text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The board of directors, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with management.

companyName: Passage BIO, Inc.

ticker: PASG

secItem: Item 1C


text: Our management team has implemented a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our enterprise risk management team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. Our Chief Financial Officer, Kathleen Borthwick, currently serves as our Chief Cybersecurity Officer and leads our cybersecurity risk assessment and management processes. Prior to being named CFO, Ms. Borthwick served as the Company's Senior Vice President, Finance, and interim CFO. She is supported by external Information Technology and third-party internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training, and risk management efforts.


text: No cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials and product, product candidates, and technology or our Information Systems and Data.

companyName: Y-mAbs Therapeutics, Inc.


text: We have a multi-stakeholder team to help identify, assess, and manage the Company's cybersecurity threats and risks, comprised of representatives from our third-party IT administrator, and from our Legal and Compliance, and Finance departments. This team, along with our third-party IT service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using automated monitoring tools, subscribing to analysis and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external review of certain data and systems, and having third parties conduct periodic assessments of our threat environment. We continue to invest in talent and infrastructure in our IT department to manage IT operations and mitigate cyber risk.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example maintaining an incident response policy and incident detection and response procedures, disaster recovery and business continuity plans and an IT contingency policy, encrypting certain data, conducting risk assessments for certain data and systems, implementing certain network security, physical and access controls, monitoring our systems, providing periodic training to employees and using tools such as penetration testing tools.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT and Legal and Compliance departments work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, our third-party IT service provider, cybersecurity consultants, outside legal counsel, software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, including hosting providers, CROs, and CMOs. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes, as appropriate, risk assessments of vendors, reviewing our vendors' information security program, reports, audits, and imposing relevant contractual obligations on our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the heading "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences"


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Senior Director of IT, and our Chief Financial Officer, and Treasurer, or the CFO.


text: Our Senior Director of IT is currently responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO has the overall IT and cybersecurity responsibility and is currently responsible for approving IT and cybersecurity related policies, processes, and procedures, approving related activities and budgets, helping prepare for cybersecurity incidents, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and our President and Chief Executive Officer, as appropriate and provides for our management team to work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: As part of its oversight of the Company's overall risk management, the audit committee is periodically updated by our CFO concerning cybersecurity threats and risks and the processes the Company has implemented to address them.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within our IT and risk management systems and addresses both the corporate and the operational IT environment.

companyName: W&T OFFSHORE INC

ticker: WTI


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology (the "NIST"), the Control Objectives for Information Technologies ("COBIT") framework and the International Organization Standardization 27001, Information Security Management System requirements. We have an annual assessment, performed by our internal audit department, of our cyber risk management program against the NIST and COBIT frameworks.


text: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. We have adopted a Cybersecurity Incident Response Plan that applies if a security event occurs. Our Incident Response Plan provides a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting, and responding to security events that are identified by or reported to the Chief Information Officer ( "CIO "). Our Incident Response Plan applies to our personnel including contractors and partners that perform functions or services that require securing our information assets, and to all devices and networks that we own. The Incident Response Plan details the coordinated, multi-functional approach for investigating, containing, and mitigating incidents. Under our Incident Response Plan, cybersecurity incidents are escalated based on a defined incident categorization to the CIO and the General Counsel. Regular updates are provided by the Cybersecurity team to the CIO, who will maintain communication and information flow to senior leadership including the General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders as well as the Audit Committee and/or the Board of Directors as appropriate. Generally, our incident response process follows the National Institute of Standards and Technology (NIST) framework and focuses on preparation; detection and analysis; containment, eradication, recovery and post-incident remediation.


text: Our CIO leads the information security organization which oversees the identification and management of information security risks. Our CIO has extensive information security and risk management experience in Information and Operational technology and holds the following information security certifications: Certified Information Systems Security Professional (CISSP); Certified Information Systems Auditor (CISA); and Certified Risk and Information Systems Control (CRISC).


text: Our CIO is a member of InfraGard, ISC2 and ISACA and serves as Adjunct Professor of Cyber Security at Lone Star College and San Jacinto College.


text: We conduct mandatory security training during new employee onboarding, as well as require our employees to complete annual security risk training and, when necessary, perform additional updated training. We also engage certain third-parties in assessing, identifying and managing cyber-security risks. These third parties perform a number of services, including managed detection and response services for information technology endpoints, anti-virus monitoring, penetration testing, and other miscellaneous cyber security programs and services. We maintain specific policies and practices governing our third-party security risks, including our third-party assessment process. Under our third-party assessment process, we gather information from certain third parties who contract with us and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.


text: The Audit Committee of our board of directors oversees our cybersecurity policies, procedures, risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Our executive management, including our Vice President and Chief Information Officer, periodically updates and reports to the Audit Committee and the board of directors regarding cybersecurity risk exposure and our cybersecurity risk management strategy (at a minimum, once per quarter). Additionally, all members of the board of directors attend quarterly training sessions through internal and external IT specialists, which include review of IT whitepapers, presentations, and other learning materials. Each of the members of the board of directors has also completed certificated training concerning IT security, IT fraud, and other common enterprise-level IT threats.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To our knowledge, such risks have not materially affected our operations nor have we experienced any cybersecurity incidences which have impacted our operations. In the past three years, we have not experienced a material information security breach. We will continue to face cybersecurity threats whether directly or through our supply chain or other channels in the normal course of business. See Risk Factors in Part I, Item 1A in this Form 10-K for additional information.


