text: Our board of directors holds oversight responsibility over Cryoport's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its audit committee. Our audit committee oversees the management of Cryoport's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds quarterly meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.


text: Within management, our Chief Information Security Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Our Chief Information Security Officer is supported by the Chief Information Officer or Information Technology Director, as applicable, of our business units with respect to the assessment and management of our material risks from cybersecurity risks on a day-to-day basis. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.

companyName: Cryoport, Inc.

ticker: CYRX

secItem: Item 1C


text: Our cybersecurity program provides what we believe is an effective level of protection of client information and of our operating systems while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we invest heavily in up-to-date information security and monitoring controls, which we believe provide the best mechanism to mitigate cybersecurity risks and threats. At the same time, cyberattacks are becoming increasingly common, sophisticated and destructive, and several highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. In order to mitigate these risks and the potential harm that may result, our Chief Information Security Officer, who reports directly to the Chief Operating Officer and who reports regularly to our Board's Audit Committee, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. We also maintain and periodically review our cybersecurity disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Company's Information Security Program encompasses the guiding policies over our cybersecurity risk management. Additionally, our IT team uses industry-leading tools to help protect stakeholders against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our Company team members are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.


text: Engaging Third Parties for Risk Management We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company.


text: The Company's Third-Party Relationship Risk Management ("TPRM") Policy governs of all aspects of third-party risk management. The Board has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to the Audit Committee and management regarding the Company's strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews the TPRM Policy on at least an annual basis and ensures that appropriate implementation procedures and practices have been established by management. The Chief Risk Officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company's strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. The Chief Risk Officer periodically provides reports to the Audit Committee on third-party risk management activities. The Company's Internal Audit department determines the frequency and scope of independent third-party audits of the TPRM program and its effectiveness.


text: The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.


text: We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.


text: The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks. The Audit Committee currently oversees risks relating to cybersecurity, technology, and finance, and in support of this objective, receives regular reports from the Chief Information Security Officer and other third party advisors, to assure the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The Audit Committee reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include cybersecurity and related risks and our exposure to those risks. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with its overall risk management framework.


text: The Chief Information Security Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. He reports quarterly to the Audit Committee on a range of topics, including: Current cybersecurity landscape and risks; Status of ongoing cybersecurity incidents, threats and strategies; Cybersecurity incident reporting and post-incident reviews; and Compliance with regulatory requirements and evolving industry trends.


text: The Chief Information Security Officer reports to the Chief Operating Officer, has a dotted line to the Audit Committee and the Chief Information Officer, and maintains independence in reporting on the status and impact of any information security related developments and strategic initiatives to the Audit Committee, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the Audit Committee, Chief Information Security Officer, Chief Information Officer, Chief Risk Officer and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company's internal Risk Management Steering Committee also reports directly to the Audit Committee regarding our risk management initiatives. The Audit Committee also receives quarterly reports from the Risk Management Steering Committee, the Company's Internal Audit department, and IT department in order to stay informed on all aspects of cybersecurity risk affecting the Company.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer, who has more than 20 years of cybersecurity experience working with large financial institutions and actively maintains multiple information security certifications. Additionally, our Chief Information Security Officer oversees our cybersecurity incident disclosure and communications. Our Chief Risk Officer separately chairs our Risk Management Steering Committee. Our Chief Risk Officer has served in her position since 2014 and is an accomplished banking professional with more than 40 years of experience in compliance and risk management.


text: The Company monitors cybersecurity events using multiple methods. The Company's 24/7 Security Operations Center ("SOC") has the ability to detect and respond to threats in real time and is authorized to shut threats down before they can harm the organization. Additionally, the SOC periodically performs pro-active "threat hunts," searching for potential indicators of compromise and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The Chief Information Security Officer is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The Chief Information Security Officer may determine that an incident has the potential to be materially relevant and would escalate that determination to the Cybersecurity Incident Disclosure Team comprised of the senior leaders, including the Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, outside counsel and other leaders and advisors to the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.


text: Reporting to Board of Directors The Chief Information Security Officer, in his capacity as such, regularly reports to management and the Audit Committee on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts and internal threat intelligence team. A team of dedicated privacy, safety, and security professionals oversees cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership of this team includes professionals with deep cybersecurity expertise, including our Chief Information Security Officer. Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: DarioHealth Corp.

