text: Our Company has a dedicated team of technology professionals who consistently monitor risks related to cybersecurity. Our Corporate Vice President and Chief Information Officer, as well as our Chief Information Security Officer ("CISO") are responsible for managing our information technology ("IT") security program. Our CISO is a Certified Information Systems Security Professional (CISSP), holds a Masters Degree in Computer Information Systems, and has over 20 years of relevant expertise in assessing and managing cybersecurity risks. Their teams are responsible for leading an enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. To identify and address potential information security risks, we use a defense-in-depth methodology that employs multiple, redundant defensive measures and outlines actions to take in the event of a security control failure or vulnerability exploitation. To protect the Company from cybersecurity threats, we utilize a combination of internal resources and external consultants and providers. These consultants and providers provide services such as penetration testing, incident response, and third-party assessments. In addition, we use a combination of both proprietary and commercial solutions to proactively manage and mitigate threats to our IT environment and these processes have been integrated into the Company's overall risk management system.

companyName: VICOR CORP

ticker: VICR


text: Our CISO oversees security, including the corporate IT environment, our public cloud presence, and security standards that are used as a framework for managing security across our Company. Our CISO is also responsible for security awareness, administering our corporate security training, and sponsoring our cybersecurity policy and standards. Our cybersecurity plan is reviewed annually, and our Audit Committee has delegated to the Executive Security Incident Response Team which is made up of our Chief Financial Officer, a Board member and senior management representatives in the legal, IT and finance functions, oversight of our cybersecurity program. The Executive Security Incident Response Team receives regular updates directly from our CISO and Vicor product security experts from various business and operational areas. We maintain various security certifications across the Company, and part of our compliance program includes processes to oversee and identify material risks from cybersecurity threats and include the use of third-party service providers to perform regular audits to ensure our security management program remains current.

secItem: Item 1C


text: Our objective for managing information security and cybersecurity risk is to avoid or minimize the impacts of both internal and external threat events and other efforts to penetrate or otherwise compromise the confidentiality, integrity, or availability of our systems. We work to achieve this objective by hardening networks and systems against attack, and by diligently managing visibility and monitoring controls within our data and communications environment to recognize events and respond appropriately.


text: To keep the Executive Security Incident Response Team apprised of the continually shifting landscape, the CISO typically provides quarterly updates to the Executive Security Incident Response Team on information security and cybersecurity matters. The Executive Security Incident Response Team maintains oversight of the efforts made to maximize information security and cybersecurity efforts. Potential concerns related to information security and cybersecurity will be escalated to the Board of Directors and Audit Committee, as appropriate.


text: Our cybersecurity infrastructure undergoes external audits. These efforts demonstrate our commitment to maintaining the highest level of cybersecurity protection. Our external third-party providers also evaluate and rank our cybersecurity maturity and coverage as part of their services. To stay informed about emerging threats, we regularly consult with external providers and other sources such as government publications and notices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Vicor Corporation maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: As is the case for all companies in our industry or with a significant digital presence, we are periodically subject to cyberattacks and other cyber incidents and, therefore, cybersecurity is an integral component of our overall enterprise information security program. We have adopted a multi-layered framework to secure our networks, systems, devices, products and services while also assessing, identifying, and managing cybersecurity risks. That framework is designed to help protect our information assets, operations, and resources from internal and external cyber threats by understanding and seeking to mitigate risks while ensuring business resiliency from unauthorized access or attack. Our cybersecurity policies, standards, and procedures include security risk assessments for high priority systems, third party compliance assessments for external vendors and suppliers, and incident management and breach response plans. which are influenced by, and periodically assessed against, recognized cybersecurity frameworks. Our incident management policy is designed to help prevent, manage, and coordinate our response to, and recovery from, potential and confirmed cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as comply with applicable legal obligations.

companyName: TechTarget Holdings Inc.


text: We seek to enhance our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. For example, we conduct regular risk assessments at planned intervals for high priority systems and/or applications to identify and analyze threats and vulnerabilities, identify controls, identify risk ratings and likelihood and level of potential impact, and provide recommendations for risk reduction, mitigation, acceptance, and avoidance. As part of our overall risk mitigation strategy, we also maintain cyber liability insurance coverage; however, such insurance coverage may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We regularly engage external parties, including consultants, auditors, and cybersecurity service providers to enhance our cybersecurity oversight. For example, we maintain an ISO 27001 certification for our BrightTALK platform and obtained a SOC 2, Type II report for our Priority Engine platform. These third-party assessments are evaluated and updated regularly. Additionally, we utilize various external parties and tools to assist us with annual penetration testing, cybersecurity and related training, vulnerability and patch management, threat detection and response, and information technology general controls.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have a third-party risk management and assessment program designed to help protect against the misuse of information technology, data, and systems by third parties and business partners generally requiring third-party service providers to complete a security risk assessment, with certain high priority third-party providers undergoing annual risk assessments to determine if they have experienced any changes that could impact their security risk. If any critical risks are identified, we may perform a compliance audit of the third-party to further document findings and to recommend corrective actions.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled "The loss of personal, confidential, and/or proprietary information due to our cybersecurity systems or the systems of our customers, vendors, or partners being breached could cause us to incur significant legal and financial exposure and liability, and materially adversely affect our business, operating results and reputation," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our Board of Directors provides oversight over cybersecurity risk. Our Board of Directors receives and provides feedback on periodic updates from management regarding cybersecurity and is notified between such updates regarding significant new cybersecurity incidents, if any. Our Board of Directors also receives periodic briefings on cyber-related issues and accomplishments including, among other things, reviewing key elements of our cybersecurity program, ongoing training initiatives and awareness programs, occurrence of any incidents, and updates regarding third-party certifications and assessments.