text: The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to management and relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company believes it is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

companyName: Vireo Growth Inc.

ticker: VREOF


text: Cybersecurity risk management is overseen by the Company's Vice President of Information Technology and Security who is supported by full-time information security staff. These individuals have experience across industries that, among other things, develops and distributes information security policies, standards and procedures; engages in employee cybersecurity training; implements security controls; assesses security risk and compliance posture; monitors and responds to security events; and executes security testing and assessments The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.


text: The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see " Item 1A. Risk Factors — We face risks related to our information technology systems, including potential cyber-attacks and security and privacy breaches ".


text: The Board and executive team provide regular oversight of the Company's cybersecurity risk management program. The Vice President of Information Technology and Security presents to the Board and the executive team regularly with updates via business review dashboards. The Board and executive team provide guidance, including with respect to any changes to business priorities, risk tolerance, or security initiatives.


text: Cybersecurity and privacy incidents in the pharmaceutical industry are growing in frequency and severity, prompting organizations to invest heavily in people, processes, and technology to bolster their cybersecurity risk management capabilities.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We assess the integrity of our information technology and cybersecurity platforms to help ensure proper safety measures are implemented. We understand the extensive responsibility associated with safeguarding our systems and data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include:


text: We utilize various securities tools and technologies designed to prevent, identify, protect, detect, escalate, respond and recover from cyber threats in a timely manner. Our approach includes real-time monitoring, threat analysis, and regular security evaluations to identify and mitigate potential vulnerabilities.


text: User Training & Education: We realize that human error can be a significant cybersecurity risk, so we have implemented education and training programs for our staff to raise awareness about cybersecurity best practices. By promoting a culture of security consciousness, we empower our staff to identify potential threats and respond effectively, in a way that is designed to enhance the overall cybersecurity posture of our organization.


text: Incidence Response and Business Continuity: We have comprehensive Incidence Response and Business Continuity plans in place designed to ensure the continuity, availability and accessibility of our systems and data, even in the face of unforeseen events such as natural disasters or cyber incidents, which plans and systems we test regularly.


text: We rely upon the capacity, availability and security of our information technology hardware and software infrastructure. We maintain comprehensive compliance and security programs designed to help safeguard and ensure the integrity of the confidential information we possess, which includes both organization and technical control measures. We routinely conduct employee trainings on important information security procedures and test and measure compliance with these security measures. In addition, we maintain cyber insurance policies that mitigate the financial risk of any potential incident.


text: We engage consultants, auditors, and other third parties in connection with such processes. We work with third-party service providers to assist us in our cybersecurity risk management to identify areas that may potentially impact our business, develop and implement control framework to mitigate such cybersecurity risks, and to be prepared to respond to and report (as required) applicable cybersecurity incidents.


text: We face a number of risks including the growing threat of cybersecurity attacks. Despite our implementation of security measures to combat the threats of cybersecurity attacks, any system failure, accident or security breach could result in disruptions to our operations. To the extent that any disruption, cybersecurity attack or other security breach results in a loss or damage to our data or inappropriate disclosure of confidential information, our business could be harmed. In addition, we may be required to incur significant costs to protect against damaged caused by these disruptions or security breaches in the future.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced cybersecurity incidents that have materially affected us, our business strategy, our results of operations or our financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding risks from cybersecurity threats, please refer to "Item 1A. Risk Factors" of this annual report on Form 10-K.


text: Our Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management. This committee periodically reviews and assesses the risk exposure of our risks related to data privacy, technology and information security, including cyber-security, and back-up of information systems and makes recommendations to our Board of Director pertaining to monitoring and minimizing findings in such assessment. This committee periodically reports to the Board of Directors.


text: While the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management, our management also plays an integral role in cybersecurity oversight. Our management is responsible for day-to-day risk management processes. This includes periodic updates from the Executive Director of Information Technology who has over 24 years of work experience in the life science industry, and holds an undergraduate degree in Industrial Technology. The Executive Director of Information Technology is responsible for managing the daily measures of safeguarding the information technology infrastructure from potential threats and vulnerabilities, which includes monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, we have established a Crisis Management Team (CMT), which is a team of cross-functional participants who are prepared to review and assess any potential cybersecurity incidents. The CMT team is led by our CFO and our General Counsel who will advise the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee of the Board accordingly in the event of any incident. We believe this division of responsibilities is the most effective approach for addressing our cybersecurity risks and that the Board leadership structure supports this approach.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy, Written Information Security Policy and Incident Response Plan with Stellus Capital Management (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy also sets forth the role of our Chief Compliance Officer and our Information Security Team in preparing, implementing, and maintaining incident response procedures.

companyName: Stellus Capital Investment Corp

ticker: SCM


text: Our Chief Compliance Officer and Information Security Team are responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. At times we may also engage assessors, consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of Stellus Capital Management who provide services to us pursuant to the Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors," in this Annual Report on Form 10-K under the heading " We, Stellus Capital Management and our portfolio companies are subject to risks associated with "phishing" and other cyber-attacks. "


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Team as needed, but no less frequently than annually. On at least a quarterly basis, the Information Security Team reports to our Board on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and Information Security Team's evaluation of cybersecurity risks that are material to us.