ticker: DRIO


text: As part of our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We also conduct annual risk-based penetration testing and provide cybersecurity training for applicable employees. Where appropriate, we engage external advisors and consultants to assist with various aspects of our cybersecurity program and processes.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, our cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with our use of third-party service providers. Based on their risk profiles, we contractually require certain third parties with access to our information systems or data to maintain cybersecurity programs and to report actual or suspected security incidents to us. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors based on their criticality and risk profile, who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber incident. This plan is reviewed at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity risks and incidents, such as a breach of the Company's privacy or information security systems, or those of our vendors or other third parties, could compromise our information and expose us to liability, which would cause our business and reputation to suffer." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile. Our SVP of Technology, who reports directly to the Chief Financial Officer and has over 25 years of experience managing information technology and cybersecurity matters, is primarily responsible for leading the assessment and management of cybersecurity risks and reports periodically to the Audit Committee on cybersecurity strategy and risks. Our SVP of Technology stays informed about and monitors the prevention, detection, mitigation and remediation of security incidents through various channels, including but not limited to briefings from the operational team members, threat intelligence sources, and alerts from security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy AerSale has developed and implemented a comprehensive cybersecurity risk management program for identifying, assessing, and managing material risks to protect the confidentiality, integrity and availability of critical systems and information relevant to our business. Our program utilizes a risk-based approach and is designed based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), and shares common methodologies, reporting channels, and governance processes that apply across all areas of our enterprise risk management, including legal, compliance, operational, and financial risks.

companyName: AerSale Corp

ticker: ASLE


text: AerSale's comprehensive cybersecurity risk management program includes, among others: a security awareness training agenda with topics relating to phishing, spams, viruses, insider threats, suspicious activity and procedures to escalate them, as well as other safety concerns. Certain training programs are employee targeted based on their individual job responsibilities and on the potential risks associated with such roles.


text: internal and external assessments, including audits and response simulations, to examine cybersecurity vulnerabilities and potential attack vectors to company systems, as well as evaluating the impact of these vulnerabilities in our operational and financial posture. processes to identify and manage risks related to critical third-party technology providers. a cybersecurity incident response plan that includes procedures for responding to cybersecurity threats or incidents.


text: when appropriate, use of external subject matter specialists, including assessors, consultants, auditors or other third parties, to provide incident response services and to conduct independent assessments of internal response readiness. engagement in security practices that include physical, administrative and technical safeguards of systems and hardware.


text: We are not aware of any risks from cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to AerSale's Business and Industry—Our business could be negatively affected by cyber or other security threats or other disruptions" in Part 1, Item 1A "Risk Factors" in this Annual Report.


text: Our Board of Directors has overall responsibility for risk oversight, and has delegated the responsibility of cybersecurity and other information technology related risks to the Audit Committee of the Board of Directors, which oversees the implementation and continuous improvement of our comprehensive cybersecurity risk management program and compliance with disclosure requirements. The Audit Committee is provided with information, results of internal and external assessments, and updates on cybersecurity initiatives at Audit Committee meetings from our Chief Information Officer, and is responsible for reporting any findings and recommendations to the Board of Directors for consideration. Our team of cybersecurity professionals is led by our Chief Information Officer, a seasoned technology executive with over 20 years of experience in the cybersecurity field, a strong focus on systems and security, and a proven track record of leading cyber experts to protect organization from evolving threats. The cybersecurity team has the primary responsibility for AerSale's comprehensive cybersecurity risk management program, and supervises internal personnel as well as external cybersecurity consultants. Our processes are designed to prevent and monitor cybersecurity incidents, allowing us to timely detect and respond to incidents through our cybersecurity response plan, which includes materiality evaluations based on the size and scope of the incident. This evaluation is documented in an incident report that is shared with the Chief Information Officer, Chief Financial Officer and Audit Committee to effectively manage resources to reduce risk and prevent future incidents.


text: Cybersecurity threats pose a risk to the Company as crimes committed through or involving the internet. Examples of those threats are malware, phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into internal systems or the systems of third-party vendors that could adversely impact operations or damage reputations.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: We utilize third party service providers to support and facilitate business and operational activities to achieve strategic goals. However, third parties may expose us and our customers to various risks. We have implemented a Vendor Risk Management ("VRM") framework, which provides the tools and practices utilized in the oversight of third-party service providers, with an objective to meet legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values. For the 2024 period, there were no material incidents affecting the VRM framework or controls.


text: We have developed cybersecurity and data privacy programs designed to enable and safeguard the confidentiality, integrity and availability of our information systems and data by providing proactive security expertise and risk assessments, creating and maintaining a resilient and secure environment, and fostering a culture of security awareness and compliance throughout our organization. We maintain a robust Information Security Program that sets forth our commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing of, and protecting sensitive information, including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA).


text: The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable and resilient technology infrastructure, fostering a culture of technology risk awareness and continuously improving its technology risk management practices. Our process for monitoring and mitigating cybersecurity risk is designed in conjunction with our overall Risk Management Policy and Information Security Program. One of the key aspects of these programs are various risk assessments that are used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program. Annually, we engage a third party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements as well as a full-scope independent audit of IT and Information Security processes.


