text: We, our clients and our vendors are regularly the target of attempted cyber-attacks, and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Such cybersecurity incidents could lead to disruptions in our systems; the unauthorized release or destruction of our or our clients' or other parties' confidential or otherwise protected information; and corruption of data. We regularly re-evaluate, modify and enhance our information security processes as new technologies emerge or new risks are identified. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operating results, cash flows or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk factors - Risks Relating to Our Business - We face risks from cyber-attacks, breaches of digital security, IT system failures and network disruptions that could adversely affect our reputation and our business." for more information about these risks.


text: Our Company has a dedicated team of technology professionals who consistently monitor risks related to cybersecurity. Our Corporate Vice President and Chief Information Officer, as well as our Chief Information Security Officer ("CISO") are responsible for managing our information technology ("IT") security program. Our CISO is a Certified Information Systems Security Professional (CISSP), holds a Masters Degree in Computer Information Systems, and has over 20 years of relevant expertise in assessing and managing cybersecurity risks. Their teams are responsible for leading an enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. To identify and address potential information security risks, we use a defense-in-depth methodology that employs multiple, redundant defensive measures and outlines actions to take in the event of a security control failure or vulnerability exploitation. To protect the Company from cybersecurity threats, we utilize a combination of internal resources and external consultants and providers. These consultants and providers provide services such as penetration testing, incident response, and third-party assessments. In addition, we use a combination of both proprietary and commercial solutions to proactively manage and mitigate threats to our IT environment and these processes have been integrated into the Company's overall risk management system.

companyName: VICOR CORP

ticker: VICR

secItem: Item 1C


text: Our CISO oversees security, including the corporate IT environment, our public cloud presence, and security standards that are used as a framework for managing security across our Company. Our CISO is also responsible for security awareness, administering our corporate security training, and sponsoring our cybersecurity policy and standards. Our cybersecurity plan is reviewed annually, and our Audit Committee has delegated to the Executive Security Incident Response Team which is made up of our Chief Financial Officer, a Board member and senior management representatives in the legal, IT and finance functions, oversight of our cybersecurity program. The Executive Security Incident Response Team receives regular updates directly from our CISO and Vicor product security experts from various business and operational areas. We maintain various security certifications across the Company, and part of our compliance program includes processes to oversee and identify material risks from cybersecurity threats and include the use of third-party service providers to perform regular audits to ensure our security management program remains current.


text: Our objective for managing information security and cybersecurity risk is to avoid or minimize the impacts of both internal and external threat events and other efforts to penetrate or otherwise compromise the confidentiality, integrity, or availability of our systems. We work to achieve this objective by hardening networks and systems against attack, and by diligently managing visibility and monitoring controls within our data and communications environment to recognize events and respond appropriately.


text: To keep the Executive Security Incident Response Team apprised of the continually shifting landscape, the CISO typically provides quarterly updates to the Executive Security Incident Response Team on information security and cybersecurity matters. The Executive Security Incident Response Team maintains oversight of the efforts made to maximize information security and cybersecurity efforts. Potential concerns related to information security and cybersecurity will be escalated to the Board of Directors and Audit Committee, as appropriate.


text: Our cybersecurity infrastructure undergoes external audits. These efforts demonstrate our commitment to maintaining the highest level of cybersecurity protection. Our external third-party providers also evaluate and rank our cybersecurity maturity and coverage as part of their services. To stay informed about emerging threats, we regularly consult with external providers and other sources such as government publications and notices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Vicor Corporation maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We face risks associated with security breaches through cyberattacks, cyberintrusions or otherwise, and other significant disruptions of information technology networks and related systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Risk Factors in Part I, Item 1A for a disclosure of our cybersecurity risks. We continue to monitor cybersecurity risks to prevent and mitigate materially negative impacts on the Company's reputation, financial performance, customer or vendor relationships and potential litigation or regulatory investigations or actions.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: As part of its regular oversight of risk management, our audit committee is responsible for the oversight of cybersecurity risk and threat mitigation related to our information technology and information systems including protection and security of employee and customer data. Our Senior Vice President – Technology Solutions is responsible for the day-to-day management of our cybersecurity program and reports directly to our President. Our Senior Vice President – Technology Solutions has served in this role for over four years and has more than 25 years of experience in the aggregate, including more than ten years with the Company, in various information technology roles. Our audit committee is responsible for overseeing cybersecurity risks, and our management team reports to our audit committee on the Company's cybersecurity program, current cybersecurity projects and industry trends and efforts to mitigate cybersecurity risk on at least a semi-annual basis.


text: We have designed and implemented a comprehensive program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed this program based on the National Institute of Standards and Technology cybersecurity framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We monitor and regularly assess our cybersecurity risks and adjust our program accordingly.


text: We maintain a cybersecurity incident response plan which outlines our response and action in the event of a major cybersecurity incident. The cybersecurity incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to varying levels and personnel within the Company depending on the severity of the threat, effectively communicating to stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the Senior Vice President – Technology Solutions would, as soon as practicable, inform the Cybersecurity Incident Response Team, the members of which would then collaborate with the Senior Vice President – Technology Solutions to manage material risks.


text: We have adopted and require employees to abide by our personally identifiable information policy to help protect personal employee, vendor and tenant information. Employees are required to complete regular cybersecurity training and education annually, which is followed-up with quarterly testing and re-training, as necessary.


text: We contract with an independent cybersecurity provider to perform an annual cybersecurity risk and vulnerability assessment. We regularly test areas of potential vulnerability, utilizing penetration testing, ransomware-focused disaster recovery tests as well as testing exercises for other higher risk areas.