text: We employ risk management, mitigation and prevention strategies based on frameworks provided by the National Institute of Standards and Technology ("NIST") regulation standards, third party cyber service providers, and common industry practices. These frameworks are applied across all network, hardware, software and communication platforms whether the platform is self-hosted or provided as a service. We leverage a Risk Assessment Score ("RAS") based on these standards against any internal networks, platforms, technologies or initiatives as well as any perimeter or connected partner, vendor or third-party service.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Our cyber posture, policies and in-production procedures are designed and developed to manage and minimize risk, threat, or loss to business processing, business objectives and business assets as well as protecting the integrity, confidentiality and personal identifying information ("PII") of our employees and partners.


text: Our security team is intentionally comprised of internal personnel with a range of technical, legal and management disciplines as well as external, third-party cyber service providers, auditors and technical consultants. This allows for broader monitoring, objective reporting, controlled policy, decreased recovery time objectives and quicker incident response.


text: We maintain cybersecurity risk insurance, conduct threat scenario exercises, provide end user cyber awareness and security training, perform regular vulnerability audits and formally report the relevant results, statuses or assessments to our senior management team or other identified key stakeholders.


text: Cybersecurity operations generally fall under the discretion of the IT Director, who has 20 years of experience and is a Certified Secure Infrastructure Specialist (CSIS - Comptia) and IT Operations Specialist (CIOS - Comptia). Our IT Director regularly communicates with and provides relevant cyber reporting, analysis, statistics and statuses to the Chief Financial Officer, who also has a background in IT and is a Certified Information Systems Auditor.


text: Our Cyber Incident Response Plan employs an operational incident-handling capability that includes preparation, detection, analysis, containment, eradication, recovery, and communication procedures.


text: Our cyber policies are based on the National Institute of Standards and Technology 800-171 and CMMC Level 2 framework, requiring formal written policies, procedures, plans of action, general security plans and regular audits. In addition, Southland carries Privacy, Security and Technology Insurance covering incidents and responses related to business interruption, data recovery, data breach, extortion and ransomware, and crisis management.


text: The Company's cybersecurity program, identified events, current and future strategies are presented to the Audit Committee for periodic review. The Audit Committee may choose to present relevant information to our board of directors (the "Board") as deemed necessary.


text: See "Systems and information technology interruption and breaches in data security and/or privacy could adversely impact our ability to operate and negatively impact our results of operations" in "Item 1A. Risk Factors."


text: We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Our cybersecurity program is led by our director of information technology (IT), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our director of IT has extensive information technology and program management experience and leads a team that has many years of experience with our organization. Our director of IT reports to our vice president in charge of coordinating operational activities within our business segments. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our director of IT and senior executives including our chief executive officer, chief financial officer and general counsel, and our executive vice president who is also the Contran chief information officer. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT team is responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief executive officer and chief financial officer, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- Risk Factors.


text: Allient has processes in place to assess, identify, and manage material risks from cybersecurity threats. We regularly undertake audits and evaluations (including to the National Institute of Standards and Technology (NIST) SP 800-171 standards) and enhance our security framework based upon the results of those audits and evaluations. For new associates, and on an annual basis thereafter, we require associates to take security awareness training and conduct on-going phishing recognition training and testing programs.

companyName: ALLIENT INC

ticker: ALNT


text: We have integrated cybersecurity risk management into our enterprise risk management program, and our management, lead by our Global Information Technology Director, regularly review cybersecurity risks. We rely extensively on information technology ("IT") systems for the storage, processing, and transmission of our electronic, business-related information assets used in, or necessary, to conduct business. We leverage our internal information technology infrastructures, and those of our business partners, to enable, sustain, and support our global business activities. In addition, we rely on networks and services, including internet sites, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors, to assist in conducting our business.


text: Numerous and evolving cybersecurity threats pose potential risks to the security of our IT systems, networks and services, as well as the confidentiality, availability and integrity of our technology systems and data. In addition, the laws and regulations governing security of data on IT systems is evolving and adding another layer of complexity in the form of new requirements.


text: Over the last three years, we have experienced no known information security breaches. However, as cybersecurity incidents continue to increase in scope, complexity, and frequency, we may be unable to prevent a significant incident in the future which may materially impact our results of operations.


text: Our cybersecurity program engages third parties when necessary. In the past, we have had cybersecurity incidents and we have made, and continue to make investments, seeking to address these threats, including monitoring of networks and systems, hiring of experts to evaluate and test our systems, employee training and security policies for employees and third-party providers. All third parties that we use have been vetted and have deep experience and strong reputations in the industry. As such, controls from the third-party vendors have been deemed to be adequate prior to any goods or services having been provided.


text: Management is responsible for the development of all cybersecurity programs, including the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Board receives quarterly reports regarding the overall cybersecurity risk management process. The Board and Audit Committee are responsible for information security oversight. Two members of the Company's Board have relevant information security and cybersecurity experience. As part of their oversight, senior leadership meets with the Audit Committee at least annually to discuss information security and cybersecurity matters.


text: For additional information regarding risks related to information technology and cybersecurity, as well as governance related to managing such risks - see also Item 1.A: Risk Factors.


text: Our cybersecurity strategy prioritizes prevention, detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our produced products and related services. We have adopted security-control principles primarily based on the National Institute of Standards and Technology Cybersecurity Framework (NIST). We also leverage industry and government associations, third-party benchmarking, internal and external Company audit results, threat intelligence feeds, and other similar resources to form our cybersecurity processes and allocate resources.

companyName: Amplify Energy Corp.

