text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal information technology systems, or those of our third-party contract research organizations, contract manufacturing organizations and other contractors and consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability, and could adversely affect our business, results of operations and financial condition".


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee within the board of directors' is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Turnstone Biologics Corp.

secItem: Item 1C


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Director, who has over 24 years of IT management experience for public companies including Synergy Pharmaceuticals, Inc.


text: Our information security function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO and information security function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.


text: The board committee receives periodic reports from our information security function (including our IT Director) concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: We design and assess our program based on the core principles of the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a lead IT person principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business, financial condition, and results of operations may suffer in the event of information technology system failures, cyberattacks, data security incidents, or deficiencies in our cybersecurity."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program.


text: Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The CFO has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology personnel and our retained external cybersecurity consultants. Our management team's cybersecurity experience is limited.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Policy statements and regulations by state and federal bank regulators indicate that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. For example, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations after a cyberattack involving destructive malware.

companyName: TC Bancshares, Inc.

ticker: TCBC


text: On April 1, 2022, a final rule issued by federal financial regulatory agencies became effective – that rule imposes upon banking organizations and their service providers notification requirements for significant cybersecurity incidents. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident" as those terms are defined in the rule. Banks' service providers are required under that rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.


text: Additionally, effective December 9, 2022, the FTC's amendments to the GLBA's Safeguards Rule went into effect. That rule requires financial institutions to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors. Additionally, multiple states and Congress are considering laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data. Risk management and strategy.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer Committee (ISOC) is primarily responsible for this cybersecurity component. The ISOC is chaired by the Company's Chief Financial Officer with oversight by a third-party information security specialist. In addition, the ISOC members include our Chief Information Officer along with external technology and internal business resources. The ISOC makes quarterly reports to the board of directors.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Officer, who reports directly to our Chief Financial Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to executive management and/or the Board of Directors. The Incident Response Plan is coordinated through the Chief Information Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity events in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors. Governance.


text: Our Chief Information Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Financial Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience, as well as third-party information security specialists. In particular, our Chief Information Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management. In addition to the ISOC, our board of directors has created the Information Technology Steering Committee, These committees provide oversight and governance of the technology program and the information security program. These committees include the Chief Financial Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire Company. The Information Technology Steering Committee meets on a quarterly basis. The ISOC generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Information Technology Steering Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Information Technology Steering Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Officer provides quarterly reports to the Information Technology Steering Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually.


text: Cybersecurity is a significant and integrated component of Cullman Savings Bank's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, we have not, to our knowledge, experienced an incident materially effecting or reasonably likely to materially affect Cullman Savings Bank.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: To prepare and respond to incidents, we have implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. We engage third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.


text: The Information Technology (IT) Department of Cullman Savings Bank is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The IT Department is managed by the Vice President IT ("VP IT"). She has more than 13 years of experience with Cullman Savings Bank and a degree in Management Technology. The VP IT also oversees our Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and brings awareness, accountability, and oversight for data protection throughout Cullman Savings Bank. Our program and with trusted third parties help ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going threat assessments, addresses the latest threats and conducts penetration, business continuity/ disaster recovery testing, and incident response plan testing. The VP IT presents information security and cybersecurity updates on a weekly basis to the Operations Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer and the Information Security Officer (ISO).


text: The Operations Committee provides oversight, from a risk perspective, of information systems security. As referenced above, the VP IT provides information security updates to the Operations Committee at each scheduled meeting. In addition, as discussed below, we have implemented an Incident Response Plan (IRP) to provide a structured and systematic incident response process for information security incidents that affect any of our information technology systems, network, or data. The IRP is implemented and maintained by the VP IT and is subject to annual review and approval by the Compliance Committee and Board.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: Risk Assessment. On a quarterly basis, the VP IT identifies and documents system internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, our Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Compliance Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Reducing unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Documenting, approving, and testing changes to security configurations. • Assessing and removing or disabling exploitable files and services based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers with respect to security maintenance and reporting responsibilities in accordance with contract provisions and that service providers provide notification of system security breaches that may affect us.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to our risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: Service Providers. Like many companies, we rely on third-party vendor solutions to support our operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, we maintain a Third-Party Risk Management Program, which is implemented through a Vendor Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive data. The Vendor Management Policy applies to any business arrangement between Cullman Savings Bank and another individual or entity, by contract or otherwise. The Vendor Management Program is audited as part of our annual Internal Audit Risk Assessment.