text: All of our employees also have a responsibility to protect the privacy of Company and Bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture. Additionally, the Company carries out regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.


text: The management of cybersecurity risks is ultimately the responsibility of Company management and is governed by the Board. They devote significant time and attention to the oversight of cybersecurity and information security risks. The Board through its BRC reviews monthly information technology and Information Security and Vendor Management reports that highlight key areas of focus and risk. The Board also reviews and approves the Information Security Program, the central program outlining cyber-security processes and controls annually and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends and best practices.


text: We are subject to extensive federal and state regulation of customer privacy and the security of financial information. Our federal regulator, the FDIC, is part of the Federal Financial Institutions Examination Council (FFIEC), which publishes extensive guidelines and examination procedures that are used to review the security of financial institutions.


text: To date, we have not experienced a cybersecurity incident or data breach that has materially affected us or our business strategy, results of operations, or financial condition.


text: The Company maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: The Bank's Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recover strategies to help mitigate the impact of a cybersecurity incident across all business lines.


text: Management Role and Board Oversight The cybersecurity programs are supervised by the Bank's Chief Information Security Officer (" CISO ") reporting to the Chief Risk Officer ("CRO") and dotted line to the Chief Information Officer. The Chief Risk Officer has reporting responsibility to the Board's Risk and Compliance Committee while the Chief Information Officer has reporting responsibility to the Board's Information Technology Committee. The Risk and Compliance Committee consists of eight directors, seven of whom are independent, while the Information Technology Committee consists of three directors, two of whom are independent and members of the Risk and Compliance Committee. The Company Board includes members who have expertise in cybersecurity, fraud, and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO who has a Ph. D. in Information Technology with a concentration in Information Assurance and experience in the information technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's knowledge and experience in the cybersecurity field are key to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards and disaster recovery, business continuity, and incident response efforts. Additionally, the Bank's CRO who leads the management risk function, has extensive experience in risk management.


text: The cybersecurity programs include a cross-function team of trained internal and external information security professionals, all of whom are required to maintain industry accredited certifications. We have an Incident Response Team chaired by our Chief Operating Officer that is comprised of executive management and designated managers, including the CISO. The purpose of our incident response plan is to manage incidents, including information security incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, notify customers, as required by law, comply with regulatory requirement and any third-party obligations.


text: The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Risk Management Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, and risk reporting. The CISO and CRO also provide a monthly overview of the cybersecurity landscape to the Board of Directors.


text: Managing Material Risks and Integrated Overall Risk Management The Company maintains documented processes, procedures, and controls for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity threats are identified utilizing risk assessments, detection tools, information gathering and performing internal, external, and third-party contracted security assessments.


text: To assess and manage cybersecurity threats, the Company maintains an Incident Response Team comprised of members from the major business areas in the Company to ensure appropriate subject matter specialists are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Company's business strategy, results of operations or financial condition by following implemented processes. The Company has not identified any cybersecurity threats that have materially affected operations or financial position.


text: Oversee Third-Party Risk The Company has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Company's vendor management program requires initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.


text: Cybersecurity Risks Management and the Board of Directors acknowledge that technology systems, managed both by the Company and third-party service providers, are critical to business operations and therefore require appropriate risk management.


text: Engagement with Third Parties on Risk Management Cybersecurity is an integral part of the risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Our internal audit function actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. Our external audit results are reviewed and reported in our annual filing and to the Board Audit Committee. Additionally, the Company and the Bank are regulated entities and undergo regulatory reviews to ensure the Company and the Bank are in compliance will all appropriate standards.


text: Cybersecurity Risk Management and Oversight We have processes for assessing, identifying, and managing cybersecurity risks, integrated into our overall risk management program and information technology function. These processes are designed to:

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Protect our information assets and operations from internal and external cyber threats, Safeguard employee, vendor, and collaborator information from unauthorized access or attack, and Secure our networks and systems.


text: Response plans for cyber incidents, Regular system testing and incident simulations, and Routine reviews of policies and procedures to identify risks and enhance practices.


text: To strengthen our cybersecurity risk management practices and oversight, we engage external consultants with expertise in information security, incident response, and governance. Additionally, we evaluate the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.


text: Board and Audit Committee Oversight We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially impact the company or its business strategy, operations, or financial condition. The Audit Committee provides direct oversight of cybersecurity risk and updates the Board of Directors on such matters.


text: Management delivers quarterly cybersecurity updates to the Audit Committee, with additional updates provided as significant new threats or incidents arise.


text: Operational Leadership and Incident Response Our Vice President of Information Technology, or VP of IT, leads company-wide cybersecurity strategy, policy, standards, and processes. This role includes working across departments to assess and address cybersecurity risks and participating in management's updates to the Audit Committee.


text: In the event of a cybersecurity incident, the VP of IT collaborates with the information technology department and relevant teams to assess and respond to the incident, determining the need for internal and external reporting.


text: Our VP of IT brings over 15 years of experience in cybersecurity, including serving as Chief Information Security Officer for a multinational company in the specialty materials industry. Our VP of IT has experience with compliance programs for cybersecurity-related regulations and standards.


text: Additionally, the VP of IT has participated in Gartner cybersecurity programs and conferences and received training on combating cyber threats, including phishing, malware, and social engineering.


text: Employee Training and Technology-Based Safeguards We provide annual data protection and cybersecurity training for all personnel, including full-time, part-time, and temporary staff. This program covers topics such as: Social engineering and phishing awareness, Password protection and mobile security, and Incident response and reporting.


text: Proactive cybersecurity monitoring for threat detection and swift response, Tools to address vulnerabilities and protect information assets, Endpoint security measures, geo-fencing, and geo-blocking on firewalls, and Automatic email prioritization to help our information technology department efficiently address the most critical threats.


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, products and our critical data (including intellectual property and confidential information that is proprietary, strategic or competitive in nature, and clinical trial data) (collectively, "Information Systems and Data").

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Our Executive Director of Information Technology, or IT, and other relevant personnel help identify, assess and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We (including the Executive Director of IT) use various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal audits, conducting threat assessments, conducting third-party threat assessments, and conducting vulnerability assessments.


text: Depending on the relevant information systems environment, we implement and maintain various technical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response measures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of certain data, network security controls, data segregation, access controls, asset management (such as tracking and disposal of our information systems), systems monitoring, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Executive Director of IT works with executive management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our Executive Director of IT and executive management also evaluate material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of our Board of Directors, or the Board.


text: We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats. These service providers may provide services related to: threat intelligence, cybersecurity practices, cybersecurity software, managed cybersecurity response, penetration testing, dark web monitoring, forensic investigation, and professional services (including legal counsel).


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We maintain a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes conducting a risk assessment or auditing for certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify, mitigate and manage cybersecurity risks associated with a particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the subsection titled " Our information systems, or those of others upon whom we rely (such as our CROs, contract manufacturers, contractors, consultants, service providers, collaborators and others) may fail or suffer cybersecurity breaches, loss or leakage of data or other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability that could adversely affect our business. "


text: Our Board performs oversight of our risk management process. The Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various standing committees of the Board that address risks inherent in their respective areas of oversight. In particular, the Board is responsible for monitoring and assessing strategic risk exposure, including a determination of the nature and level of risk appropriate for us. The Board is also focused on emerging risks, as well as risk mitigation strategies. As part of its risk mitigation duties, the Audit Committee monitors cybersecurity risk and mitigation of such risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Executive Director of IT, who has 26 years of experience developing and deploying network and data security policy and technology.


text: The Executive Director of IT and Chief Financial Officer, or CFO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key cybersecurity priorities to relevant personnel. The Executive Director of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members, including the CFO, depending on the circumstances. The CFO, Executive Director of IT, and Vice President of Finance work with our incident response team in an effort to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the Audit Committee of the Board for certain cybersecurity incidents.


text: The Audit Committee receives reports from the Executive Director of IT concerning our significant cybersecurity threats and risks, as well as the processes we have implemented that are designed to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: ZYNEX INC

ticker: ZYXIQ


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: We are establishing incident response, business continuity, and disaster recovery plans designed to more formally address our response to a cybersecurity incident.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct basic security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the System and Organization Controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company's incident response team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is an element of this program. Our cybersecurity risk assessment and management efforts are led by our Director of Information Technology, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our Director of Information Technology reports directly to our COO. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data, and we maintain a cybersecurity risk management program as a part of our overall risk management program that is focused on identifying, assessing and managing cybersecurity risk. Key elements of that program include: Alignment with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyberattacks; Engaging external cybersecurity experts in incident response development and management;

companyName: ELUTIA INC.

ticker: ELUT


text: An information security training program instructing company employees with access to our networks how to be aware of, and help defend against cybersecurity risks; Evaluating the cybersecurity risk of third party service providers; and Business continuity plans and critical recovery backup systems.


text: Our cybersecurity risk management program is supervised by our Director of Information Systems, who has over 20 years of relevant experience, and whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes, as well as managing the Company's information security and risk management awareness program.


text: Cybersecurity Incident Response Process We maintain and regularly update a cybersecurity incident response plan that outlines the steps we take to identify, investigate and take action in response to any potentially material cybersecurity incidents. Our incident response plan is designed to ensure that our Director of Information Systems and members of our senior management team are timely informed of and consulted with respect to any potentially material cybersecurity incidents.


text: Board Oversight of Cyber Risk Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, comprised solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risks and threats and provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. Periodic updates are provided to the Audit Committee on, among other things, our cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. We also engage third parties to periodically evaluate and audit aspects of our information security programs, including by conducting vulnerability assessments and penetration testing. These partnerships enable us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current. The results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.


text: We face a number of cybersecurity risks in connection with our business. Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We may also rely on information technology and third-party vendors to support our operations, including to collect and store sensitive data. Despite ongoing efforts to continued improvement of our ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.


text: Based on the information we have as of the date of this Annual Report, we do no t believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. See Item 1A, Risk Factors, of this Annual Report for further discussion of cybersecurity risks.


text: As a company that provides enabling platform technologies to advance the discovery, development and commercialization of next-generation cell therapeutics for customers, we are committed to protecting the confidentiality, integrity and availability of our and our customers' information assets. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats and cybersecurity incidents, as such terms are defined in Item 106(a) of Regulation S-K. Our exposure to applicable cybersecurity risks is described more fully under the Risk Factors in Item 1A in this annual report on Form 10-K. As described further below, we maintain a formal and comprehensive information security management framework informed by the National Institute of Standards and Technology ("NIST") cybersecurity framework and have implemented several dozen policies governing our information security program, which we revise and update annually. Our Board, including the Audit Committee of our Board, and our management team are actively involved in the oversight of our enterprise risk management program, of which cybersecurity represents an important component.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Monitoring and assessing cybersecurity risk is a critical part of our overall enterprise risk management ("ERM"). Our Board regularly discusses significant areas of risk, including those that may be related to cybersecurity, as necessary. We have designed and implemented an information security program tailored to our operations, the nature of our products and services, and the sensitivity of the data that we process. We have implemented cybersecurity risk management processes that include, for example, developing organizational understandings to manage cybersecurity risk, identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities, and developing a vendor risk management policy for assessing supply chain and vendor-related risks. As part of these processes, we have implemented an Incident Response Plan, which provides protocols for incident evaluation, including processes for notification and internal escalation of information to our senior management and the appropriate Board committees. Our Incident Response Plan is updated annually and tested in tabletop exercises.


text: We utilize the cybersecurity services of our IT MSP, which is a SOC that is operated 24/7/365 and monitors our devices and networks for malicious activity. In addition to antivirus endpoint protection on Company devices, our IT MSP also, for example, monitors IT system metadata around suspicious events, evidence of tactics, tools, or procedures used by attackers, and monitors remote privileged activity.


text: We engaged a third party to perform a cybersecurity audits in 2021 and in the fourth quarter of 2024. To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation, or financial condition. To date, we have not experienced a material cybersecurity attack, such as a cybersecurity threat, a ransomware attack, computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks, or system failures. The Company carries cybersecurity insurance and considers our coverage to be adequate.


text: Our Board, including the Audit Committee of the Board, and our management team are actively involved in the oversight of risks from cybersecurity threats.


text: Our Audit Committee discusses risks related to cybersecurity quarterly, and reports to the Board quarterly on such risks and events. Our Senior Director of Information Systems presents information to the Audit Committee regarding cybersecurity risks and events quarterly. The full Board also discusses cybersecurity risks and events annually. If there are direct risks rising to the level of potential materiality, the management team reports such risks and events to the Board.


text: Our Senior Director of Information Systems and our Director of Information Systems are responsible for day-to-day oversight of cybersecurity risk. The individual currently holding the position of Senior Director of Information Systems has held the role for two years, has sixteen years of experience in IT and software development (with eight of those years in management roles), and holds certification from MIT Sloan School of Management in cybersecurity risk management. The individual currently holding the position of Director of Information Systems—who reports directly to the Senior Director of Information Systems—was formerly an IT Audit Senior Associate at PricewaterhouseCoopers, performed security assessments as a consultant at PricewaterhouseCoopers, and passed his CISA exam (though certification is currently pending). These individuals are responsible for coordinating resources internally and externally regarding cybersecurity risk management and incident response, and they report directly to our Chief Administrative Officer.


text: Our management team has also established a Cybersecurity Incident Response Team (the "CSIRT"), which is comprised of our Chief Executive Officer, the Chair of the Audit Committee of our Board, our General Counsel, our Chief Administrative Officer, and our Senior Vice President of Human Resources. The CSIRT is also responsible for responding to cybersecurity incidents.


text: Cyber Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our broader information security policy, which is informed by industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security (CIS) benchmarks.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Security incident management processes designed to oversee, identify and manage security events and incidents, including a cybersecurity incident response plan and a managed 24/7 security operation center, which monitors all security events from endpoints and cloud services.


text: System lifecycle and management processes designed to oversee and manage systems and services used by Sagimet, including system assessments and the management of vulnerabilities. System protections including firewalls, endpoint protection, access controls and cloud-based security systems.


text: Annual cloud system assessments designed to help identify material cybersecurity risks to our critical systems, information and our broader enterprise Information Technology (IT) environment.


text: Cybersecurity awareness training for all users with access to our systems including employees, consultants and senior management, with timely relevant security topics, which include social engineering, phishing, password protection, protecting personal data and appropriate use of assets.


text: We have leveraged the support of a third-party data privacy organization to perform a risk assessment designed to identify, assess, and manage data privacy risks. Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf. This process includes a risk assessment process which is designed to oversee, identify and manage material cybersecurity and data privacy risks associated with systems, services and third parties.


text: To date, we have not experienced any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information technology systems and infrastructure. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Related to Cybersecurity Risks Our Senior Director of IT is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has over 15 years of experience as an information technology professional.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our audit committee, per the audit committee charter. Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. In addition, management alerts the audit committee of any material cybersecurity incidents. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.


text: Material risks of cybersecurity threats are integrated into the Company's overall risk management program and managed across the Company, utilizing internal and third-party expertise. To protect our information systems from a cybersecurity threat, certain tools have been implemented within our IT network to help prevent, identify, detect, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. The Company also leverages the services and tools of a third-party cybersecurity firm to identify, prioritize, assess, mitigate and remediate reasonably foreseeable cybersecurity risks and threats.

companyName: Westrock Coffee Co

ticker: WEST


text: To identify, detect and respond to a cybersecurity incident, we conduct proactive cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing, perform incident response capability reviews and exercises, conduct annual employee training, monitor emerging laws and regulations related to data protection and information security (including intellectual property) and implement appropriate changes. The Company has implemented a cybersecurity incident response plan that outlines the Company's process for preparing for a cybersecurity incident, detecting, analyzing, containing, eradicating and recovering from such incident, and provides guidance for post-incident analysis. Additionally, we have established a Cyber Incident Committee that is comprised of leadership across the Company's finance, legal, accounting, internal audit and IT organizations to provide guidance and monitor overall company cybersecurity.


text: When a cybersecurity incident occurs, the Company prioritizes responding to and containing the threat and minimizing any business impact as appropriate. Each incident is evaluated, to determine the operational and financial significance, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact. An incident that reaches a specific level of severity is reported to the Cyber Incident Committee within pre-determined time frames. In such instance, the Cyber Incident Committee monitors the incident through resolution and post-incident analysis.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional discussion of cybersecurity risks or the impact of previous cybersecurity incidents, see Item 1A. Risk Factors "Risks Related to Our Business" in this Annual Report on Form 10-K.


text: The Company's board of directors is responsible for overseeing the Company's risk management program and has designated its Audit & Finance Committee with specific responsibility for overseeing cybersecurity risks, among other risks. The Company's cybersecurity organization is led by our Director of Information Security ("DOIS"), who is responsible for assessing and managing material risks that result from cybersecurity threats, and reports to the Senior Vice President and Chief Information Officer ("CIO"). The CIO and the Audit & Finance Committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes.


text: Our DOIS has nearly a decade of experience within cybersecurity functions and his skillset includes security architecture and engineering, incident response and penetration testing. Our CIO joined the Company in 2023 and most recently served as CIO and VP at another large, publicly-traded organization and has held other vital IT positions over the course of his over 25 year career.


text: The Audit & Finance Committee regularly reviews our cybersecurity program with our CIO and management and reports to the Board of Directors. Cybersecurity reviews by the Audit & Finance Committee generally occur annually, or more frequently as determined to be necessary or advisable. Additionally, on a quarterly basis, members of the Audit & Finance Committee receive updates from our CIO regarding matters of cybersecurity, including, but not limited to, information on new and/or existing cybersecurity risks and management's response to such risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: AUDIOEYE INC

ticker: AEYE


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through an internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our products) and implement appropriate changes.


text: We have implemented incident response processes in the event of a cybersecurity threat. Such incident responses are overseen by functional leaders and internal experts. In the event of a cybersecurity threat, security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for potential privacy impact. As part of the above processes, we have engaged external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards and obtained a SOC 2 Type II report.


text: We describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security and privacy breaches, computer viruses, and cyber-attacks could harm our business, financial condition, results of operations, or reputation." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cyber and data security threats. Members of the Board or Audit Committee receive periodic updates from senior management regarding our cybersecurity processes and risks. Members of management that comprise our incident response team include the following officers (or those with similar responsibility): Senior Director of Information Technology, Chief Operating Officer, Chief Financial Officer, Customer Success (if customers are affected), and Vice President of Human Resources (if employee data is affected). As part of our internal response policy, upon confirmation of a breach, a remediation process is initiated, led by our Principal Privacy Officer who chairs an incident response team. This team may include members from relevant departments such as Product Development, Information Technology, Finance, Legal, Marketing, Client/Customer Services and Human Resources, any other relevant units or departments affected by the breach and any additional personnel as deemed necessary.


text: The Principal Privacy Officer is responsible for overseeing the determination of whether a breach occurred, coordinating with third parties handling protected information, and ensuring compliance with legal obligations. Forensic investigators, provided through AudioEye's cyber insurance or as deemed necessary by the Principal Privacy Officer, will analyze the breach to understand its cause and extent. A communication plan will be developed by Marketing, Legal, and Human Resources to inform internal employees, the public, those directly affected, and regulatory authorities, as necessary to help ensure all notifications comply with relevant laws and regulations.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.

companyName: Hughes Satellite Systems Corp


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, cybersecurity maturity assessments, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have not experienced cyber-attacks or other malicious activities that materially disrupted our business. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business. We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Senior Director of Cybersecurity Infrastructure and Threat Hunting, Corporate Cybersecurity leads our information security organization responsible for overseeing our information security program. This individual has over 20 years of experience in various roles involving security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: We anticipate that we will continue to evaluate and address as needed our cybersecurity risk management, policies, structure, strategies and governance to meet our needs.


text: Legacy relies on information technology infrastructure and architecture, including hardware, cloud computing networks, software, people, and processes to manage protected, confidential, and personally identifiable information. Our business is at risk from, and may be impacted by, cybersecurity threats and incidents, including but not limited to attempts to gain unauthorized access to our systems or data. Similar threats and incidents may impact third parties with which we do business. We have invested and continue to invest in cybersecurity and data protection efforts, including technical, administrative, and organizational safeguards designed to protect our systems and data. However, we acknowledge that a future cybersecurity incident could materially harm our business, operating results, and financial condition.

companyName: Legacy Housing Corp

ticker: LEGH


text: The Company's cybersecurity efforts are directly overseen by our Director of Information Technology, who reports directly to our Chief Executive Officer. The Company's Board of Directors is made aware of cybersecurity incidents and threats, as appropriate, pursuant to corporate policy.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Our Vice President of Information Technology ("VP of IT") with assistance from our third-party managed services team, legal, quality, finance and human resources, identifies, assesses and manages the Company's cybersecurity threats and risks. The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual and automated tools, analyzing reports of threat actors, conducting scans of the threat environment, evaluating threats reported to us and coordinating with law enforcement concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; disaster recovery and business continuity plans; implementation of security standards; network security controls; access controls; system monitoring; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified by the Company's senior management team. Also, IT consultants work with management to follow the National Institute of Standards and Technology framework for cybersecurity to mitigate cybersecurity threats that are more likely to lead to a material impact on our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms including outside legal counsel, cybersecurity consultants, threat intelligence service providers, managed cybersecurity service providers and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, reviews of vendor's written security program and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our collaborators, contractors, consultants or other third parties with whom we work, may fail or suffer security breaches, which could result in a significant disruption of our product development programs and can lead to adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; reputational harm; loss of revenue or profits; loss of customers or sales; disruption of our business operations."


text: Our board of directors and audit committee addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Financial Officer and our VP of IT who has over 40 years of experience in information technology and cybersecurity and manages the Company's information technology infrastructure.


text: The VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The VP of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The VP of IT works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have implemented and maintain a cybersecurity risk management program that includes processes designed for the identification, assessment and mitigation of cybersecurity risks in order to protect the confidentiality, integrity and availability of our critical systems and information. We have designed and assessed our program based on the Center for Internet Security (CIS) Controls standard and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: security controls and mitigation measures designed to manage and mitigate material risks from cybersecurity threats to our critical systems and information;


text: an IT and security team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and mitigation measures, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, IT and security personnel and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk-based approach to identifying and overseeing third party cybersecurity risks, including evaluating the cybersecurity processes of service providers and other vendors, and reviewing available security certifications and independent audit reports.


text: Although, to our knowledge, we have not experienced any material cybersecurity breach to date, we may experience cybersecurity incidents and face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see "Item 1A Risk Factors."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other IT risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives reports from management on our cybersecurity risks at least semi-annually. In addition, management updates the Audit Committee regarding cybersecurity matters, as necessary, including any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities and the full Board periodically receives briefings from management on our cybersecurity risk management program.


text: Our management team is responsible for assessing and managing risks from cybersecurity threats. The Vice President, Global IT and Senior Vice President, Risk and Internal Controls have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. They provide briefings to the management team, including the Chief Financial Officer/Chief Operating Officer and the General Counsel and Secretary, as well as the Board and the Audit Committee. Their briefings include topics such as threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us. The briefings also cover alerts and reports produced by security tools deployed in our IT environment. Our Vice President, Global IT has over 20 years' experience leading teams in cybersecurity, and designing and securing critical IT infrastructure in the healthcare, biotech and sports entertainment sectors. Our Senior Vice President, Risk and Internal Controls has more than 30 years' experience designing, implementing and leading risk management, internal control and compliance programs, including cybersecurity, data privacy and business resilience, in global organizations.


text: ISG maintains a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and the Company's client-facing products. We regularly assess the threat landscape, taking a holistic view of cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: Information Services Group Inc.

ticker: III


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology. ISG performs annual assessments, by two independent third parties, against the International Organization Standardization ("ISO") 27001 Information Security Management System requirements for which we maintain certification. ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials. In 2024, the Company achieved a System and Organization Controls 2 ("SOC2") Type 1 against our GovernX platforms, and we are preparing to continue maturity in this area by seeking to attain SOC2 Type 2 in 2025.


text: The Company's cybersecurity efforts are led by the Chief Information Security Officer (" CISO "), who reports to the Chief Information Officer ("CIO") and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has proven cyber operations and cyber risk management experience, having previously worked for UK law enforcement and leading organizations in the financial services, health and advertising sectors. Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional. The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cybersecurity disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents. Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board ("IEB") and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee ("ISC").


text: Cybersecurity is an important area of focus for our Board of Directors. The Board of Directors reviews and discusses with our CIO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, any significant cybersecurity incidents, and the emerging threat landscape. Our CIO discusses the same cybersecurity topics covered with the Board of Directors with the IEB. In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives.


text: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely our Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager. The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high-rated incidents to help align our risk exposure with our strategic objectives. The ISC meets quarterly and receives additional ad-hoc briefings from the CISO as and when required.


text: In the event of a major security incident, certain members of the ISC form part of our Incident Management Team ("IMT"). The IMT follows our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership, the IEB and the Board of Directors, as appropriate.


text: For the evaluation of our security controls, ISG engages third-parties services to conduct penetration testing, independent audits or provide consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of our security controls. We also share and receive threat intelligence which we utilize to bolster defenses against active threats. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across our security domain.


text: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, through the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network. We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable. We seek to work directly with any suppliers to address potential deficiencies when identified.


text: To mitigate the risk and negative exposure of personal data being breached or inadvertently shared outside of ISG, we maintain a data protection framework that includes policies, procedures, guidance and records. This includes policies and procedures regarding the rights and usage of personal and client data. ISG employs a Data Privacy Manager who briefs the ISC on privacy matters as part of the quarterly ISC meetings. The Data Privacy Manager completes an internal audit annually and works with a specialist third party to complete an external Data Protection Compliance review.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating cybersecurity threats or incidents, and such threats or incidents may have a material adverse effect on us. While ISG maintains cybersecurity insurance, the costs related to cybersecurity threats or service disruptions to both ISG and our clients may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see the risks identified under "Risks Related to Data, Cybersecurity and Confidential Information" found in "Part 1A, Risk Factors" of this Annual Report on Form 10-K.


text: As a Company selling some products and performing engineering services for defense applications, we may be the target of cyber-attacks from a variety of threat actors. Cybersecurity threats include attacks on, or other attempts to infiltrate, our information technology (IT) infrastructure and the IT infrastructure of our customers, suppliers, subcontractors and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, including attacks targeting the security, confidentiality, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure.

companyName: Vuzix Corp

ticker: VUZI


text: Our Cybersecurity Program Our products and services are normally classified as EAR 99 (items not designated under the control) by the U.S. government, but our defense customers may ask us to make some alterations for the environments in which the products will be used. Moreover, our products sold for defense applications are integrated with our customers' products. Given the nature of our business and the cybersecurity risks we face, we have instituted a cybersecurity program for identifying, assessing, and managing cybersecurity risks, which include material risks from cybersecurity threats to our internal systems, our products, services and programs for customers, and our supply chain.


text: Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operations. We, or third parties we contract with, monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications. Incident Response.


text: Our cybersecurity program includes monitoring for potential security threats that may lead to vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage an incident response team based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and/or the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident response process is also designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis. Third Party Service Providers.


text: We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery. Our main external service provider is US-based and utilizes a 24 x 7 x 365 Service Operation Center (SOC). Program Assessment.


text: We regularly evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board of Directors with the annual assessment by a third party on the Company's cybersecurity program.


text: Cybersecurity risks are also included with the Company's annual business risk assessment which is provided to the Board of Directors.