ticker: AMPY


text: We maintain an information security program that includes physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, while timely and effectively responding to, cybersecurity threats or incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. Through our cybersecurity risk management process, which is overseen by the Amplify Information Technology Steering Committee (the "Steering Committee"), we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats. This process has been integrated into the Company's Risk Management Program, and we have integrated Cyber Incident Response planning into our Business Continuity Program. In addition, we routinely engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. We provide monthly cybersecurity awareness and weekly phishing simulations, data protection modules, tabletop exercises, as well as more contextual and personalized modules for targeted users and roles.


text: Our Steering Committee was established to further strengthen our cybersecurity risk management activities across the Company, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The Steering Committee has primary management oversight responsibility for assessing and managing risks from cybersecurity threats and is responsible for developing and coordinating enterprise cybersecurity policies and strategies and for providing guidance to key management and oversight bodies. Our Vice President of Information Technology, who has nearly two decades of information technology and cybersecurity risk management experience in the oil and natural gas industry, serves as the chair of the Steering Committee. The Steering Committee includes senior executives and managers, with significant risk management expertise, from multiple areas of the business. The Steering Committee meets quarterly and reports to senior management regarding the progress of specific cybersecurity objectives. Cross-enterprise action teams will be formed, as needed, to manage and implement key decisions of the Steering Committee. A strong partnership exists between our information technology, finance, operations, internal audit, and legal departments for the purpose of addressing identified issues in a timely manner and reporting incidents as required.


text: The Nominating & Governance Committee, which is comprised entirely of independent directors, has primary responsibility for oversight of the Company's initiatives, policies and performance regarding risk management matters, including information security, cybersecurity, business continuity and data protection and privacy. Committee members have extensive experience working for and/or serving on the boards of directors of publicly traded companies and are experienced in overseeing cybersecurity and information security risks, understanding the cybersecurity threat landscape and/or assessing emerging cybersecurity risks. The Nominating & Governance Committee generally meets at least quarterly and as frequently as circumstances dictate. Members of senior management, representing a variety of teams and functions including information technology, operations, finance and legal, routinely provide updates regarding assessments of cyber risks, the threat landscape, and the Company's cybersecurity risk mitigation and governance strategies. The Nominating & Governance Committee and members of senior management brief the entire board, as necessary, on cybersecurity matters discussed during committee meetings.


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face certain ongoing risks from cybersecurity threats, that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations, and/or financial condition. For more information about these risks, see the risk factor titled, "Our business could be negatively affected by security threats, including cybersecurity threats, destructive forms of protest and opposition by activists and other disruptions" under Item 1A of Part I of this Annual Report.


text: We proactively address cybersecurity risk through a comprehensive cybersecurity program to identify, protect, detect, respond to, and manage any reasonably foreseeable cybersecurity risks and threats. We use a multi-faceted approach including, but not limited to, third-party assessments, internal cybersecurity audits, IT security, governance, risk, and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things, require mandatory third-party cybersecurity training and testing for all employees, perform periodic user access reviews across the organization, perform penetration testing using external third-party tools and techniques to test security controls, employ multifactor authentication and biometrics login tools, take steps to verify whether vendors have appropriate cybersecurity programs, and conduct frequent security assessments to identify and remedy vulnerabilities.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: We also employ the use of Secure Socket Layer inspection on our firewalls, which are able to decrypt and scan all network traffic entering and leaving our facilities. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards, including regularly reviewing and updating our incident response plan. These partnerships enable us to leverage specialized knowledge and insights, seeking to continue to improve upon our cybersecurity strategies and processes.


text: Based upon the information that we have as of the end of the year covered by this report, we do not believe that we have experienced any material cybersecurity incidents to date. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken, and continue to take, to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurance that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially affect us. As described in Item 1A – "Risk Factors", any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks, or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.


text: Our Board understands the critical nature of managing risks associated with cybersecurity threats. Accordingly, our Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and in maintaining shareholder confidence. The Audit Committee has been made primarily responsible for the Board's oversight of cybersecurity risks. However, the entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address these issues. Our Chief Information Officer is responsible for overseeing cybersecurity and reports to the Audit Committee, as well as the Board at all its regular quarterly meetings regarding matters of cybersecurity. These reports include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), updating the status on defensive security measures and risk assessment, and key information security initiatives. Our Audit Committee and our other Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our Chief Information Officer has been with the Company for more than 25 years, developing and overseeing our information systems and cybersecurity risk management program. Our Chief Information Officer and his team, which includes a cybersecurity professional, are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board and Audit Committee on any appropriate items.


text: Cybersecurity risk management is an important and continuously evolving focus for the Company. Resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology assets. The Company's security efforts are designed and tested to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems or cause other damage. The Company has implemented precautionary measures and controls reasonably designed to address this increased risk, such as enhanced threat monitoring. The Company continues to make investments and partner with qualified third parties to enhance its cyber defense capabilities to monitor the evolving spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency against cybersecurity threats. The Company actively participates in discussions and simulations of cybersecurity risks and has engaged in efforts to educate all employees on the topic of cybersecurity risks.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: The Company acknowledges that third parties and clients may also be sources of cybersecurity risk for the Company. As a result, the Company engages in regular and ongoing reviews and discussions with vendors and clients regarding cybersecurity risks and opportunities to improve the Company's cybersecurity posture. The Company maintains a vendor risk management program to identify and help manage any third party cybersecurity risks.