text: We conduct annual reviews of third-party hosted applications where sensitive Company data is shared. Additionally, cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.


text: We maintain cybersecurity risk insurance coverage; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Risk Management & Strategy Wesbanco generally approaches cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to Wesbanco; (ii) maintaining the confidence of its customers and business partners; and (iii) preserving the confidentiality of its customers' and employees' information. Wesbanco's Information Security and Cybersecurity program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. The bank also partners with trusted security vendors to enhance incident response capabilities, evaluate framework and compliance assessments, provide continuous monitoring, provide guidance on strategies, evaluate compliance with existing laws and regulations, design and implement cyber policies and procedures, and provide threat intelligence services.

companyName: WESBANCO INC

ticker: WSBC


text: As detailed in Item 1A "Risk Factors - Risks Related to the Use of Technology", third-party technology relationships pose a risk to the organization. As such, third-party risk management processes are aligned with regulatory requirements and are another key focus area within the bank's enterprise risk management framework. Wesbanco employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Wesbanco's sensitive information, systems or networks. This process is also intended to provide for the security and integrity of Wesbanco's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Wesbanco's information assets and reducing the overall risk of cyber threats. Third-party providers are evaluated during onboarding and throughout the ongoing relationship based on the level of risk that the service being provided presents to the organization. The evaluation process includes a thorough review of operational practices related to cybersecurity and considers factors that impact the protection of bank and customer data.


text: Wesbanco continues to foster a risk averse focus and leverages various threat intelligence sources to continually evaluate current and future risks to the organization. The bank invests in continuing education of the security team and in technologies that help protect its systems and data. Required security awareness training is provided to all employees to ensure that corporate policies are understood and followed. The bank's cybersecurity strategy and roadmap are frequently evaluated and updated according to multiple inputs including any tangible cybersecurity incidents. Incident Management and Response is led by a cross functional incident response team that handles critical incidents inclusive of cybersecurity incidents. In addition to handling critical incidents, the response team coordinates an annual tabletop exercise aimed at continually practicing documented incident response processes. These tabletop exercises include participation from executive leadership and periodically members of the board of directors. The Incident Response team is chaired by the Chief Security Officer and membership of the Incident Response team includes representation from Human Resources, Information Technology, Fraud and BSA, Corporate Communications, Risk Management, Investor Relations, Retail Banking, Compliance, Bank Operations, Legal Counsel, Customer Support, and Digital Banking and Payments.


text: Cybersecurity threats, a security strategy roadmap, and key risk indicators are shared with management and the board of directors through both committee reporting structures and periodic reports of the Chief Security Officer. In addition, management updates our Enterprise Risk Management Committee, as necessary, regarding significant cybersecurity incidents. Our Enterprise Risk Management Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Technology Governance Committee, a management level steering committee also receives periodic reports from the Chief Security Officer for security risk assessments, security program effectiveness evaluations, occurrence and response to cyber incidents, effectiveness of mitigation strategies, regulatory compliance, and external assessments and benchmarking. As part of the Enterprise Risk Management Framework, cybersecurity oversight also utilizes the concept of three lines of defense which allows for multiple challenge response processes to continually mature the cybersecurity program. Cybersecurity best practices from the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") are used to establish, operate, and validate security controls.


text: The Enterprise Risk Management Committee is a board-level committee focusing on enterprise risk, including cybersecurity risks. Multiple directors have decades of experience, not only in the banking sector, but also have been responsible for cybersecurity and technology departments at larger organizations. The Chief Security Officer is responsible for providing the Information Security strategy and operational planning for the overall Information Security program, and has decades of experience in the industry, advanced education degrees, and holds industry standard technical and security certifications. Several members of the Information Security team also hold multiple security certifications that tie directly to their job responsibilities. These certifications include, but are not limited to, ISC2 Certified Information Systems Security Professional (CISSP), ISACA Certified Information Systems Auditor (CISA), ISACA Certified Information Security Manager (CISM), EC-Council Certified Ethical Hacker (CEH), CompTIA Security+, CompTIA CySA+, CompTIA CASP+, and CompTIA PenTest+.


text: While Wesbanco and its third-party providers have in the past experienced cybersecurity incidents, Wesbanco is not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect Wesbanco, including its business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Interruption to Our Information Systems or Breaches in Security Could Adversely Affect Wesbanco's Operations." for additional detail.


text: Our cybersecurity risk management program is designed to assess, identify, and manage material risks from potential unauthorized breaches of or access to our electronic information systems, and the information we store on our systems. Our program includes a wide variety of mechanisms, controls, technologies, methods, systems and other processes as further described below that are designed to prevent, detect, or mitigate unauthorized access, data loss, theft, misuse or other security incidents and vulnerabilities affecting our systems and the information we store on our systems. The information we store includes confidential, proprietary, business, and personal information of ours, our customers, our employees and other third parties that we collect, process, store and transmit as part of our business. Our program is aligned with the National Institute for Standards and Technology Risk Management Framework (NIST RMF), other industry-recognized standards and our contractual requirements. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds and other similar resources to inform and guide our cybersecurity processes and resource allocation. Additionally, we use processes and third-party technologies to oversee and minimize impact to our data, including two-factor authentication, encryption, Company secured email and dedicated cybersecurity support personnel.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Our cybersecurity risk management strategy is led by our Chief Information Security Officer (CISO) and a team of information security and other professionals, as detailed further below, who are responsible for implementing and maintaining our cybersecurity data protection practices. This team works in close coordination with the Audit Committee of our Board of Directors, which is responsible for oversight of cybersecurity risk, senior management and other business functions and teams across the Company to identify threats by performing risk assessments and analyzing effectiveness of controls against identified risks.