text: Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Cullman Savings Bank and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection/prevention systems, endpoint protection, network monitoring, multi-factor authentication, and data backups. Notable services include 24/7 security monitoring and response, vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the Board reviews the overall status of the Information Security Program and The Corporation's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes. violations.


text: Program Adjustments. The VP IT monitors, evaluates, and adjusts the Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan (IRP). In our effort to ensure that information security incidents can be recovered from quickly and with the least impact to The Corporation and its customers, The Corporation maintains a structured and systematic IRP for all information security incidents that affect any of the IT systems, network, or data of The Corporation, including The Corporation's data held, or IT services provided by third-party vendors or other service providers. The VP IT and the ISO are responsible for implementing and maintaining the IRP, which includes: • Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training to employees and board of directors. • Reviewing the IRP at least annually, or whenever there is a material change in The Corporation's business practices that may reasonably affect its cyber incident response procedures.


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our residents and other stakeholders, as a top priority. Our board of directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and resident information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and updates are presented to our board of directors and members of management, as appropriate.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.


text: We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our response to—a cybersecurity incident.


text: We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting resident and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Our Chief Financial Officer is responsible for managing cybersecurity risk. With the assistance of outside consultants, he develops mitigation strategies and implements controls to reduce the likelihood of a cybersecurity incident occurring as well as to reduce the impact of any such incident, should it occur. At least annually, he discusses cybersecurity risk and the Company's mitigation efforts and effectiveness of controls with the Audit Committee of the Board of Directors, which is the committee that has primary responsibility for overseeing our risk assessment and is composed solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risk and reviews the tests of controls performed by consultants that perform the internal audit function. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full Board of Directors.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: As of December 31, 2023, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have implemented controls to protect our data and information systems and monitor our systems on an ongoing basis, such efforts may not prevent material compromises to our information systems in the future, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and procedures.


text: While we have control over our information systems, we do not have control over the information systems of our hotel manager, Our Town, or of our franchisors. Although we set expectations for Our Town and our franchisors, we rely on them to manage the cybersecurity risk to which they are subject. Our hotel manager maintains separate cybersecurity insurance coverage to offset a portion of potential costs incurred from a security breach.


text: We currently do not have a cybersecurity incident response plan with respect to our data and information systems. We rely on Our Town and their cybersecurity consultants as well as our franchisors, to maintain cybersecurity incident response plans applicable to their systems and hotel-level systems they manage on our behalf.


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors - We and our manager rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."


text: Cybersecurity Risk, Management, and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Bank's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition.

companyName: BV Financial, Inc.

ticker: BVFL


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes advanced employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third Party Risk Management, and Incident Response.


text: Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees are the first line of defense against cybersecurity measures. Every employee is responsible for protecting Bank and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data.


text: As indicated above, supporting our operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. Accordingly, the Company engages third-party consultants and independent auditors to conduct penetration tests, external audits, program enhancement where applicable and review of cybersecurity risk assessments.


text: The Company has established an Information Technology Steering Committee consisting of department leaders. The committee focuses on strategic and tactical delivery as well as policy oversight. All such policies are approved by the board of directors. All Information Security activity is led by the Information Security Officer.