text: Additionally, the Company maintains an Information Security Program designed to prevent, detect, and respond to cyberattacks, and maintains a cybersecurity incident response plan designed to enable the Company to respond to cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify clients and customers, as applicable. The Company's risk and technology teams, led by the Company's Chief Risk Officer ("CRO") and Chief Technology Officer ("CTO"), respectively, are responsible for leading the incident response team, identifying technology and cybersecurity risks, utilizing management's expertise in assessing the materiality of cybersecurity events, and are responsible for the controls to manage threats. The Company's risk team in conjunction with the broader incident response team conduct periodic tabletop exercises and business continuity simulations to train and align on best practices and assessment of potential cyber events. Management utilizes the incident response plan and incident response team to assesses materiality of any cyber event through a qualitative and quantitative assessment. The information security program and overall cybersecurity risk management processes are aligned and integrated into the Company's overall risk profile and appetite through the Company's Enterprise Risk Management Committee.


text: The Company's governance structure is designed to identify, escalate, and mitigate information security risks. Management utilizes its Enterprise Risk Management Committee and IT Steering Committee, comprised of senior leaders including the Company's CRO, CTO, Chief Financial Officer, and other leaders with cybersecurity expertise, to disseminate information and monitor information security efforts throughout the Company. Each committee's charter, in addition to the Information Security Policy, establishes roles and responsibilities related the Company's cybersecurity governance and program. The risk team provides oversight of the Company's activities designed to identify, assess, measure, and mitigate cybersecurity risk. The Company's Information Security Program includes training that reinforces the Company's Information Security Program policies, standards, and practices, as well as the expectation employees comply with these policies. The technology team engages employees through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees, and is supplemented by various testing initiatives, including social engineering testing. Finally, the Company provides specialized security training for certain employee roles such as system administrators and all information security training is monitored and reported on by the risk team as well as the Company's learning and development function.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks faced by the Company. In addition, our board of directors, as a whole and through its Audit Committee, is responsible for the oversight of cybersecurity risks. In that role, the board of directors and Audit Committee are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, the board of directors and Audit Committee receive periodic updates on the Company's Information Security Program, cybersecurity policies and practices, ongoing efforts to improve security, as well as the Company's efforts to prevent, detect, mitigate, and remediate significant cybersecurity incidents.


text: Risks from cybersecurity threats, including any previous cybersecurity events, did not materially affect the Company or its business strategy, results of operations or financial condition during the period covered by the report. Notwithstanding the comprehensive approach that the Company takes to address cybersecurity risk, the Company may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.


text: Our business operations rely on the secure collection, storage, transmission, and other processing of confidential and sensitive data through our information systems. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements concerning the treatment of such data. To ensure the security, confidentiality, integrity, and availability of our information systems, we have implemented a comprehensive cybersecurity risk management program (the "Information Security Program"). The program is designed to identify, assess, manage, and mitigate risks and secure Company and customer information against threats. This is achieved through monitoring, threat management strategies, policies and procedures, security awareness, oversight, and governance.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: The Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO") provide direct oversight and management of the cybersecurity risk management program. The CISO and the Information Security team assess and manage the day-to-day cybersecurity and threat management programs. Our CISO has more than 20 years of relevant experience in leading and building risk management and cybersecurity programs. Our CISO maintains the following credentials: Certified Information Systems Auditor and Certification in Risk Management Assurance. The CRO and CISO report periodically on important updates related to the Information Security Program and threat landscape to the Board of Directors and its designated committee with responsibility for oversight of risk management.


text: There are also several Management committees that are responsible for oversight of the Information Security Program. These include: • Information Security Committee; and • Risk Management Committee.


text: The Information Security Committee ("ISC") is chaired by the CISO and is responsible for overseeing cybersecurity risk, including information security policies and procedures, information security audits, social engineering testing, vulnerability management, penetration testing, information security projects, business continuity, incident response planning, and current threats and security advisories related to the bank's information systems and data assets. The ISC members include the CRO, Chief Information Officer, and General Counsel, with broader attendance from representatives of Risk Management, Technology, Operations, Internal Audit, and Retail. The ISC, in turn, provides a summary update and points of escalation to the Risk Management Committee ("RMC"), who is chaired by the CRO.


text: The RMC serves as the primary Management committee in fulfilling enterprise risk management oversight responsibilities, including cybersecurity risk. The RMC provides quarterly updates to the Audit Committee.


text: The Board of Directors holds oversight responsibility over the Company's risk management program, including material risks related to cybersecurity threats. This oversight may be executed directly by the Board of Directors or through its committees. The Board of Directors has delegated oversight of Risk Management to the Audit Committee of the Board of Directors. The Audit Committee engages in regular discussions with Management regarding the Company's risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include evaluating current trends, internal risk assessments, and risk management policies. Annually, a comprehensive report on the state of the Information Security Program, including cybersecurity risk management, is provided to the Board of Directors by the CRO and CISO. This report includes: Risk assessment results; Third- and fourth-party vendor oversight; Results of security monitoring and testing; Security incidents or violations (if applicable); Internal and external audit results.


text: The Information Security Program employs various information security controls, tools, and strategies to combat threats and to ensure the Company's information and systems remain secure. The Information Security Program contains specific provisions for identifying, assessing, and mitigating cyber threats, including but not limited to ransomware attacks, denial of service attacks, phishing and social engineering, data breaches, credential theft, and vulnerability exploitation.