text: We have a Privacy and Security Executive Taskforce ("Taskforce") consisting of executive-level leaders that meets periodically to, among other things, review global trends in privacy, security, and compliance, identify key projects and resource needs, and review operational privacy and security statistics and metrics. Additionally, our Chief Technology Officer ("CTO") is a member of the Taskforce and manages and oversees a team (the "IT Security Team") that is responsible for leading company-wide cybersecurity efforts. The IT Security Team works with various business units and departments, including legal, product development, and operations, to help set standards, policies, and processes. Our CTO along with key members of his IT Security Team have worked in the information security field for many years and are actively involved in our cybersecurity efforts. Our internal audit function also provides independent testing on aspects of the operations of our cybersecurity program and the supporting control framework and reports the results of these audits in reports to our Audit Committee.


text: In an effort to deter and detect cyber threats, we periodically provide all full- and part-time employees with a data privacy, cybersecurity, and incident response training and compliance program, which covers timely and relevant topics, including phishing, malware, password security, confidential data protection, asset use and mobile security, and educates all employees on the importance of reporting all incidents immediately to the company's dedicated Incident Management Team. We also use technology-based tools to mitigate cybersecurity risks to bolster our employee based cybersecurity programs.


text: We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes.

companyName: Gogo Inc.

ticker: GOGO


text: As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, manage and report cybersecurity risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology's Cybersecurity Framework ("NIST"), which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. To protect our network and information systems from cybersecurity threats, we use various security tools and policies that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.


text: We have a number of policies and procedures supporting the cybersecurity program, including a comprehensive enterprise cybersecurity incident response plan which is activated in the event of a cybersecurity incident. The incident response plan is a detailed playbook that specifies how Gogo classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, the Board, the Audit Committee, the Chief Executive Officer and other senior executives are part of the notification chain.


text: We conduct regular reviews and tests of our cybersecurity program, which includes tabletop exercises, penetration and vulnerability testing, simulations, and other exercises, as well as leverage audits by our internal audit team to evaluate the effectiveness of our cybersecurity program and controls and improve our security measures and planning. We also engage external auditors to review our cybersecurity program and controls, as well as engage third parties to perform penetration testing and vulnerability scanning of our public and private assets.


text: With respect to third-party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures through various contractual provisions to the extent possible, and we perform risk assessments of vendors as appropriate from time to time, which includes a vendor's ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, including the loss of customer confidence, reputational harm, our operating results and our financial condition. While we have experienced cybersecurity incidents, to date, we do not believe that we have experienced a material cybersecurity incident during the fiscal year ended December 31, 2023.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as our contemplated use of artificial intelligence may further expose our computer systems to the risk of cybersecurity incidents.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, which involves Board and Audit Committee oversight, senior and department executive leadership focus and commitment, and employee training. Our Audit Committee, comprised entirely of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through annual assessments, quarterly reporting and regular updates from members of the Company's executive leadership team, cybersecurity and data privacy leadership team, as well as the Internal Audit team.


text: Our Vice President, Network Engineering, Product Development and Operations serves as the leader of our cybersecurity team and has over 25 years of experience working in information technology, specializing in network security. The leader of our cybersecurity team has spent the last 17 years working for us in a variety of roles and as a result has in-depth knowledge of the Company's IT and Cyber ecosystem. We believe that his technical expertise combined with his business acumen and education, positions him well to lead Gogo's cybersecurity program. In addition to oversight of cybersecurity, our Vice President, Network Engineering, Product Development and Operations oversees (i) infrastructure management, (ii) the implementation and compliance of our information security standards, and (iii) mitigation of information security related risks. We also have management level committees and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The Cybersecurity Cross Functional Team (the "Cybersecurity CFT"), led by our Vice President, Network Engineering, Product Development and Operations, brings together IT, legal, compliance and other function heads. The Cybersecurity CFT provides a forum for these cross-functional members of management to: consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Gogo Executive Cybersecurity Committee (the "GECC") is comprised of executive leadership and members of the cybersecurity, operations, risk, legal, and internal audit teams. The GECC liaises with the Cybersecurity CFT and provides oversight of all aspects of Gogo's cybersecurity program and, at regular intervals through the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks. • The Incident Response Management Team (the "IRMT"), which includes senior executives and members of our cybersecurity leadership team, was established to support our incident response plan and reports into the GECC. Members of the IRMT are alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The IRMT annually assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. The IRMT also engages with the Company's Board and the Audit Committee depending on the severity of the cybersecurity incident.


text: The output of each of the foregoing committees are collected and analyzed on a regular basis and our Vice President, Network Engineering, Product Development and Operations briefs the Audit Committee, through quarterly updates as well as on an ad hoc basis between regular updates to the extent needed.


text: At the employee level, we maintain an experienced IT team tasked with implementing our privacy and cybersecurity program and supporting our cybersecurity leader in carrying out reporting, security and mitigation functions. We continuously seek to promote awareness of cybersecurity risk through communication and education of our employee population, and have a mandatory training program which covers privacy and cybersecurity (including phishing tests) and records and information management.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. This program includes: • Robust Firewalls and Intrusion Detection Systems: The company has invested in state-of-the-art firewalls and intrusion detection systems to prevent unauthorized access to its networks. • Regular Security Assessments: The company conducts regular security assessments to identify vulnerabilities and address them promptly. This includes penetration testing, vulnerability scanning, and third-party audits. • Employee Training and Awareness: The company provides comprehensive cybersecurity training to all employees to educate them about potential risks, phishing attacks, and best practices for protecting sensitive information. • Incident Response Plan: The company has developed an incident response plan that outlines the steps to be taken in the event of a cybersecurity breach. This includes isolating affected systems, investigating the breach, and notifying relevant stakeholders. • Cyber Insurance: The company has obtained cyber insurance coverage to mitigate the financial impact of a cybersecurity breach. This insurance policy covers expenses related to incident response, legal fees, and potential customer compensation.

companyName: Arcellx, Inc.

ticker: ACLX


text: By implementing these risk management strategies, the company aims to minimize the likelihood and impact of a cybersecurity breach, thereby safeguarding its assets and maintaining the trust of its stakeholders.