text: As part of our risk management process, our cybersecurity risk management team oversees our vulnerability management practices and conducts routine application security assessments, yearly penetration testing, periodic security audits and ongoing risk assessments designed to identify cybersecurity risks to our environment. We continue to leverage third-party services for security operations through a dedicated managed security service provider to monitor and respond to cyber threats. This provider plays a critical role in, mitigating threats to our environment, as well as alerting and responding to events and incidents in close coordination with our internal team. For example, this provider performs searches across live and historical data to provide analysis based on threat intelligence and use cases to develop trends and data models to reduce false positives and enhance search criteria for future use. In addition to our routine practices, we also conduct testing, audits and assessments in connection with acquisitions, the implementation of new software, processes or activities requiring changes in our information technology environment, new cybersecurity events or developments and receipt of new risk intelligence. Further, we have adopted an enterprise-wide cybersecurity training and awareness program requiring all employees to complete annual cybersecurity training. The program is supported with monthly education and simulations with remedial training assignments to increase user awareness.


text: We maintain an incident response plan (IRP) aligned with NIST RMF when responding to incidents. The IRP sets out a coordinated approach to investigating, containing documenting and mitigating incidents. Our CISO, with oversight from our Chief Information Officer (CIO), is responsible for executing the relevant cybersecurity incident response plan, which includes response criteria for materiality, applicable requirements for incident disclosure and reporting and escalation procedures to various individuals and departments, including our Audit Committee, key stakeholders, and senior management, including our General Counsel, Chief Financial Officer and Chief Executive Officer, for risks with a potentially material impact for responding to cybersecurity incidents. In addition to our in-house team and third-party security operations services, we also engage assessors, consultants, auditors and other third parties from time to time to assist with assessing, identifying, and managing cybersecurity risks. For example, we leverage third-party security and compliance companies with subject matter expertise in these areas for threat identification and remediation. We continue to work with the U.S. Department of Defense on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks, including through participation in the Department of Defense's collaborative information sharing. We also partner with other work groups to support understanding and deployment of the Cybersecurity Maturity Model Certification (CMMC) to promote readiness in complying with cybersecurity requirements for handling CUI and federal contract requirements.


text: As of December 31, 2024, we were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Cybersecurity and Data Privacy Oversight Montrose maintains a dedicated cybersecurity team, led by our CISO and reporting to our CIO. Our CIO has deep expertise in cybersecurity and data management, as well as technical strategy and infrastructure, as part of his over 20 years of experience serving in this and similar roles across multiple organizations. Furthermore, our CISO is a Certified Information Security Manager (CISM) and brings over 25 years of experience in information technology, governance, compliance, and risk management.


text: The CISO is responsible for developing and deploying Montrose's overall cybersecurity and data privacy strategy, policies, procedures, and threat detection and response actions, with the support of Montrose's cybersecurity team. The cybersecurity team implements Montrose's cybersecurity and data privacy policies and procedures, including governance, compliance, and risk management practices, to safeguard Montrose's information systems and data. Collectively, the CISO and the cybersecurity team manage and evolve Montrose's cybersecurity posture with the objective of preventing cybersecurity incidents and increasing system resiliency to minimize business impact should an incident occur.


text: At the management level, Montrose's Enterprise Cybersecurity Council, consisting of our CIO, CISO, Director of Information Security, Director of Infrastructure, and senior security architects and engineers, meets monthly to review and assess cybersecurity risks and evaluate performance metrics to identify areas for continual improvement and system strengthening. Furthermore, the Council reviews project implementation status for targeted cybersecurity measures and tracks employee cybersecurity training completion and phishing email response rates. Council members have extensive cybersecurity experience and hold certifications including CISM, Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH) and Cisco Certified Network Associate (CCNA).


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. The Audit Committee maintains delegated oversight of cybersecurity risks, bringing in third-party expertise as needed to advise on cybersecurity infrastructure, policies, and practices. Our CIO and CISO brief the Audit Committee quarterly, at a minimum, on Montrose's cybersecurity risks, business-impacting incidents, and ongoing and future cybersecurity project implementations. In addition, the Audit Committee's third-party cybersecurity advisor meets regularly with the CIO and CISO to review our cybersecurity strategy and our continued progress toward meeting our objectives. The full Board of Directors receives quarterly updates from the Audit Committee regarding its oversight of cybersecurity risks and is also periodically briefed on our cybersecurity risk management program directly by our CIO and CISO.


text: In accordance with our Incident Response Plan, in the event of a potentially material cybersecurity event, the Audit Committee as well as our General Council, Chief Financial Officer, and CEO would be notified, briefed, and involved in oversight of mitigation, reporting, and recovery measures as appropriate.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I. Item 1A. "Risk Factors—General Risks—Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity risks including oversight of management's implementation of our cybersecurity risk management program. Pursuant to its charter, the audit committee's oversight of the integrity of our information technology systems and cybersecurity risks includes the review and assessment with management of the adequacy of controls and security for our information technology systems, processes and data, as well as our contingency plans in the event of a breakdown or security breach affecting our information technology systems.