text: Due to the dynamic nature of risks, threats, vulnerabilities, and the information systems themselves, all information systems that store, process, or transmit sensitive and confidential information are protected by comprehensive defense-in-depth strategies that include strong authentication techniques, firewalls, intrusion detection systems, end point protection, physical security measures, encryption and security awareness training.


text: The Information Security Program is periodically reviewed to ensure that internal controls are designed appropriately and operating as expected. The Information Security Program is reviewed and approved by the Board of Directors annually. Periodic audits are performed by internal and external auditors to confirm adherence to the security program and regulatory guidelines and requirements. The Information Security team performs an annual assessment of cybersecurity risk and maturity using the FFIEC Cybersecurity Assessment Tool and reports the results to the Board of Directors as part of the annual report.


text: The Information Security Program complies with all applicable regulations, including Section 501(b) of the Gramm–Leach–Bliley Act and Section 216 of the Fair and Accurate Credit Transactions Act of 2003. The Information Security Program aligns with National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security (benchmarks for device hardening).


text: The Information Security team is responsible for monitoring and identifying all vulnerabilities and suspected threats and implementing corrective actions, if required. The Information Security team conducts risk assessments on the technology stack, determines effectiveness of internal controls, and develops remediation plans. The Information Security team utilizes specialized service providers to perform continuous monitoring, alerting and containment of potential threats, and penetration testing. The Information Security team maintains a Vendor Management Program and performs ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies, if applicable.


text: While we have not experienced any data breaches during the year, our online banking platform was targeted in the beginning of the year by threat actors who created malicious look-alike phishing sites. The Bank did not suffer losses as a result of these attempted attacks and due to efforts made to improve our security posture, the attack efforts have significantly subsided and remained at a stable low-level for the remainder year. We continue to monitor and look for ways to enhance security, safeguard customer data, ensure the continuity of our operations, and mitigate any risks associated with potential cybersecurity events.


text: The Information Security team maintains a Third-Party Risk Vendor Management Program that requires all third-party vendors with access to our systems or sensitive information comply with applicable cybersecurity standards and regulations. Ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies are performed, if applicable.


text: While extensive cybersecurity controls and procedures are in place, the risk of experiencing an incident can never be eliminated completely. We maintain and regularly review and update an Incident Response Plan that outlines procedures for identifying, containing, and mitigating any cyber event that may affect our systems, data, or operations and includes potential credit monitoring services, customer and regulatory notification guidelines and templates. This plan is regularly tested and updated. The plan is designed to address adverse events that could impact the security of information, that affect our ability to conduct secure financial transactions, or that present reputational risk. We have retainers in place with privacy counsel and forensic incident response firms.


text: We maintain cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents, such as data breaches and system disruptions. However, such insurance may not cover all types of damages, and we cannot guarantee that our coverage will be sufficient to fully protect us from the financial consequences of a cyberattack.


text: The Company is committed to maintaining a strong cybersecurity posture devoting significant resources to cybersecurity and risk management processes to adapt to the rapidly evolving landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company has designed and implemented cybersecurity policies and procedures for identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular basis. At the tactical level, our information technology (IT) security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The Company monitors and evaluates our cybersecurity position and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Additionally, the Company maintains a formal information security training program for all employees that includes training on matters such as phishing, email security best practices and data privacy. To evaluate and enhance our cybersecurity program, it is regularly evaluated by external experts with the results of those reviews reported to senior management and the Audit Committee of our Board of Directors (Audit Committee). We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: Oversight of cybersecurity risk is maintained by the Company's Board of Directors and is supported by the Audit Committee. The Audit Committee is primarily responsible for overseeing our design, execution and administration of the Company's enterprise risk management process, and with regard to cybersecurity risks, setting expectations and accountability for management and reviewing management's assessment of the effectiveness of our cybersecurity controls, including policies and procedures to address our cyber risks and overseeing the Company's cybersecurity disclosures. The Company's information security program is managed by the Company's Chief Information Officer ( CIO), whom reports to the Chief Financial Officer (CFO), and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CIO periodically briefs the Audit Committee and our CFO, as well as our Chief Executive Officer (CEO), other members of the Board of Directors and other members of our senior management as appropriate. These reports include, but are not limited to, new developments, evolving standards, vulnerability assessments, third-party and independent reviews, threat environment summaries and technological trends. In the event of a potentially material cybersecurity incident, the CIO will meet with the Company's Audit Committee, CEO, CFO, legal counsel and any other members of senior management as appropriate to review the cybersecurity event, perform a materiality analysis and, if appropriate, identify any information required to be disclosed in a Current Report on Form 8-K.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on the Company will not occur in the future. In response to the rapidly evolving cyber threat environment, the Company continues to invest in data security and system resiliency. See also Item 1A, "Risk Factors" for additional discussion regarding risks related to information technology systems.


text: The Company employs a multi-layered approach in an effort to assess, identify and manage risks from cybersecurity threats:

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Risk Assessment: On a regular basis, the Company conducts assessments to identify potential cybersecurity threats and vulnerabilities within its systems and networks. This includes evaluating the impact of potential breaches and the likelihood of occurrence.


text: Security Measures: The Company has implemented various security measures like firewalls, encryption, intrusion detections systems, and access controls to mitigate potential risks. Further, the Company also regularly updates software and security protocols to stay ahead of any emerging threats.