text: The Company employs a cybersecurity policy which it believes is appropriate for the potential of cybersecurity threats faced by it. The Company does not have possession of personally identifiable patient information from its clinical trials, nor does it have information with respect to third party credit or banking information. Accordingly, the threat is limited to disruption of ordinary business operations. The Company's information systems and maintenance are delegated to independent information technology and cybersecurity consultants, with at least 10 years of experience advising similarly situated companies on information technology and cybersecurity risk management, who report to the Company's Chief Financial Officer, who reports in turn directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversite. The Company has never been affected by cybersecurity incidents.

companyName: REVELATION BIOSCIENCES, INC.

ticker: REVB


text: The Company's information systems employ storage and recovery services from various third parties, including Microsoft, as its cloud service providers, which provides an additional level of protection from cybersecurity threats.


text: Risk Management and Strategy Daily, we are threatened by system intrusions, social engineering attempts and web application attacks. These threats and attempts are directed at payment data, employee credentials, system passwords and personal information. We have developed and implemented a risk-based framework to address them. We consider cybersecurity a top risk within our enterprise risk management protocol, which is subject to oversight by our Board of Directors.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Our risk-based processes, as designed, seek to maintain physical, administrative and technical controls that protect the confidentiality, integrity and availability of our information systems and information stored on our network, including customer information, personal information, intellectual property and proprietary information.


text: We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for our cybersecurity framework. This does not imply that we meet any technical standards, specifications or requirements under the NIST CSF, only that we use the NIST CSF as a framework to help us identify, assess and manage cybersecurity risks related to our business. Our policies for overall general information technology controls are also influenced by the Control Objectives for Information and Related Technologies, which align with the NIST CST.


text: Our key cybersecurity processes are organized into four primary categories: • Outage and access: these processes address system intrusion and credential and password threats and risks; • Payment and loyalty rewards: these processes protect the information of our customers; and • Personal data: these processes protect the payroll and healthcare data of our current and former employees and vendor information. • Vendor partner security: these processes review the infrastructure and security processes of vendor partners that process transactions, provide cloud-based solutions and provide the backbone for our data flow.


text: Key elements of our cybersecurity processes include, but are not limited to, the following: • Firewalls, data encryption and tokenization, multifactor authentication and data backup, among other safeguarding tactics; • Routine tests of our back up processes, the physical security of our data storage and access to systems via penetration testing; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • Training and testing of the diligence and awareness of our employees regarding social engineering email and other cybersecurity schemes and risks; • Engaging third-party cybersecurity companies periodically to assess our cybersecurity posture and assist with identifying and remediating cybersecurity risks; and • Contractual commitments from vendor partners and a review of controls at vendor partners via System and Organization Controls reports.


text: Our Board of Directors oversees and guides our business and oversees our exposure to major risks. As stated in its charter, our Board of Directors has delegated to the Audit Committee the responsibility for Board-level oversight of cybersecurity risk. As part of its oversight role, the Audit Committee receives reports about our protocols, material threats or incidents and other developments related to cybersecurity. When these discussions occur, Board members with cybersecurity acumen that are not on the Audit Committee are present and active in those discussions.


text: These cybersecurity reports are provided to our Audit Committee at least annually, and these reports are delivered by our Senior Vice President and Chief Information Officer ("CIO"). Our CIO has over 30 years of experience with our information systems and is versed in cybersecurity frameworks and best practices. A security committee assists the CIO with developing controls, selecting vendor partners, identifying emerging threats and implementing best practices within our risk-based framework. Our security team is comprised of professionals with cybersecurity certifications and specialized training. The CIO addresses how we allocate capital resources to our cybersecurity processes with our executive leadership team, which includes our Chief Executive Officer, Chief Operating Officer, Chief Merchandising Officer and Chief Financial Officer. The CIO reports directly to our Chief Operating Officer.


text: Process to Access, Identify and Manage Material Risks from Cybersecurity Threats When a cybersecurity incident occurs or we identify a vulnerability, our CIO and our security committee, which is described in more detail under "Governance" above, are responsible for leading the initial risk assessment, and external experts may also be engaged and our Audit Committee or full Board may also be consulted. If a breach of our control structure were to occur, our executive leadership team, Audit Committee and counsel would be briefed by the CIO and a determination would be made on whether such issue is material to warrant disclosure.