text: As part of its oversight, the audit committee will receive reports from management on our cybersecurity risks including any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The audit committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, management may from time to time directly provide the full Board with briefings on our cyber risk management program, including presentations on cybersecurity topics from our Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Vice President of Information Technology and Security Officer, who reports to the Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Vice President of Information Technology and Security Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Information Technology and Security Officer's experience includes 15 years of experience across digital and cyber defense, and has most recently led the cyber function for the last six years at two emerging biotechnology companies.


text: Our management team takes efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have implemented a risk-based approach designed to identify, assess and manage cybersecurity threats that could materially affect our business and information systems. We attempt to identify and assess risks from cybersecurity threats by evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, and completing third-party cybersecurity threat assessments.

companyName: Annexon, Inc.

ticker: ANNX


text: We use cybersecurity consultants and penetration testing firms in an effort to identify, assess, and manage material risks from cybersecurity threats. We use third-party service providers in various elements to our business operations such as data hosting providers. To help manage cybersecurity risks associated with our use of third-party service providers, we primarily engage with industry-preferred service providers, and we also contractually require service providers with access to personal, confidential, or proprietary information to maintain data security controls and practices.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, or availability of our information technology systems or data, and those maintained on our behalf, could lead to adverse consequences that materially adversely affect our business, including, without limitation, regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, loss of customers or sales, fines and penalties or lawsuits."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee is responsible for advising on our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and risk management processes are managed by certain members of our management, including our CFO (who has prior experience in strategic business operations). Our CFO has supervisory responsibility over IT and cybersecurity functions. Our management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, helping prepare for and respond to cybersecurity incidents, and reviewing security assessments and other security-related reports. Our incident response team is responsible for remediating cybersecurity incidents of which they are notified.


text: We maintain a cybersecurity policy, reviewed with our audit committee, which is designed to address cybersecurity risks to us (including by escalating certain cybersecurity incidents to members of management and the board of the audit committee, in each case depending on the circumstances). We also maintain incident response procedures designed to assist us in responding to cybersecurity incidents.


text: We recognize the critical importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us. Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews. Cybersecurity is also one of the initiatives we have identified to guide our ongoing corporate sustainability efforts. Our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), has day-to-day responsibility for our cybersecurity programs. Given the significant risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

companyName: Repay Holdings Corp

ticker: RPAY


text: Risk Identification and Assessment We employ structured processes and procedures to identify and assess cybersecurity risks and events. Our CISO oversees a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk. The cybersecurity risk assessment receives input from cross-functional teams across our organization. We also engage various third parties (including penetration testers, auditing firms and managed security service providers) to assist in identifying and assessing material cybersecurity risks.


text: Our cybersecurity-related risks are managed using a combination of documented policies and procedures, management oversight and security systems and hardware. Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually. As part of these policies and procedures, we maintain a Security Incident Response Plan (the "SIRP") that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business. During the past year, we conducted a tabletop exercise with our executive management team that simulated a cybersecurity incident to evaluate the effectiveness of our SIRP, identify potential improvements and enhance our incident response readiness.


text: Employee and contractor compliance is bolstered by hiring, onboarding and termination procedures that are designed to align with cybersecurity objectives. All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis. We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.


text: We utilize a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards. Our systems include third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.


text: We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. These firms also provide educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.


text: As an important part of our cybersecurity programs, we perform defined due diligence procedures prior to engaging with new vendors. The level of due diligence varies depending on the materiality, level of risk and complexity of the arrangements. The vendors' financial condition, information security programs and regulatory reporting are also typically reviewed and considered prior to entering into a vendor agreement.


text: Risks from Cybersecurity Threats While we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial conditions, we do expend significant resources (including cyber insurance costs) to address the ongoing risks from cybersecurity threats. We believe these risks could be material in light of the sensitive data that we collect, process and store in the operation of our business. See "Risk Factors" above.


text: Our board of directors established a technology committee (the "Technology Committee") to oversee the risks from cybersecurity threats. The Technology Committee is currently comprised of three independent directors and chaired by Maryann Goebel, who was awarded the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD). Our CTO works closely with the Technology Committee to develop the meeting agenda and to prepare the relevant materials for each committee meeting. The Technology Committee typically reviews an updated version of the cybersecurity risk assessment program (described above) at each meeting. The Technology Committee receives and reviews cybersecurity incidents that are reported in accordance with the SIRP and our other procedures. The Technology Committee typically meets on a quarterly basis. The Chairperson of the Technology Committee makes a regular report to our board of directors following each meeting of the Technology Committee. Our board of directors retains ultimate responsibility for the oversight of the major risks inherent in our business, including risks from cybersecurity threats.


text: We have established a Security and Privacy Steering Committee to provide governance, oversight and leadership in matters relating to information security and privacy within our business. The Security and Privacy Steering Committee's responsibilities include policy development, risk management, compliance with relevant laws and regulations, incident response, ongoing monitoring and improvement of information security and privacy practices. The Security and Privacy Steering Committee is chaired by the CISO and co-chaired by our Director of Compliance (who serves as our privacy officer). The membership of the Security and Privacy Steering Committee is comprised of individuals from cross-functional teams with expertise and responsibilities in information security and privacy, including representatives from our legal department, our finance department and various units within our technology department. Our CTO also currently serves as a member of the Security and Privacy Steering Committee.


text: Our CISO is responsible for managing any cybersecurity incidents under the SIRP and coordinating with our senior management. The SIRP includes a process under which senior leaders from our information security, legal and accounting teams will assess the impact and significance of a cybersecurity incident to determine any necessary external notifications or filings. The SIRP also contains parameters regarding the requirements and timing for notifications of certain cybersecurity incidents to our board of directors.


text: Our CISO has served in various roles in information security, information technology and engineering operations for over 25 years. Our CISO holds an undergraduate degree in electronics and communications engineering, and he has attained a professional certification in leadership from a leading graduate school. He also maintains a Certificate Information Systems Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2). Our CTO holds an undergraduate degree in management and information systems, and he has served in various technology roles for over 30 years. Our CTO's prior experience includes serving as the Chief Information Officer and Chief Information Security Officer of a public company and as Chief Technology Officer of a separate public company.


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Seer, Inc.

ticker: SEER


text: We design and assess our program based on recommendations from trusted sources, such as the National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001. In 2024, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology (IT) environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for managing the risk inherent to engaging with external service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - If we, or our vendors, partners or customers, experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from the Audit Committee on our cybersecurity risk management program.


text: The Audit Committee receives regular reports from our VP of Information Technology on our cybersecurity risks. In addition, our VP of Information Technology updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: We have established an internal cross-functional Steering Committee and a leadership committee with the objective of overseeing the cyber security program, incidents, risks and initiatives. The Steering Committee is chaired by our VP of Information Technology and is comprised of leaders from Software Development, Research and Development and Data teams. The Steering Committee oversees the cybersecurity program relevance and effectiveness through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment. Updates from the Steering Committee are provided quarterly to an executive leadership committee, which is chaired by our VP of Information Technology and is comprised of the President and Chief Financial Officer, Chief People Officer, Chief Data Officer, Chief Operations and Product Development Officer and the SVP of Product Development.


text: The IT management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our VP of Information Technology has over 20 years of experience managing global IT operations, including strategy, information security, applications, infrastructure, support and execution.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our clients' and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management ("ERM") program, which is managed by the Senior Vice President General Counsel. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite.


text: Our ERM program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process when identifying and assessing material risks. Our ERM team collaborates with internal subject matter specialists, as necessary, to gather insights and report on the most significant risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to identify threats and improve our incident response plan.


text: We identify and assess cybersecurity incidents based on multiple factors including information from previous events and incidents. The Cybersecurity Incident Response Team ("CSIRT") categorizes events into four levels of severity with defined requirements to assess criticality. The CSIRT informs both our leadership as well as our SEC Cybersecurity Rules Disclosure Committee ("SCRDC"), Cybersecurity and Privacy Council and the Audit Committee of the Board on matters related to cybersecurity risks that are deemed to materially affect the Company.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes created by artificial intelligence). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework.


text: We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance, including review of past cybersecurity incidents in order to address known vulnerabilities. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks.


text: We are also in the process of simplifying our technology landscape and implementing several new cybersecurity technologies that will help improve the management of cybersecurity risks and threats. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial (including no related penalties and settlements).


text: Our global cybersecurity and privacy program is managed by our Chief Technology and Information Security Officer ("CISO"), Vice-President of Global IT Security, Global Chief Privacy Officer ("CPO"), and Chief Information Officer ("CIO"). We have also established a Cybersecurity and Privacy Council, which comprises our senior management team, including our CEO. The Cybersecurity and Privacy Council meets on a quarterly basis with the CISO, CPO and CIO to keep our CFO, General Counsel and other executive leadership informed of cybersecurity activities and new risks and requirements. The objective of this council is to review, discuss, and manage cybersecurity and privacy risks and threats, prioritize risks, monitor risk mitigation progress, advise and update on the evolving legal landscape, as well as provide visibility into ongoing activities and programs.


text: The Board of Directors provides oversight and has designated primary responsibility to the Audit Committee who oversees our information security programs including cybersecurity and is actively involved in monitoring the progress of key cybersecurity initiatives. The CISO manages the cybersecurity program in collaboration with the CIO, CPO, and our business leaders. The CISO provides updates to the Audit Committee quarterly, including progress on the cybersecurity initiatives, risk trends and scores, and any cybersecurity incidents. Executive leadership and the Board of Directors are regularly informed and updated on any potentially material incidents.


text: We also created a SCRDC composed of members from cybersecurity, privacy, legal, audit, and finance teams. This committee's objective is to review and discuss the nature of cybersecurity and privacy incidents and determine impact and materiality.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO, CPO, CIO, and VP of Global IT Security. Our security, privacy, and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. These leaders have relevant degrees and certifications, including Certified Information Systems Auditor, Certified Information Systems Security Professional, Fellow of Information Privacy, and Certified Information Privacy Professional. As described above, we have experienced professionals in the key roles of the CISO, CPO, CIO, and VP of Global IT Security. The cybersecurity and privacy offices are responsible for incident reporting and management, which includes cybersecurity threats. The Incident Response team, comprising key cross-functional professionals and stakeholders globally, meets weekly and as needed to identify, respond, contain, and coordinate events where activities threaten the security, confidentiality, integrity, and availability of our information, including client information and information systems.


text: Once an event materially impacts systems or data, these cross-functional professionals and stakeholders evaluate the incident using key factors (e.g., type and scope of information impacted, systems impacted, reputational impact) and promptly inform senior leadership, the Audit Committee and the Board of Directors. Further, we may consult outside counsel or external advisors given the circumstances and situation (e.g., client, controls, location, or regulatory landscape).