text: Employee Training: The Company provides associates with cybersecurity training and awareness programs. These initiatives are intended to help employees recognize and respond appropriately to potential threats like phishing attempts, or social engineering and account takeover. This includes conducting tabletop exercises, fostering preparedness and effective response within the Company.


text: Incident Response Plan: The Company has established an incident response plan in an effort to address and contain any breaches or cybersecurity incidents. This plan includes defining roles, responsibilities, and steps to recover from a potential attack.


text: Regular Audits and Monitoring: The Company conducts periodic audits and continuous monitoring of systems intended to detect any anomalies or potential security breaches. This involves using advanced tools to monitor network traffic and behavior for suspicious activities.


text: The Company has implemented policies and procedures related to disclosing its cybersecurity risks and management strategies in its annual report, SEC filings, or other regulatory filings providing investors with an understanding of the potential impact on the Company's operations and financials.


text: This multi-layered approach has been integrated into the Company's overall risk management system and processes. Integrating cybersecurity risk management into the overall risk management system demonstrates the Company's commitment to addressing threats that could significantly impact its operations, financial stability, and reputation. This integration is intended to provide a holistic approach to risk management and helps in creating a more resilient organization against cybersecurity threats.


text: The Company, as an integral aspect of its regular operations and risk management processes, engages third-party entities and service organizations. The Company evaluates and selects these external partners through its due diligence process. This scrutiny is intended to provide alignment with the Company's standards for security, reliability, and compliance. Additionally, the Company engages third-party firms to augment the Company's cybersecurity defenses, leveraging external expertise to mitigate and prevent potential threats. Furthermore, the Company maintains ongoing oversight and monitoring of these third parties in an effort to mitigate potential risks and provide continued adherence to established protocols in order to foster an ecosystem of trusted collaborations within its operational framework.


text: During the periods covered by this report, there were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "The Company's operations, including third-party and client interactions, are increasingly done via electronic means, and this has increased the risks related to cybersecurity threats," which are incorporated by reference into this Item 1C.


text: The Company's Board of Directors (the "Board") plays a pivotal role in overseeing risks arising from cybersecurity threats within the Company. The Board exercises oversight by adopting a Written Information Security Program, engaging in discussions, reviewing reports, and seeking updates on the Company's cybersecurity posture. The Board's Risk Committee oversees and monitors the Bank's enterprise risk management practices. The Risk Committee assists the Company's Board of Directors with monitoring the Company's information technology and cybersecurity plans and policies, in addition to compliance with information security and technology risk management requirements, including reporting related to the SEC's cybersecurity disclosure rules.


text: The Board is kept informed about cybersecurity issues through a structured and responsive communication process tailored to its needs. This involves updates provided by the Chief Information Security Officer ("CISO") or other members of management during Board and Risk Committee meetings. Additionally, management reports to the Board on significant cyber incidents, emerging threats, and the effectiveness of existing security measures. The communication framework is intended to keep the board informed about cybersecurity matters, allowing them to make informed decisions and provide strategic guidance to fortify the Company's defenses against potential threats.


text: The Company employs a software platform designed for tracking, monitoring, and managing cybersecurity threats across its systems and networks. The platform serves as a centralized hub that aggregates data from various sources, allowing the cybersecurity team, led by the CISO, to take action to mitigate risks. This technological tool serves as a key component in the Company's cybersecurity arsenal, enhancing its ability to monitor, analyze, and respond to evolving cyber threats.


text: In cases where cybersecurity threats are deemed significant or pose a potential risk to the Company's operations, they are escalated to members of management who oversee cybersecurity matters. Depending on the nature and criticality of the threat, it may be escalated to executives such as the CISO, Chief Information Officer, Chief Risk Officer, Chief Financial Officer, General Counsel, or other relevant senior management personnel. These leaders possess the expertise and authority to assess the situation's impact on the Company's operations, finances, and reputation. Further, these leaders have over 15 years of experience each in their respective fields of expertise. Upon receiving this information, they engage in deliberation and decision-making, collaborating with the cybersecurity team to formulate and execute an appropriate response plan, which may include elevating the matter to the Risk Committee, or the Board, if warranted. This hierarchical escalation process is intended to ensure that key decision-makers are properly informed, enabling appropriate actions to mitigate the identified cybersecurity risks.


text: Cybersecurity risk is the risk of exposure to harm or loss resulting from misuse or abuse of technology by malicious actors. Cybersecurity risk is an important and continuously evolving focus for us as significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology assets. Security efforts are designed to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have experienced, and expect that we will continue to experience, a higher volume and complexity of cyber-attacks. We have implemented precautionary measures and controls reasonably designed that follow the National Institute of Standards and Technology (NIST) and other industry standards to address this increased risk.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our strategic objectives, business environment and operational needs.


text: Engage Third-parties on Risk Management Ongoing business expansions may expose us to potential new threats as well as expanded regulatory scrutiny including the introduction of new cybersecurity requirements. We continue to make significant investments in enhancing our cyber defense-in-depth capabilities and to strengthen our partnerships with the appropriate government and law enforcement agencies and other businesses in order to understand the full spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency against cybersecurity threats. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversee Third-party Risk Third parties with which the Company does business or that facilitate the organization's business activities (e.g., vendors, supply chain, exchanges, clearing houses, etc.) are also sources of cybersecurity risk. Third-party cybersecurity incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises, could affect their ability to deliver a product or service or result in lost or compromised information. Because we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Monitoring includes quarterly assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Our Information Technology Steering Committee ("ITSC") is central to the Board's oversight of cybersecurity risks, which are incorporated into our overall risk management program overseen by our Board Risk Committee. These Committees meet no less than quarterly and are composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. While, as of the date of this Annual Report on Form 10-K, we have not encountered cybersecurity challenges that have materially impaired our operations or financial standing, our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future.