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Director of Information Technology who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage assessors, consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function primarily through the audit committee.


text: Our Director of Information Technology and members of our cybersecurity committee (a management committee), which includes legal and privacy representatives, are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers. Our Director of Information Technology has expertise in security frameworks and standards (NIST), proficiency in security tools such as Security Information and Event Management) systems, Intrusion Detection Systems (IDS) and vulnerability scanners, and has experience with threat intelligence, threat modeling, risk assessment, and risk management practices as well as analyzing logs, investigating security incidents, and performing forensic analysis.


text: Our Director of Information Technology and members of our cybersecurity committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Director of Information Technology and members of our cybersecurity committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: Security Awareness Training, Patch Management Process, Endpoint Detection and Response, Managed Detection and Response, Incident Response Plan, Data Encryption, Access Control, Network Security, Vulnerability Management.


text: Our Director of Information Technology, Controller and members of our cybersecurity committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We design and are assessing our cybersecurity risk management program based on the ISO 27001:2022 standard. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27001:2022 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Merus N.V.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information technology systems that are vulnerable to cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT department who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process. The cybersecurity risk management program also includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards, and investigations on an as needed basis. We contractually require third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please see section "Risk Factors --Our information technology systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Operating Officer and management team are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from the Head of IT Security and Compliance, the supporting internal team and support of third-party service providers.


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Cybersecurity Risk Management and Strategy" above.


text: Our Chief Operating Officer and Head of IT Security provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter. Our audit committee is charged with, and is able to pass resolutions relating to the application of information and communication technology by the Company, including risks relating to cybersecurity. Moreover, periodic briefings are also provided to the board of directors relating to our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter.


text: Our team that is responsible for assessing and our material risks from cybersecurity threats, including our Chief Operating Officer, Chief Financial Officer, and Senior Director, Head of IT Security and Compliance, has more than a combined 30 years of risk management experience. Our team's experience includes the Senior Director, Head of IT Security and Compliance, who has an extensive (+25 years) track record on cyber- and IT risks management, developing security and compliance programs and frameworks and leading IT security organizations, our Chief Finance Officer who, serving that role at Merus and prior companies and serving as a previously Audit Committee chairperson for Merus and current chairperson at Kala Pharmaceuticals, has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, while evaluating strategies to gain a high level of cyber security, and our Chief Operating Officer, who manages the IT organization at Merus and has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, and review U.S. jurisprudence concerning protection of confidential information and trade secrets and has participated in trainings on cybersecurity threat defense and response, and cybersecurity strategies from a legal perspective.


text: We operate in the biopharmaceutical sector, which is a highly regulated sector subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; disruption of our clinical trials, manufacturing or supply chain; violation of privacy laws and other litigation and legal risk; and reputational risk. We rely primarily on industry-leading third parties and a cloud-based infrastructure for our information technology systems, and accordingly are dependent on these third parties' own cybersecurity risk management practices and strategy. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data ("Information Systems and Data").

companyName: GERON CORP

ticker: GERN


text: We take a risk-based approach to identify and assess the cybersecurity threats and risks that could affect our business and Information Systems and Data. Our Information Technology personnel help identify, assess and manage our cybersecurity threats and risks, and support our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods and tools to identify, assess and manage cybersecurity threats and risks, including, for example, automated tools, industry reports, third party threat assessments and penetration testing. In addition, we encrypt data at rest and maintain network security controls, such as firewalls and virtual private networks. We also conduct computerized system monitoring and access control, including asset management, tracking and disposal associated with onboarding and offboarding of personnel. We maintain cybersecurity insurance.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. For example, we have implemented and maintain an incident response plan, and we utilize automated tools designed to maintain email security. We have also implemented a computerized system security and password policy that defines security for access to computer systems managed and controlled by us, and a procedure for computerized system incident management to address any unplanned issues in regulated computerized systems that could impact subject safety, product quality, and data integrity. We periodically conduct cybersecurity incident tabletop training exercises involving our personnel and plan to conduct similar training in 2024.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our head of Information Technology evaluates material risks from cybersecurity threats and reports periodically to our Audit Committee, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers such as Crowdstrike, cybersecurity service providers such as Mimecast, penetration testing firms, auditors, and professional services firms, including legal counsel. These relationships enable us to leverage specialized knowledge and insights, enabling our cybersecurity strategies and processes to remain consistent with industry best practices.


text: We rely on third-party service providers to perform a variety of functions throughout our business, such as contract manufacturing organizations, contract research organizations, suppliers and consultants. If we successfully obtain regulatory approval to commercialize imetelstat, we will rely on third party logistics organizations and distributors to distribute imetelstat. We conduct quality audits of regulated vendors, which typically include an assessment of such vendor's information technology systems, and we impose appropriate contractual obligations on vendors pertaining to information security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our efforts may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. We have not encountered cybersecurity challenges that have materially impaired our business, operations or financial standing.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Information Technology Systems, Data Security and Data Privacy."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of our Board is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our Audit Committee, as well as our Chief Financial Officer, Chief Legal Officer, and other members of our executive management as appropriate, receives periodic reports from our head of Information Technology concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various periodic presentations related to cybersecurity threats, risk and mitigation.


text: Our Information Technology personnel responsible for cybersecurity risk assessment and management processes are managed by certain members of our executive management, including our Chief Financial Officer. Together with our executive management, our Information Technology personnel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. We seek to hire information technology personnel with skills appropriate to help us prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including executive management. When appropriate given the nature of any potential cybersecurity incident, our executive management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, and to make any legally required notifications to individuals or regulatory agencies, including making any required disclosures under the Securities Exchange Act of 1934, as amended.