text: The Board's Audit Committee oversees risks relating to cybersecurity threats and the steps management takes to monitor and control such exposures. In addition to other written policies and procedures, the Company has instituted an Information Security Incident Response Plan ("IRP") which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents. Our IRP includes detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be executed from detection to assessment to notification and recovery, including internal notifications to the Audit Committee as appropriate. These incidents may consist of any actual, threatened, suspected, or reported event or occurrence that may affect the confidentiality, integrity, or availability of Company systems or data, or of any such event affecting a third party that may affect Company systems or data. T he objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders. The Audit Committee receives regular reporting from senior officers (such as the Chief Information Security Officer and the Director of Risk Management & Insurance) on operational risk and the steps management has taken to monitor and control these risks. Such reporting includes updates on the Company's IRP, the external threat environment, and the Company's programs to address and mitigate the risks associated with the cybersecurity threat environment. The IRP and internal controls around cybersecurity are periodically evaluated by external experts and the results of those reviews are reported to the Audit Committee.

companyName: BRUKER CORP

ticker: BRKR


text: The Company has established a corporate-level global Information Security Incident Response Team ("ISIRT"), which provides a centralized, coordinated response to, and management of, cybersecurity incidents that may present significant risk to the Company's operations, valuation, brand or reputation, employees, and customer or business relationships. The Company's cybersecurity response team is comprised of multiple subject-matter experts, including information technology, cybersecurity and risk management members with a combined experience of well over 60 years. Core members of the ISIRT consist of the Vice President, Financial Operations and Project Management ("Financial Ops"); Senior Vice President, General Counsel, and Corporate Secretary ("General Counsel"); Chief Information Security Officer ("CISO") who reports to the Chief Information Officer ("CIO"); Chief Privacy Officer ("CPO"); Vice President, Corporate Treasurer ("Treasury"); Director, Risk Management & Insurance ("Risk Management"); and Cyber Security Manager ("Information Security"). If a cybersecurity incident warrants activation of the ISIRT, the Company's Financial Ops and the General Counsel will notify, as appropriate, the Company's executive leadership and the Audit Committee. We also engage specialized third-party consultants to proactively support our cybersecurity efforts, which include but are not limited to, application and network security, information risk management, as well as business continuity and disaster recovery.


text: Cybersecurity incidents may occur at, or be reported to, any of the Company's facilities worldwide. The Company has an IT Service Desk which acts as the single point of contact for cybersecurity incident reporting. Employees can notify the IT Service Desk of any event that they observe or is reported to them that may constitute a cybersecurity incident. Once notified, the IT Service Desk team conducts an initial classification and escalates, when needed, to the CISO and other members of ISIRT as per the Company's IRP. Financial Ops, in consultation with the General Counsel, CPO and CISO, decide whether to activate the ISIRT in connection with any escalated incident. When activated, the ISIRT coordinates and directs all aspects of the response, including, as applicable, investigation, containment, business continuity and recovery, remediation, notifications, communications, and post-incident activities with executive leadership, including the CIO, and the Audit Committee and/or Board of Directors, as appropriate in the circumstances. As of December 31, 2024, no identified risk has required activation of the ISIRT.


text: In addition, our third-party service providers play a role in our risk management and strategy as well as with the investigation of cybersecurity incidents. Based upon the assessment of the type of incident and risk presented, the ISIRT engages outside counsel and/or external resources, such as forensic consultants, to conduct or assist with cybersecurity investigations in order to provide advice to the Company. The vendors we engage with are globally recognized companies with expertise in cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards. The Company also conducts appropriate cybersecurity exercises and training. For example, employees must complete cybersecurity training on at least an annual basis, which educates our employees on the Company's policies and procedures for handling personal data, incident reporting, and avoiding common cybersecurity threats such as phishing attacks.


text: For a discussion of information technology rights that may materially impact us, see Item 1A "Risk Factors—We rely on information technology to support our operations and reporting environments. A security failure of that technology, including with respect to cybersecurity, could impact our ability to operate our businesses effectively, adversely affect our financial results, damage our reputation and expose us to potential liability or litigation."


text: Our cybersecurity risk management strategy and processes, which are integrated into our overall risk management process, for assessing, identifying and managing material risks from cybersecurity threats are designed based on established frameworks and standards developed by the National Institute of Standards and Technology ("NIST"). Although this does not mean that we currently meet all technical standards, specifications, or requirements, we use this framework, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity defense strategy based on prevention, detection and containment. We employ industry standard measures directly or indirectly related to cybersecurity, such as multifactor authentication, endpoint protection defenses, antivirus protection, encryption standards, restricting access based on business necessity, and remote access monitoring. Our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. We engage third parties to conduct penetration testing and evaluate our adherence to industry-standard frameworks. We assess the security framework employed by our third party service providers including their reports on security, availability and confidentiality to assess and identify material risks from cybersecurity threats associated with our use of third party applications. We have also established liaison programs with the Federal Bureau of Investigation ("FBI") and U.S. Cybersecurity & Infrastructure Security Agency ("CISA") to monitor, identify, and counter advanced persistent threats specific to our company and industry. As part of this program, we have an FBI Special Agent assigned as our Liaison Officer who provides us with periodic cybersecurity threat briefings, and also provides counter-threat support on request.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Annual Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."


text: Governance of cybersecurity risk management Our Board of Directors, acting through the Audit Committee, is responsible for overseeing management's implementation and execution of the risk management process, including our cybersecurity risk management strategy and processes. Our Audit Committee reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team with substantial relevant experience in designing and managing our information technology infrastructure and system, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.


text: As trusted partners to healthcare providers, patients, biopharmaceutical companies, academic and non-profit institutions, business partners and employees, we appreciate the importance of maintaining a comprehensive and trustworthy information security program. Our information security program is fully integrated into our operations, and a hallmark of our program is its cross-functional approach with our internal privacy objectives and stakeholders.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: Our cybersecurity program is based on the ISO 27001 security controls set, and in particular, it focuses on the principles of confidentiality, integrity and availability. We maintain an ISO 27001 certification with a fully integrated set of operational policies and procedures to adhere to the domains of ISO 27001. This includes but is not limited to the organization of information security to assign roles and responsibilities within Adaptive, access control to restrict employees' access to view only that information that is relevant to their roles, information security incident management, and compliance to broadly ensure alignment with applicable laws and regulations. We perform an annual risk assessment conducted by an outside assessor and conduct vendor risk assessments for third party vendors to evaluate how their systems may impact our business in the event of a cybersecurity incident. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.


text: The internal body with executive oversight of our cybersecurity program is our Privacy and Information Security Steering Committee ("PISSC"), which applies a multidisciplinary framework to cybersecurity risks and risk assessment by integrating information security, privacy and human resources expertise, oversight and reporting. The PISSC is made up of our Privacy Officer, Chief Operations Officer (who is also acting as head of our security team), Chief Financial Officer, General Counsel and Chief People Officer and meets on a quarterly basis. Julie Rubinstein, who serves as our Chief Operations Officer, is leading our security team on an interim basis and is supported by a fractional chief information security officer.


text: Our board of directors is kept apprised of cybersecurity risks and assessments through regular presentations to the Audit Committee regarding our information security and privacy governance and reports on information security and privacy incidents. Cybersecurity threats, including as a result of any past cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see the "Risk Factors" section.


text: Cyber Risk Management and Strategy We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following: • implementing the latest software releases and tools (including multi-factor authentication) in a timely manner; • seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers; • constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats; • third party internal and external vulnerability assessments and penetration testing; • annual review and audit of cyber controls and procedures; • periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology; • periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties; • security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements; • employee anti-phishing campaigns performed at least quarterly; • a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and • a cybersecurity risk insurance policy.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, there is no guarantee the measures and security we have implemented will be successful in detecting and preventing a cybersecurity incident. Please refer to Item 1A of this Annual Report on Form 10-K for more information regarding additional risks related to cybersecurity and information technology.


text: Cyber Governance Cybersecurity holds a pivotal role in our comprehensive risk management processes and is a key focus for both our Board and management. Our management has primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents. However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.


text: The Board receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.


text: Led by our Director of Information Technology and Security ("Director of IT") with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.


text: Innovex maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") and the Cybersecurity Framework. Innovex has an annual assessment, performed by a third party, of the Company's cyber risk management program against the NIST Cybersecurity Framework. Innovex contracts a Cyber Security Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. An annual incident response drill is in place to prepare support teams in the event of a significant incident. Cyber partners are a key part of Innovex's cybersecurity infrastructure. Innovex partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Innovex engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Innovex's environment.

companyName: Innovex International, Inc.

ticker: INVX


text: Innovex's VP of IT reports to Innovex's Chief Financial Officer and is the head of the Company's cybersecurity team. The VP of IT is responsible for assessing and managing Innovex's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Innovex. The Audit Committee of the board of directors oversees Innovex's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The IT department briefs the Audit Committee on the effectiveness of Innovex's cyber risk management program, typically on a semiannual basis. In addition, cybersecurity risks are reviewed by the Innovex board of directors, at least annually, as part of the Company's corporate risk mapping exercise. Innovex faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Innovex has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Innovex's business, financial condition, results of operations, or cash flows. See "Item 1A. Risk Factors—Risks Related to Technology Advancement—We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss" and "Item 1A. Risk Factors—Risks Related to Technology Advancement—We have experienced IT system disruptions and cyber attacks in the past, and a failure of our IT infrastructure and cyber attacks could adversely impact us in the future."


text: As a company that collects and retains large volumes of customer and employee data, including payment card numbers and other personally identifiable information, we face significant and persistent cybersecurity risks. The protection and integrity of that data is important to us, which is demonstrated by the significant efforts and investments made to implement various measures to manage the risk of a security breach or disruption.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Risk Management and Strategy Assessing, identifying, and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. The program ensures regulatory compliance in alignment with Federal Financial Institutions Examination Council, the Sarbanes-Oxley Act of 2002, and the Gramm-Leach-Bliley Act. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program.


text: The Board of Directors holds ultimate responsibility for overseeing cybersecurity and information security risks. They dedicate substantial time and attention to this critical area, leveraging the technical expertise of their members. The Board regularly reviews an Enterprise-Wide Risk Report, which includes key cybersecurity risk measures and trends across the Company. Additionally, the Board annually reviews and approves the Information Security Policy and frequently receives presentations from the Chief Information Security Officer ("CISO") on cybersecurity risks, industry trends, and best practices.


text: The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company's enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.


text: The Board of Directors is also responsible for the approval and oversight of the Information Security ("IS") Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.


text: All of our employees also have a responsibility to protect the privacy of bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture.


text: We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements.


text: We depend on third-party service providers to support our business and operational activities and to help us achieve our strategic goals. However, these third parties can introduce various risks to us and our customers. To mitigate these risks, we have established a Third Party Risk Management framework. This framework equips us with the necessary tools and practices for effective oversight of third-party service providers, ensuring compliance with legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values.


text: Our vendor risk management practices are robust and include comprehensive risk assessments of suppliers, with a strong emphasis on cybersecurity. We use commercially available services to monitor our vendors, providing security scores for supplier technology services, threat intelligence, financial intelligence, and other cybersecurity-related considerations. Regular reviews are conducted to track changes in our vendors' cybersecurity risk posture, and continuous threat intelligence monitoring helps identify potential cybersecurity incidents involving third parties. We also strive to negotiate appropriate cybersecurity provisions in our vendor contracts.