text: Management's Role Managing Risk While the ITSC and our Board of Directors to which it reports oversees cybersecurity risk management, management is responsible for the day-to-day cybersecurity risk management processes. The Chief Risk Officer ("CRO") and the CISO play a pivotal role in informing the ITSC and Board Risk Committee on cybersecurity risks. Comprehensive briefings are presented to the ITSC and Board Risk Committee on a regular basis, with a minimum frequency of quarterly. These briefings encompass a broad range of topics, including: Maturity of our cyber landscape commensurate to inherent risks of environment;


text: Emerging threats Status of ongoing cybersecurity initiatives and strategies Incident reports and learnings from any cybersecurity events Compliance with regulatory requirements and industry standards; and Results of internal and external testing of cybersecurity controls. In addition to our scheduled meetings, CISO maintains an ongoing dialogue with management and the Board of Directors regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The CISO actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The CISO conducts a quarterly review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity and operational risk, he brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO and holds several certifications including ISACA's, CISM and CRISC and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity training program.


text: The CISO is responsible for identifying technology and cybersecurity risks and is responsible for the controls to manage threats. To help safeguard the confidentiality, integrity and availability of our infrastructure, resources and information, we maintain an Information Security Program designed to prevent, detect, and respond to cyberattacks. The ITSC and Board of Directors is periodically provided with updates on the Information Security Program, recommended changes, cybersecurity policies and practices, ongoing efforts to improve security, as well as our efforts regarding significant cybersecurity events.


text: The CISO manages the Security Operations Center (SOC) and is responsible for implementing and maintaining controls designed to detect and defend us against cyber-attacks and includes a dedicated function for incident response and ongoing monitoring for cybersecurity threats and vulnerabilities, including those among the Bank's third-party suppliers. The CISO conducts a quarterly review of our inherent risk posture against the effectiveness of our cyber risk management strategies. This review helps in measuring the effectiveness of controls and identifying areas for improvement ensuring cyber controls is commensurate with our inherent risk profile and the Board's risk appetite.


text: Monitoring Cybersecurity Incidents The CISO continually monitors for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We deploy defense-in-depth safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments as well as ongoing acquisition of knowledge crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and prevent escalation of any loss or damage from the cybersecurity incident. The Incident Response Plan is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response teams (i) include subject matter experts to address cyber threats and (ii) includes representatives from the accounting team to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs the ITSC and Board Risk Committee of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we face. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: For additional information regarding the risk we face from cybersecurity threats, please see the risk factor titled "Our information systems may experience an interruption or breach in security and cyber-attacks, all of which could have a material adverse effect on our business." included in Part I. Item 1A. - Risk Factors of this report.


text: We recognize the critical importance of safeguarding our information systems and data against evolving cybersecurity threats. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Paragon 28, Inc.


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, preventative tools and technologies, monitoring and detection tools, and regular backup protocols. Additionally, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. The results of these assessments are reported to the Audit Committee.


text: We assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop remediation or mitigation controls and safeguards. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing to evaluate the effectiveness of our information security program and improve our security measures and planning. Risk Assessment: Regular assessments identify and prioritize technical risks to critical assets through threat identification and vulnerability assessments.


text: Risk Identification and Analysis: Prioritization of risks is based on standardized scoring frameworks, focusing resources on addressing the most significant threats.


text: Risk Mitigation and Management: A range of controls and measures are implemented to mitigate identified risks, incorporating technical and procedural safeguards.


text: Continuous monitoring systems are deployed to detect potential security incidents in real-time, ensuring a 24x7x365 capability to respond and mitigate. Cybersecurity Training and Awareness: New hire, annual, and ongoing security awareness training is given to all employees. Incident Response: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Continuous Improvement: Commitment to continuous improvement is reflected in regular reviews, updates of risk assessments, and simulated cyberattacks to identify and remediate risks from existing and emerging threats.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives.


text: Our management team, including the Director of IT Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 20 years of Information Security experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: IRadimed employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third-party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis.

companyName: IRADIMED CORP

ticker: IRMD


text: Our cybersecurity team works in conjunction with management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. The Chief Executive Officer is responsible for overseeing our information technology leadership team and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into IRadimed's enterprise risk management process, and our information technology leadership team reviews the Company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into the enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to, information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing, training and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources; and the formation of a multidisciplinary cybersecurity incident response team.


text: The Board provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risks and assists the Board of Directors in fulfilling its oversight responsibilities regarding Company policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing our information security policies and internal controls regarding information security; and reviewing the annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the cybersecurity program and receives regular updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. The Audit Committee oversees the Company's disclosure of any cybersecurity incident deemed material (and such materiality determination will be made by the Board upon recommendation of the Audit Committee) as required by the SEC or any other governmental authority, as applicable. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of vertical applications are required to document user access reviews regularly. We request a System and Organizational Controls ("SOC") 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, IRadimed invests significantly in the cybersecurity elements outlined above. In addition, the Company has made investments to fulfill the operational and financial regulatory requirements laid out by the Sarbanes-Oxley Act of 2002.


text: IRadimed faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks.