment of the third party's information security controls where appropriate. As part of the Company's process to continuously improve its information security programs, the Company also engages third-party subject matter experts to assess and evaluate the effectiveness of various aspects of the Company's information security program.


text: The Company (or the third parties on which it relies) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Board Governance and Management Cybersecurity risk is managed as an enterprise risk in the Company's enterprise risk management process. At the highest level, the Company's program includes multi-layered governance by management, the Audit Committee and the Board of Directors.


text: Ultimate responsibility for risk oversight and management generally lies with the Company's Board. To effectively manage oversight of our cybersecurity risk management practices, the Board has delegated such responsibility to the Company's Audit Committee. The Company's Chief Information Officer ("CIO") and the information security team provide reports to either the Audit Committee or the full Board on a quarterly basis on various matters, including current and emerging cybersecurity risks to the Company, internal and external assessments of the Company's information security program, and a roadmap of projects to manage its information security posture. In the event of any significant cybersecurity incidents, the Company's Incident Response Plan outlines the process to escalate communications to the Audit Committee and/or the full Board in the event of any significant cybersecurity incidents between the quarterly updates on an ad hoc basis.


text: At the executive and management level, the CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program. The CIO has 19 years of experience in technology risk management, 11 of which have been with the Company (or its affiliates), and has passed examinations and received certifications as a SANS Global Information Security Leader and a Certified Information Systems Auditor. In addition to the CIO, the Company's information security team under the direction of the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Information security processes include escalation of certain risks and incidents to the CIO and the executive team, with monthly scorecard and quarterly dashboards also used to update the risk landscape.


text: Overall, the Company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of the Company's cyber risk management strategy and the controls designed to protect its operations. In addition, we maintain cyber insurance that is designed to protect us against certain losses related to cyber risks, and we believe the amount and scope of this insurance are customary for similarly situated companies in the telecommunications industry. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: Our various corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We utilize a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.

companyName: Postal Realty Trust, Inc.

ticker: PSTL


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the "Technology Committee") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms.


text: For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs. Depending on the nature and risk profile of the services provided and the sensitivity of information processed, we may from time to time conduct a review of the cybersecurity practices of such vendor, contractually imposing obligations on the vendor and conducting periodic reassessments during their engagement. We are currently not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or, to our knowledge, are reasonably likely to materially affect our business, financial condition and results of operations. See to Item 1A. "Risk Factors" in this annual report on Form 10-K, including "We face cybersecurity risks and risks associated with security breaches", for additional discussion about cybersecurity-related risks.


text: Our Board of Directors oversees our strategy and risk management, including material cybersecurity risks. The Audit Committee of the Board of Directors (the "Audit Committee") oversees our cybersecurity and information technology risk exposures, as well as our cybersecurity and information technology policies and programs, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from, and also engages in regular discussions with, management and also our MSP regarding our significant cybersecurity risk exposures and the measures implemented to monitor and control these risks. Our Technology Committee also meets at least quarterly to assess cybersecurity risks and prepares reports to the Audit Committee. A number of members of our Technology Committee have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, over their careers at the Company or other organizations.


text: Management is responsible for hiring and overseeing third-party vendors related to cybersecurity and integrating cybersecurity risk considerations into our overall risk management strategy. Our internal cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances and reporting to the Audit Committee for certain cybersecurity incidents, which also allows decisions regarding the public disclosure and reporting of such incidents to be made by management, the Audit Committee and the Board in a timely manner.


text: The Company is subject to cyber-attacks and information theft risks in our operations, which we seek to manage through cyber and information security programs, training, and insurance coverage. To strengthen our security and cyber defenses, we maintain a defensive approach to cyber and information security designed to defend our systems against misuse, intrusions, and cyberattacks and to protect the data we collect. The Company's processes to assess, identify and manage material risks from cybersecurity threats are strategically integrated into the Company's overall risk management framework, as evidenced by annual risk assessments and required trainings across business lines and applications. The Company's information security program maintains procedures and controls for the systems, applications, and data of the Company and of its third-party providers. The Company has an established cybersecurity training program which is administered through online learning modules and is required for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential information and asset security, among others, and educate employees on mechanisms in place to report cyber-related incidents or suspicions of cybersecurity threats. Further, the Company maintains a cybersecurity incident response plan, which is managed by the Company's chief information security officer and is reviewed and tested annually. The incident response process is overseen by a security operations and cybersecurity incident response team comprised of members across the organization, including global management and IT operations and leverages an organizational-wide self-service platform that allows the Company to track, manage and resolve information security risks across the organization.

companyName: CORPAY, INC.

ticker: CPAY


text: Our information security program is designed to generally align with recommended practices in security standards issued by ISO, AICPA (SSAE18), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and U.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.


text: Our newly acquired businesses maintain separate cybersecurity programs and processes that may differ in scope and complexity from the Company's overall cybersecurity programs and processes.


text: As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, "Item 1A. Risk Factors."


text: Use of Third-Parties To regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address cyber-related issues, the Company engages with information security and forensics firms with specialized industry knowledge. Our collaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and testing, and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties, regulators, and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized access to our processing systems.


text: In order to oversee and identify risks from cybersecurity threats associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.


text: The Board of Directors oversees the Company's information security and risk management program. To support effective governance in managing risks related to cybersecurity, the Board has established an information technology and security committee.


text: The information technology and security committee is responsible for providing oversight and leadership for our information technology security and cybersecurity, planning processes, policies and objectives. The information technology and security committee is composed of board members with both industry knowledge as well as expertise in technology and security, finance and risk management. The primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global information security and the evolution of our technology in a competitive environment.


text: To accomplish this purpose, the information technology and security committee has five primary responsibilities: • understanding the security controls and assessments conducted on our major payment platforms and comparing them to industry best practices; • evaluating strategies to protect our intellectual property; • assessing opportunities to update our processing platform strategies to ensure the long term use of our resources; • reviewing progress on significant IT security and cybersecurity projects and evaluating effectiveness of projects; and • overseeing our disaster recovery and business continuity plans.


text: The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity council at the Company, and receive regular cybersecurity reports from the global CIO, the corporate CIO and the chief information security officer (CISO), among others. These reports include updates on the Company's cybersecurity strategy and execution of its processes, including updates on procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cyber incidents. Such updates also include updates on the Company's continued compliance with regulatory requirements. The Company's information security and risk management program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.


text: Our CISO, who reports directly to the Company's Chief Information Officer ("CIO"), has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems Auditor.


text: Our CISO manages the Company's information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cyber threat detection and incident response. Our CISO promptly informs and updates the Board about any information security incidents that may pose a significant risk to the Company.


text: We have a thorough process for identifying, assessing, and managing cybersecurity risks within our broader risk management framework. We gather insights from external experts and internal threat intelligence teams for our cybersecurity risk management program. A dedicated team oversees cybersecurity risk management, led by professionals with deep expertise, including our Vice President, Cybersecurity and Information Security Officer. Our executive leadership, supported by our cybersecurity team, oversees our enterprise risk management and regularly considers cybersecurity and other material risks.

companyName: BIOLIFE SOLUTIONS INC

ticker: BLFS


text: Within our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company and third-party service providers. Significant incidents undergo review by a cross-functional group, with immediate escalation for potentially material incidents. We consult with outside counsel as needed, with final decisions made by senior management.


text: The Audit Committee oversees cybersecurity risks and incidents, ensuring compliance with disclosure requirements and cooperation with law enforcement. Senior management regularly updates the committee on cyber risks and any material incidents.


text: While our business strategy and financial condition have not been materially affected by cybersecurity risks, we cannot guarantee future immunity. For more details, refer to Item 1A Risk Factors in our Annual Report on Form 10-K.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical information technology and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer and employee data ("Information Systems and Data").

companyName: Sweetgreen, Inc.

ticker: SG


text: Our Chief Technology Officer ("CTO"), as well as the security operations, engineering, risk management and legal functions help identify, assess and manage the Company's cybersecurity threats and risks. Our security operations team monitors and identifies potentially material cybersecurity threats and risks, implements and maintains the Company's incident management policies and plans. Our security operations team leads our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, subscribing to reports and services that identify cybersecurity threats, monitoring incident notifications from stakeholders, conducting threat assessments, managing software vulnerabilities and patches, conducting tabletop incident response exercises, and, in connection with our legal function, coordinating with law enforcement concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; vulnerability management activities; encryption of data; network security controls; data access controls; penetration testing; cybersecurity insurance; and a dedicated security operations team.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provides an annual cybersecurity update to each of the board of directors and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as account management, payment processing, cloud-based infrastructure, data center hosting, and content delivery to customers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If the confidentiality, integrity, or availability of our information technology, software, services, communications, or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight, mitigation, and disclosure of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO and members of our legal and cybersecurity teams. Our CTO has more than three decades of experience working in technology for global companies in the technology, retail, and food services industries and has served in senior management at another public food service company.


text: Senior management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Senior management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity policies and processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Legal Officer, and Chief Financial Officer. The Chief Legal Officer works with the Company's cybersecurity incident response team to help the Company mitigate and remediate cybersecurity incidents of which he is notified. In addition, the Company's incident response process includes reporting material incidents to the audit committee of the board of directors.


text: The audit committee and the full board receive annual reports from senior management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to certain cybersecurity threats, risks, and mitigations.


text: The Fund depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Fund's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Fund. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Fund further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Fund's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Fund's use of such entities.

companyName: Nuveen Churchill Private Capital Income Fund


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Fund and the Advisers. This cyber risk management program is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Fund and other affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund and the Advisers in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Fund, the Advisers and their respective third-party service providers.


text: TIAA's cybersecurity team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Fund and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Oversight of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund is assessed on an ongoing basis, as well as how such risks could materially affect the Fund's business strategy, operational results, and financial condition. Cybersecurity risk remains heightened to the financial industry, including the Fund, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Fund's operations. TIAA and the Advisers continue to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers. The Fund has not experienced any material cybersecurity incident, and the Fund is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.


text: TIAA's cybersecurity team periodically reports to the Fund's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Fund, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Board receives periodic updates from the Fund's management regarding TIAA's cybersecurity program, information on current threat landscape and risks from cybersecurity threats and cybersecurity incidents impacting the Fund.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees and violation of data privacy or security laws.

companyName: Prime Medicine, Inc.

ticker: PRME


text: Oversight and Governance Our cybersecurity risk management program is a significant part of our overall risk management program, which has been delegated by our Board of Directors to the Audit Committee of the Board of Directors ("Audit Committee"). As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing, assessing, and considering, in consultation with management and the Board, as appropriate, the overall risk management policies and procedures of the Company, including our major risk exposures such as cybersecurity.


text: Members of our senior management, including our Chief Executive Officer, Chief Financial Officer, and leaders from our legal and information technology functions, maintain responsibility for assessing and managing cybersecurity threats. This team has deep expertise in building and leading information systems and cybersecurity teams across a variety of institutions.


text: Teams of internal and third-party cybersecurity professionals oversee cybersecurity risk management, which is based on the National Institute for Standards and Technology Cybersecurity Framework: • Identify – Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. • Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. • Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. • Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. • Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes that is centered on three key components: • Identification of risks: We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. • Assessment of threats: We assess organization vulnerabilities and the likelihood that the risk scenarios could occur, including risk assessments of our existing systems, penetration testing, and other vulnerability analyses. This assessment also extends to critical third parties, such as contract research organizations, prior to being approved to work with the company, and includes reviews of Service Organization Control Type 2 reports. • Execute: Internal and third-party experts coordinate implementation of necessary security controls to prevent or reduce the risk of security vulnerabilities from being exposed.


text: We also maintain an ongoing end-user cybersecurity awareness program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions, including quarterly training and simulated phishing campaigns.


text: The Audit Committee and Board of Directors receive routine updates from senior management, including leaders from our information technology and legal functions regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and mitigating those risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: We retain a chief information consultant and a third-party security management vendor to help identify, assess and manage our cybersecurity threats and risks. These partners identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example, automated tools, cybersecurity threat subscription services, threat report analysis, internal and external audits, and threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our security management partners work with our Chief Financial Officer to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity software providers and penetration testing firms. These third-parties also provide application and hosting services. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments and audits for each vendor and a review of each such vendor's written security program.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our information security consultant and third-party managed service provider. Our information security consultant has over 40 years of experience in pharmaceutical information technology, including many years as a chief information officer.


text: Our Chief Financial Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our information security partners, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer and legal department. Our Chief Financial Officer works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We operate in the medical device industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have initiated a risk-based approach designed to identify and assess the cybersecurity threats that could affect our business and information systems. Our strategy is to maintain a high level of risk awareness, identify critical IT assets, regularly update or replace those assets, and systematically perform vulnerability testing, and to promptly remediate deficiencies. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: NeuroMetrix, Inc.


text: We are adopting various tools and methodologies to manage cybersecurity risk that will be tested on a regular cadence. We are also in the process of monitoring and evaluating our cybersecurity posture and performance on an ongoing basis through scheduled vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.