text: For the 2024 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, see Item 1A. "Risk Factors," including the risk factor titled "An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses."


text: We recognize that cybersecurity threats have been increasing in number and severity in the general marketplace and in our industry. In an effort to address the threat landscape, we maintain a cybersecurity risk management strategy that is designed to identify, assess, manage, and address cybersecurity threats that may have a material impact on our business. Our cybersecurity risk management strategy includes various policies and components, including cybersecurity assessments, an incident response plan, evaluation of the security practices of our key vendors, and cybersecurity awareness training for our staff.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: We engage a third-party to conduct a cybersecurity risk assessment on an annual basis, which is informed by the National Institute of Standards and Technology, or NIST Cybersecurity Framework. We have established a process for our IT security team to track and quantify known IT security risks and our remediation efforts through a cybersecurity risk register. The IT security team meets periodically to review and update the cybersecurity risk register based on feedback across the organization and the findings contained in our NIST-informed annual cybersecurity risk assessment. The IT security team reports on findings on at least an annual basis to the executive leadership team and the board of directors.


text: We have established a process to review and assess vendors' security posture and practices prior to their onboarding. Vendors that access, store or process our data are required to respond to a cybersecurity questionnaire and provide applicable security audit reports and certifications. Our process also includes contractual requirements to maintain data protection safeguards for vendors that process data on our behalf.


text: We maintain a security awareness training program for employees, which is provided through digital microlearning assignments. We also provide additional mandatory trainings, including phishing training, throughout the year.


text: We maintain a Written Information Security Program, or WISP, that defines our organization's cybersecurity policies and procedures. This covers all aspects of cybersecurity, including but not limited to risk management, third party security assessments, security awareness training, acceptable use, endpoint security, patch management, log management, backup and recovery.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected, and we do not believe they are reasonably likely to materially affect, our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber-attacks or other failures in our telecommunications or IT systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations" in Item 1A- Risk Factors.


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by relevant members of our executive leadership team on at least an annual basis.


text: Our executive leadership team meets with our Head of Global Information Technology, along with other members of our IT security team as needed, to discuss cybersecurity matters, such as the emerging cybersecurity threat landscape, significant developments to our cybersecurity processes, and our cybersecurity risk assessments. Senior management is thus kept abreast of the cybersecurity posture and potential risks facing our company. Our cybersecurity incident response process is designed to proactively triage, contain, investigate, mitigate and correct all incidents at the direction of the Head of Global Information Technology. Critical incidents are assessed for materiality, and escalated to the executive leadership team for awareness, direction and approval as needed. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, as needed, to provide oversight and guidance on critical cybersecurity issues.


text: Our IT security team, led by the Head of Global Information Security, Governance and Architecture ("Head of Global ISGA"), is responsible for managing and directing the day-to-day information security strategy of the organization, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of Global ISGA reports to our Head of Global Information Technology. The Head of Global ISGA routinely reports on cybersecurity risks, projects, and initiatives to the Head of Global Information Technology, who regularly reports to executive management and the audit committee on these matters as described above.


text: The Head of Global ISGA maintains a Certified Information Systems Security Professionals, or CISSP, certification and has more than two decades of IT security management experience. The IT security team is supported by external vendors that provide managed services for network support, security operations and other IT areas as needed. Our IT security team also meets regularly with our Global Privacy Committee, which oversees our Enterprise Data Protection Program, to coordinate on cybersecurity initiatives and strategy related to protection of personal data.


text: We recognize the importance of maintaining the trust and confidence of the patients we serve, our business partners, employees and our shareholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Our cybersecurity practices, policies, and standards are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") (NIST SP 800-53), the Center for Internet Security ("CIS"), along with adopting best practices from Control Objectives for Information and Related Technologies ("COBIT") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.


text: We may face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, which could adversely affect our business and operations. To identify and assess material risks from cybersecurity threats, we maintain a robust cybersecurity program to ensure our systems are effective and prepared for information security risks and have integrated these processes into our overall risk management systems and processes. We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, CIS, and COBIT, as well as by engaging experts to attempt to infiltrate our information systems. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools, services and capabilities, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling, disaster recovery and business continuity planning activities, red team testing, mandatory training for our employees, and tabletop exercises to inform our risk identification and assessment.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our vendors, CROs, suppliers and/or manufacturers who may have access to patient and employee data or our systems. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct continuously through third-party risk management tools.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants and other third parties, including a bi-annual review of our cybersecurity program by an independent Qualified Security Assessor.


text: In the last three fiscal years, we have no t experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, cybersecurity threats, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation," in Item 1A. Risk Factors, which disclosures are incorporated by reference herein.


text: Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our Board delegates to the Audit Committee oversight of certain aspects of our risk management process, including risks related to information technology, data privacy and cybersecurity.


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes, including recent cybersecurity incidents and related responses, cybersecurity testing, activities of third parties, and other similar matters. Our cybersecurity risk management and strategy processes are led by our Data Security Officer, Data Privacy Officer, Chief Financial Officer and General Counsel. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.


text: Our Audit Committee is encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. We have processes in place to ensure that our Audit Committee shall receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials ("Information Systems and Data").

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Our officers and our IT vendors help identify, assess and manage our cybersecurity threats and risks. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating threats reported to us.