text: As part of our Enterprise Risk Management ("ERM") process, we identify risks and assign responsibility for managing each risk to the appropriate level of management. Cybersecurity is a risk identified in our ERM process. Management has implemented a comprehensive cybersecurity risk management strategy in line with industry standards and regulatory requirements. This strategy includes: • conducting an independent cybersecurity maturity assessment to evaluate the health of our overall cyber programs and developing a solid roadmap to continuously improve our defensive posture; • performing regular risk assessments, where we identify potential vulnerabilities and evaluate the likelihood of various cyber threats; • implementing security controls including email and browser protection, audit log monitoring, malware defenses, controlled use of administrative privileges, encryption protocols, and multi-factor authentication; and • implementing progressively challenging employee training and awareness programs, including simulated phishing campaigns, to reduce the risk of human error in the recognition and reporting of potential threats.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: We continuously monitor our networks and systems and integrate threat intelligence feeds to evaluate evolving cyber threats. We conduct regular testing and simulation exercises, including engaging third-party service providers to perform penetration testing, to identify and address weaknesses in our defenses and engage third-party service providers to perform cybersecurity risk assessments, which are based on the National Institute of Standards and Technology framework. Cyber risks are considered and addressed for those third-party relationships deemed critical to our operations, as well as those with access to or custody of confidential data or customer non-public information, including PHI, and those services or products accessed in a cloud environment or involving generative artificial intelligence or other machine learning technologies.


text: The Audit and Risk Committee of the board of directors has responsibility of oversight for the Company's enterprise risk assessment and risk management systems. Our Chief Information Officer ("CIO"), Senior Director of Information Security and other delegated positions are responsible for assessing and managing our material risks from cybersecurity risks. Our CIO has 15 years of experience in cybersecurity and a degree in management information systems. We also have a Cybersecurity Infrastructure Committee that meets monthly. We have implemented an incident response strategy as an element of our overall risk management approach. Our incident response plan entails clearly-defined roles and responsibilities, established communication protocols and measures to mitigate the impact of any cybersecurity incidents. We have experienced adverse IT events in the past, but to date, we have seen no material impact on our business or operations from these attacks or events. We prioritize the detection, response, and recovery from potential breaches and carry cybersecurity insurance which includes cyber breach response services. The scope and coverage of our cybersecurity insurance is reviewed on an annual basis. Risks and potential threats are identified and measured through these monitoring, testing, and response processes procedures and significant risks, and threats are reported by the CIO to the Audit and Risk Committee.


text: The Information Security function is led by the Chief Information Security Officer (CISO), under the direction of the Chief Information Officer (CIO). The Company's CISO, who was appointed in August 2021, has over 20 years of experience within information security and is both a Certified Information Security Manager and a Certified Information Systems Auditor. Key responsibilities of the Information Security function include developing cybersecurity strategies; managing cybersecurity governance; performing cybersecurity risk assessments; ensuring compliance with security standards and regulatory requirements; managing identity and access; monitoring cybersecurity threats; validating cybersecurity alerts; preparing for and responding to cybersecurity incidents; business continuity and disaster recovery plans; and creating security awareness through periodic trainings of both Company leadership and Associates. The CIO, CISO and the Company's Chief Legal Officer, who also serves as the Chief Compliance Officer, have oversight responsibilities of the Company's cybersecurity program.

companyName: SpartanNash Co


text: The Company's Board of Directors (Board) has appointed the Audit Committee to assist the Board in fulfilling its responsibilities with respect to the oversight of cybersecurity, data security, privacy programs, and the Company's response to security breaches. Two Company Directors serving on the Audit Committee completed the National Association of Corporate Directors/Carnegie Mellon CERT cyber-risk oversight program along with required examinations and earned the CERT designation. The CISO provides quarterly updates to the Audit Committee, which include a current evaluation of the Company's maturity within the National Institute of Standards and Technology (NIST) framework, including assessments against key performance indicators, updates on internal phishing campaigns, tabletop exercises conducted at various levels of the organization, and management training. The Audit Committee also reviews reports and recommendations from third parties periodically engaged by the Company to assess the cybersecurity control environment. In addition, the Company's internal audit function periodically audits elements of the security program and reports its observations to the CISO and the Audit Committee.


text: As a component of the Company's overall risk management process, which is aligned with a broader Enterprise Risk Management framework, the Company has implemented a multi-layered approach to minimize cybersecurity risk and safeguard its data. The Company conducts cybersecurity risk assessments on a regular basis and responds to identified risk exposures by employing a combination of risk mitigation strategies, including the adoption of cybersecurity controls and maintaining a cybersecurity insurance policy that provides coverage for security breaches. The Company engages third party consultants periodically to evaluate elements of the cybersecurity policy, processes, procedures and controls. The CISO and other members of the Executive Leadership Team respond to applicable recommendations arising from the third-party consultants. In addition, the Company engages a Qualified Security Assessor as part of the compliance requirements for Payment Card Industry (PCI). The Company also engages with a third-party risk management provider to ensure its vendors comply with internal security and privacy requirements and that key vendors are continually monitored for security risks. The Company's cybersecurity governance practices are based on the Company's common control framework which incorporates elements from the NIST Cybersecurity Framework, the Center for Internet Security's benchmark standards, and specific regulatory and industry requirements including Health Insurance Portability and Accountability Act and PCI. The CISO provides at least quarterly updates on the cybersecurity program, including the results of the cybersecurity risk assessments and the related responses, to the Company's Security Governance Council composed of members of the Executive Leadership Team. The Company continually monitors cybersecurity threats and has a dedicated cybersecurity team in place to identify if any of the threats may lead to a cybersecurity incident. In the event of such an incident, the Company will take decisive measures to thoroughly analyze, contain, and eliminate the threat. Following an incident, a comprehensive review is performed to determine whether the incident meets qualitative or quantitative materiality thresholds, and whether the incident warrants public disclosure.


text: Effect of Cybersecurity Threats As of the effective date of this filing, the Company is currently not aware of any known or potential cybersecurity threats that are reasonably likely to materially affect the Company's business strategy, results of operations, or financial conditions. Although the Company believes it has implemented sufficient security measures to protect against cyber-attacks, unknown cyber incidents could materially disrupt the Company's operations or compromise sensitive information.


text: We recognize the importance of identifying and managing cybersecurity risks and have integrated cybersecurity risk management into our overall risk management processes. We have implemented processes to identify, assess, detect, evaluate, and mitigate ongoing security threats to our information technology systems and data as well as those of third parties upon which we rely.

companyName: IonQ, Inc.

ticker: IONQ


text: We conduct periodic and ad-hoc risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing, maintain ongoing risk assessments, and monitor various third-party risk feeds. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. In evaluating our response to our application security assessments, penetration tests, and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program. Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have passed a SOC 2 type 1 audit. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.


text: We maintain an incident response plan which includes, among other areas, prioritization guidelines, data collection and evidence handling, communication channels and partners, and if required, law enforcement engagement. We maintain relationships with both local and national law enforcement agencies. We evaluate security incidents on a scale of severity to determine the appropriate incident handling protocols.


text: We require all employees to undertake data protection and security training at least annually. We provide specialized training to targeted groups of employees depending on their role and the larger threat landscape. We are briefed regularly by national law enforcement, and work with external consulting firms on custom training and evaluations.


text: While we have experienced cybersecurity incidents in the past, to date, none have materially affected the Company or our financial position, results of operations, or cash flows. We continue to invest in the cybersecurity and resiliency of our systems and networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "If our information technology systems, data, or physical facilities, or those of third parties upon which we rely, are or were compromised, we could experience adverse business consequences resulting from such compromise," which should be read in conjunction with the information contained within Item 1C, Cybersecurity.


text: The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, directly and through its committees. Our Audit Committee is responsible for the oversight of cybersecurity risks, including our assessment of potential vulnerabilities and threats, evaluation of incidents, and monitoring of the implementation of key actions and/or projects to further enhance our ability to detect and manage ongoing security threats. Key members of management, including our security officer, provide updates to our Audit Committee on at least a semi annual basis. In addition to committee updates, our security officer also meets with the full Board of Directors at least annually to discuss the Company's overall risk profile and associated ongoing mitigation efforts. The briefings provided to our Audit Committee and Board of Directors include updates on the Company's key cyber risks and threats, the status of projects to strengthen our information security systems and incident readiness programs, assessments of the information security program and our key assets, as well as the emerging threat landscape.


text: Our security officer, who reports to our VP of Engineering, and is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, VP of Engineering, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies. Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters. Our security officer collaborates closely and regularly with our external consulting firm who provides a fractional Chief Information Security Officer ("CISO"), which includes a cybersecurity expert with recognized expertise and many years of experience.


text: The Company's overall risks and assessments are monitored via a cross functional team composed of members of senior management, security, legal, and financial reporting. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee pursuant to its charter. Our Audit Committee is primarily responsible for monitoring and assessing strategic risk exposure and receives periodic updates from management at Audit Committee meetings regarding cybersecurity threat risks and management's strategies to manage the same, and our management is responsible for the day-to-day management of the material risks we face. Our Audit Committee reports to the board of directors regarding its activities, including with respect to cybersecurity risk oversight as appropriate, on a quarterly basis.

companyName: RxSight, Inc.

ticker: RXST


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats and have processes for monitoring and assessing strategic risk exposures and reporting to the Audit Committee and board of directors. We regularly assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within our IT infrastructure.


text: We conduct periodic risk assessments to identify cybersecurity threats that may affect information systems that may be vulnerable to cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, if necessary, we implement and maintain reasonable safeguards to minimize identified risks and regularly monitor the effectiveness of our safeguards. We devote significant resources, including engaging experienced consultants and designate senior-level information technology management ("IT management") to manage the risk assessment and mitigation process. Personnel tasked with managing cybersecurity risks periodically report to senior management and the Audit Committee. We use automated tools and trained personnel to maintain real-time threat monitoring and 24x7 alerting of all of our IT infrastructure and endpoints. We leverage various software tools, internal personnel and consultants to identify, triage, escalate and remediate threats. In the event of a security incident, we follow communication protocols to alert senior-level management as to the nature and severity of the threat while leveraging consultants and forensic tools to contain, document and mitigate the threat.


text: As part of our overall risk management system, IT management monitors and tests our safeguards and trains our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies and risks through communication and trainings.


text: We have engaged, and expect to continue to engage, consultants, or other third parties in connection with our risk assessment processes. These providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing the design of our processes. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers we expect them to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "We may experience a significant disruption in our information technology systems or breaches of data security" and "Unauthorized third parties may seek to access our devices or other products and services, or related devices, products, and services, and modify or use them in a way inconsistent with our FDA clearances and approvals, which may create risks to users." As of the date of this report, we do not believe that we have experienced a material cybersecurity incident.


text: Our cybersecurity program is led by a team of skilled cybersecurity professionals, including dedicated internal cybersecurity resources and external advisors. In the normal course of business, we may collect and store sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We maintain a robust cybersecurity incident response plan, which details the incident response procedures, tactical and strategic team membership, and points of contact related to the response processes. The Company also maintains a detailed decision-tree-based playbook which is a supplement to the plan and focuses on specific types of incidents and the appropriate response steps. Cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach. The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity incidents are fully integrated into the Company's ERM program. The plan and playbook are structured to align with the National Institute of Standards and Technology ("NIST") Cybersecurity framework practices. The plan and playbook are reviewed at least annually. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Metallus Inc.

ticker: MTUS


text: The Company adheres to a periodic, third-party facilitated testing exercise of the cybersecurity incident response plan and playbook with the Company's tactical and strategic team members. The teams are comprised of key members of the organization and external advisors who hold critical importance in the handling of cybersecurity events. The exercise covers response procedures for prevalent cybersecurity incidents including but not limited to phishing, third-party breaches, and a standard incident response process. The documentation helps leaders make appropriate, pre-planned decisions. To assist, appendices detailing generalized incident response checklists and workflows from the Cybersecurity & Infrastructure Security Agency ("CISA") and the NIST are referenced and used as a framework. Lastly, the response plans contain instructions on collecting and incorporating lessons learned after a successful identification and remediation of a security event. The information security team also works in partnership with the Company's internal audit team to review information technology-related internal controls with our external auditor as part of our overall internal controls process.


text: In light of the pervasive and increasing threat from cyberattacks, the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cyberattacks. The Company's Information Technology ("IT") leadership team consults with and provides regular updates to the Board of Directors, as well as our chief executive officer and other members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of the information security program, timely reports regarding any cybersecurity incident that meets established reporting thresholds, and emerging threat landscape. In addition, the Company has an IT governance committee, which is comprised of the chief executive officer, IT and other officers of the Company. The IT governance committee meets quarterly, and as necessary, to discuss the cybersecurity program and other relevant topics. The IT team also consults regularly with the Board of Director's cybersecurity expert in between meetings. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors, at least semi-annually. The Board of Directors has oversight responsibility for our data security practices and we believe the Board of Directors has the requisite skills and awareness into the design and operation of our data security practices to fulfill this responsibility effectively.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: Our information security processes are designed to assess, identify and manage material risks from cybersecurity threats. In conducting our business activities, we are entrusted with confidential information from our clients, business partners and employees. Confidential information may include sensitive business and technical information, as well as personal information. Our Information Security Management System ("ISMS"), based on ISO/IEC 27001, is an integral part of our overall enterprise risk management system, and serves as a framework for handling cybersecurity threats and incidents, including such threats and incidents associated with our use of services by information technology suppliers. The ISMS is operated by our Global Information Security team headed by our Global Chief Information Security Officer ("CISO"). We maintain physical, electronic and procedural safeguards designed to guard confidential information contained within our information systems from loss, misuse, unauthorized access, disclosure, alteration or destruction. We have layered defenses designed to protect against intrusions that could affect the confidentiality, integrity and availability of information.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: We prepare for security incidents by analyzing threat intelligence, holding periodic cybersecurity incident tabletop exercises, and reviewing lessons learned on a regular basis. Our incident management process is communicated to employees during periodic security awareness training. Our employees are trained to report incidents, including security weaknesses, malfunctions, threats and breaches immediately to the concerned internal departments and to our information security group. Our computer security incident response team is trained to manage incident response.


text: We conduct systematic and manual assessments designed to identify information security vulnerabilities, such as external party penetration tests, internal manual penetration tests, source code scanning and other techniques. We perform information technology risk assessments on a periodic basis designed to detect risks for which controls and mitigation strategies are developed.


text: We engage with external experts, including cybersecurity assessors and consultants, in evaluating and testing our information systems and information security controls, enabling us to obtain specialized knowledge and insights.


text: We perform information technology supplier risk assessments on a periodic basis. Information technology suppliers to SS&C that access, process or store personal information or other customer data are assessed and are also subject to periodic due diligence procedures.


text: Cybersecurity risk is overseen by the board of directors, with additional oversight of the relevant risk framework and controls provided by the Audit Committee. The Audit Committee oversees our policies with respect to risk assessment and risk management generally, including guidelines and policies to govern the process by which our exposure to risk is handled. As set forth in its charter, Audit Committee oversight includes periodic review of our information security controls and procedures and the processes and procedures for managing cybersecurity risks.


text: Our CISO, who reports to SS&C's Chief Technology Officer, provides periodic updates to the Audit Committee or to the board of directors on cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends and other areas of importance.


text: Our CISO is responsible for our overall information security strategy, policy, security engineering, operations, cybersecurity threat detection and response. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. Cybersecurity team members provide regular reports to our CISO with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents, and otherwise aid our CISO in operating the ISMS. Cybersecurity team members have relevant education, certifications, and industry experience.


text: We, our clients and our vendors are regularly the target of attempted cyber-attacks, and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Such cybersecurity incidents could lead to disruptions in our systems; the unauthorized release or destruction of our or our clients' or other parties' confidential or otherwise protected information; and corruption of data. We regularly re-evaluate, modify and enhance our information security processes as new technologies emerge or new risks are identified. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk factors - Risks Relating to Our Business - Our software-enabled services may be subject to disruptions, attacks or failures that could adversely affect our reputation and our business." for more information about these risks.


text: Premier's risk management program is designed to o identify, measure, prioritize, and manage risk, including information security and cybersecurity risk, in relation to the Company's desired risk appetite established by its Board of Directors. Premier uses a risk-based approach to manage and mitigate threats to information technology resources. Periodic risks assessments are conducted to identify, assess, and reduce information security and cybersecurity risks to acceptable levels.

companyName: PREMIER FINANCIAL CORP


text: Premier maintains an active Information Security Policy (the "IS Policy") and associated programs, procedures and standards (collectively with the IS Policy, the "ISPP") in alignment with Federal Financial Institutions Examination Council and National Institute of Standards and Technology guidance to help in the mitigation of risks that may impact the Confidentiality, Integrity and Availability (aka "CIA Triad") of systems and information. The components of the IS Program are reviewed and approved annually by senior management and the IS Policy is reviewed and approved annually by either the Risk Committee of the Board of Directors or the full Board of Directors. These annual reviews and approvals ensure the ISPP meets expectations to safeguard Premier and customer confidential information. The ISPP is subject to annual review by our auditors (both internal and external), the FDIC, and the ODFI to ensure it is in alignment with Premier's internal risk management practices, government regulatory expectations and industry best practices. We use auditors and other third party resources, in addition to internal tools and resources, for security monitoring and testing.


text: Premier maintains an Information Technology Incident Response Policy and an Information Security Incident Response Playbook that together coordinate the identification, reporting and escalation, containment, and remediation responses of any potential information security incident. Each cybersecurity incident is reviewed by the Chief Information Security Officer ("CISO") to determine if the matter needs escalated to the Company's Information Response Team, Information Security Oversight Committee ("ISOC"), Enterprise Risk Management Committee ("ERMC"), or the Board of Directors or Board-level Risk Committee.


text: Premier address third-party risks as part of Premier's Vendor Risk Management ("VRM") Policy and Program. The purpose of the VRM is to provide a consistent framework to direct Premier in the assessment, measurement, monitoring and control of risks related to vendors and third parties with whom Premier does business. Premier assesses and monitors the cybersecurity controls of third party service providers and partners. As part of the initial and regular monitoring of the vendor, the Company reviews a vendors internal controls based on the COSO framework in alignment with their formal SOC II assessments. The focus of the review is on a vendor's internal management and security practices including but not limited to, physical/systems security, business resiliency, application programing practices, systems security monitoring, and systems change control/authorization.


text: The VRM currently is managed under the direction of the CISO, with a goal of ensuring that vendors meet obligations associated with the confidentiality, integrity, and availability of Company and customer information. Beginning with the establishment of vendor relationships, vendors are risk rated based on their criticality to the operations of Premier and the sensitivity of the information such vendor has or utilizes to provide services to the Company. These assessments include, but are not limited to, a review of financial, operational and security aspects of the vendor. After the establishment of the vendor relationship, vendors are reevaluated on a regular basis based on their criticality and risk rating, with such reevaluations being conducted either annually, every two years or every three years.


text: Notwithstanding the focus Premier places on cybersecurity, Premier may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Premier Board of Directors has assigned to the Board Risk Committee ("BRC"), along with the ERMC, oversight of risk management, including risks associated with information security and cybersecurity. The BRC is comprised of independent directors of Premier with participation from Premier's executive leadership and additional members of management. The ERMC is chaired by the Chief Risk Officer and, in addition to general oversight of risk management, is responsible for documenting all risks for the organization and reporting to the BRC issues of a critical nature. The ERMC meets monthly and is a cross-functional group comprised of all members of executive leadership and additional members of management from different areas of the Company. The ISOC) is responsible for managing and mitigating information security and cybersecurity risks where appropriate and escalates issues to the ERMC. The ISOC is chaired by the CISO and includes select members of executive leadership and representatives from the Risk Management Department and Information Technology Department. The ISOC meets at least monthly. Routine reporting of the status of cybersecurity risks and mitigation activities progress from the ISOC to ERMC and finally to BRC.


text: The information security and third-party risk management programs of the Company are managed by the CISO who is a member of the Company's Risk Management Department, reporting directly to the Company's Chief Risk Officer who reports directly to the Chief Executive Officer. The CISO's responsibilities include: maintaining the information security risk assessment and related reports to management; monitoring reasonably foreseeable threats, internal and external, that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or data systems; overseeing the development, implementation, enforcement and maintenance of the ISPP; implementing appropriate changes to the program in response to industry or regulatory mandates; monitoring the entire ISPP, reviewing it at least annually, and adjusting as necessary for changing regulation, technology, personnel, procedures and business arrangements; reporting the status of the ISPP periodically; ensuring information security awareness training is provided to all employees on a regular basis; ensuring the ISPP assessments are updated to include control changes for existing/new products, processes, and systems reflecting the associated changes to risk and mitigation methodology; providing guidance to management on emerging risks, cyber threats and regulatory changes; and maintaining information security program strategic goals in alignment with IT and PFC business strategy.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, personal information, and Personal Health Information ("PHI") (collectively, "Information Systems and Data").

companyName: Personalis, Inc.

ticker: PSNL


text: The board of director's audit committee and the internal cybersecurity team help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of our risk register. Our internal cybersecurity team includes our information security function, security management, engineering operations, legal, risk management and third-party service providers. Our cybersecurity team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Personalis' risk profile using various methods including, for example: using manual and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments, employee reporting, and regular reviews and internal and external audits.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan, incident detection and response, disaster recovery and business continuity plans, risk assessments, network security controls, access controls, user management, asset management, hardware and data segregation, system monitoring and regular reviews.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. Additionally, the cybersecurity team monitors activity on a continual basis and works with security management to prioritize our risk profile and mitigate cybersecurity threats that are more likely to lead to a material impact to our business on a monthly basis; executive management evaluates material risks from cybersecurity threats against our overall business objectives on a periodic basis and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk periodically.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, threat intelligence service providers, and professional services firms.


text: We use third-party service providers to perform a variety of functions throughout our business, including, but not limited to infrastructure support and maintenance, supply chain resources, contracting services and software integrations. These vendors are reviewed as part of our vendor management program, including the management of cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I, Item1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including the Vice President of Informatics, who has more than 20 years of experience in information technology and oversees the Informatics department which includes the Company's hardware, software, help desk, and cybersecurity team.


text: The Vice President of Informatics reports to our Chief Financial Officer and is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Vice President of Informatics is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the internal cybersecurity team and others, depending on severity. The cybersecurity team works with our incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic updates from certain members of the cybersecurity team concerning the Company's significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee and board also have access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: As an HCM company, we face a multitude of cybersecurity threats from threat actors seeking to access or leverage the data we possess for malicious ends. Review of our information security program, including our cybersecurity policies, standards, and processes, is integrated into our Enterprise Risk Management ("ERM") program which is based on the COSO Enterprise Risk Management Framework and International Organization for Standardization ("ISO") 31000, the two most widely used global standards for ERM.

companyName: Dayforce, Inc.

ticker: DAY


text: Our information security program aligns with recommended practices in security standards issued by ISO, AICPA (SSAE18), National Institute of Standards and Technology ("NIST") and other industry sources. Specifically, we maintain several ISO certifications (ISO 27001, 27701, 27017, 27018, 27036), NIST 800-171 compliance, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. We have invested in our data security team, information security program, and security environment in order to identify, prevent, and mitigate cybersecurity threats and promptly identify and respond to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program to ensure that it remains reasonable and appropriate to changes in the security threat landscape, available technology, security vulnerabilities, and legal and contractual requirements applicable to us, is a continuous effort.


text: We believe that effective cybersecurity depends upon the successful implementation and maintenance of a comprehensive information security program. Deploying suitable security technology, which encompasses analytics and automation, and leveraging the expertise of highly skilled security and risk professionals, is crucial in our strategy. Additionally, we prioritize data governance and data-centric security as integral components of our approach to ensure compliance, uphold privacy standards, and safeguard customer data.


text: We continue to work to enhance our capabilities in cloud security and assurance testing, security operations and automation, product security, and enterprise risk management. To combat the evolving cybersecurity risk landscape and the enhanced level of sophistication of cybersecurity threats, management has prioritized five areas of our information security program: global standards and operations, a risk-aware workforce, product security, detection and response, and data governance management. In addition, we maintain cybersecurity insurance; however, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: We contract with several outside cybersecurity experts to audit and test security controls on a regular basis. Any risks or control gaps identified as a result of such assessments, audits, and reviews are reported to the most senior leadership of all functional areas of the Company, the Audit Committee of the Board (the "Audit Committee"), and the Board as appropriate, and we adjust our cybersecurity policies, standards, and practices as necessary.


text: We face a number of risks from cybersecurity threats, which may materially affect our business, financial condition, and results of operations, because our business is dependent on the successful operation of our payroll, transaction, financial, accounting, and other data processing systems. Although such risks have not materially affected us, including our business, financial condition, and results of operations to date, we have, from time to time, experienced threats to and breaches of our data and systems, and our third-party partners' data and systems, including malware and computer virus attacks. Businesses we acquire maintain separate cybersecurity programs and processes that may differ in scope and complexity from our overall programs and processes as we set about integrating the acquisition target's systems into ours. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not detected a cybersecurity incident. Please refer to Part I, Item 1A, "Risk Factors" for further discussion of our cybersecurity-related risks.


text: Our commitment to cybersecurity begins at the Board and extends to the most senior leadership of all functional areas of the Company. Our Audit Committee oversees our risk management process at the Board level. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management, including in the areas of cybersecurity and other information technology risk and privacy.


text: The Company's cybersecurity program is supervised by our Chief Information Security Officer ("CISO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity, strategy, policy, standards, and processes. The CISO provides quarterly updates related to the cybersecurity program, including any notable incidents at regularly scheduled Audit Committee meetings. The CISO updates include details regarding the magnitude, financial impact, and remediation of cybersecurity incidents. Members of our Board of Directors and senior Company executives participate in annual tabletop exercises that focus on testing response plans to ransomware, cloud security, payroll disruption, and other incidents. In addition, in order to deploy a consistent cybersecurity framework, and to manage the risk of social engineering, software downloads, and phishing, we educate employees globally through ongoing security awareness training.


text: Our CISO has served in various roles in information technology and information security for over 25 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and is a member of the National Association of Corporate Directors ("NACD"). At the management level, our CISO, who oversees our data security personnel, works closely with our Chief Risk Officer, who oversees our incident response and business continuity management programs, to assess and manage the cybersecurity element of our ERM program. Our Chief Risk Officer has extensive familiarity with our business, having been at Dayforce, Inc. for over 20 years. Our Chief Risk Officer focuses on risk management, business continuity planning, crisis management, audit processes, operations management, and executive and board of directors reporting.


text: Our CISO and Chief Risk Officer report to our Chief Operating Officer. These officers, along with our Chief Product and Technology Officer and our Chief Information Officer, drive our cybersecurity priorities at the executive level.


text: We have established a documented cybersecurity incident materiality assessment and disclosure program that is jointly managed by our Incident Response, Cybersecurity, and Corporate Legal teams. This program calls for the immediate assessment of potentially material cybersecurity incidents, and the appropriate escalation to our cross-functional Disclosure Committee in order to facilitate the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner and elevated to our Audit Committee or Board if needed.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures and processes that are designed to safeguard our information systems and to assess, identify and manage material risks from cybersecurity threats.

companyName: ZimVie Inc.


text: Managing Material Risks and Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework. This integration ensures that cybersecurity considerations are an integral part of our overall risk management system and processes. In addition, our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our systems and to advise us on cybersecurity risk management processes. These relationships enable us to leverage specialized knowledge and insights, in an effort to keep our cybersecurity strategies and processes at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: Overseeing Third-party Risk We have implemented processes to oversee and manage risks from cybersecurity threats associated with third-party service providers. We conduct security requirements assessments of third-party providers before engagement and maintain ongoing monitoring for compliance with our cybersecurity requirements. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to risks from cybersecurity threats that could have that effect, as further described in Item 1A "Risk Factors" of this Annual Report.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and has established robust processes to oversee such risks.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and has been delegated responsibility for assessing and managing such risks. The Audit Committee members have diverse expertise in risk management, technology and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk and Reporting to the Board of Directors Our Chief Information Officer ("CIO") and Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee at their meetings on a regular basis. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to the scheduled meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. In addition, the Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of IT Security, reporting to the CIO. Our Director of IT Security oversees our cybersecurity program, tests our compliance with standards, remediates known risks and leads our employee security training program. With over 25 years of experience in the field of cybersecurity, our Director of IT Security brings a wealth of expertise to the role, including extensive experience as an enterprise head of security and recognition within the industry. Our Director of IT Security provides in-depth knowledge and experience, which is instrumental in developing and executing our cybersecurity strategies.


text: Monitoring Cybersecurity Incidents Our Director of IT Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have in place a detailed incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. In addition, our Director of IT Security is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition assists in the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management and governance.

companyName: Bumble Inc.

ticker: BMBL


text: Our Information Security Management System ("ISMS"), the foundation of our security framework, is designed to protect critical assets (including our users' personal information) and assess, identify, manage and mitigate material risks from cybersecurity threats.