text: As of February 3, 2024, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, cash flow or financial condition.


text: Even with our current control processes and a continuous improvement mindset, cybersecurity threats constantly evolve. If the measures we have employed were to fail, or if a breach were to occur, it could result in impairment or loss of critical functions, such as the operation of our e-commerce websites, our Evansville distribution center, our corporate network and/or our point-of-sale systems, as examples. Additionally, confidential information could be compromised or we could be defrauded or ransomed for a material amount of funds. Any of these outcomes could negatively affect our reputation and customer loyalty. The ultimate effects of a breach or loss in function or confidential information are difficult to quantify with any certainty, but such loss may be partially limited through insurance. See "Risk Factors—We could be adversely affected if our inventory technology systems fail to operate effectively, are disrupted or are compromised", "—Various risks associated with our e-commerce platform may adversely affect our business and results of operations" and "—We outsource certain business processes to third-party vendors and have certain business relationships that subject us to risks, including disruptions to our business and increased costs" in PART I, ITEM 1A of this Annual Report on Form 10-K, which risk factors are incorporated by reference into this section of this Annual Report on Form 10-K.


text: Our current digital age has seen a remarkable growth in information technologies that allows for greater connectivity capabilities and faster sharing of data and information than ever before. These rapid advances in technology have been of great benefit to organizations like our own, which seek to deliver cutting-edge and life-enhancing solutions for our customers. In our pursuit of these objectives, we acknowledge and take seriously our responsibility to maintain the highest level of confidentiality, integrity, and availability of data belonging to our customers, prospects, external partners, and internal workforce members, and to protect our critical information technology systems and infrastructure against current and ever evolving cybersecurity threats and attacks.

companyName: Hyperfine, Inc.

ticker: HYPR


text: It is our organization's aim to comply with all cybersecurity and data privacy laws and regulations in applicable jurisdictions. Additionally, we are committed to meeting national and international standards and best practices for our industry for effective cybersecurity risk management of the organization's confidential information and critical IT infrastructure. Our cybersecurity and data protection policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or "NIST", and other applicable industry standards and frameworks such as HITRUST and SOC 2. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the data that we collect and store, and information systems and technologies through which that data is processed, by identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents when they occur. Our organization's internal administrative, technical, and physical security measures (controls) are tested for compliance to these frameworks and reviewed annually. The domains and controls associated with these frameworks are tested and reviewed annually. Certifications of compliance, and/or Auditor's 'Letters of Opinion' Attestation of Compliance from the applicable auditors are provided once the audits are completed each year.


text: The status of our cybersecurity program is regularly reported to our organization's board of directors. Our board of directors is actively involved in oversight of our cybersecurity risk management activities, and cybersecurity represents an important element of our organization's overall approach to risk management in the pursuit of its business goals and objectives.


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our data and information systems are effectively secured and prepared for information security risks by internal and external threat actors. Our program involves regular monitoring of our internal IT assets, data inventories, and potential security exploits and/or threats to those assets' confidentiality, integrity, and availability. We employ a range of technical security tools and external security services, including regular network and endpoint monitoring, compliance audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk posture, remediation plans and cybersecurity investments.


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors and our audit committee provide oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager.


text: We also identify our cybersecurity threat risks by comparing our processes to standards established by the HITRUST and SOC2 frameworks and any findings resulting from penetration testing and threat modeling conducted by third party service providers. To provide for the confidentiality, integrity, and availability of critical data and information systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following internal security measures: • maintain a cybersecurity program through formally-defined documented policies, standards, processes, and procedures to ensure internal security measures are implemented to protect against cybersecurity threats, to assess emerging cybersecurity and data privacy laws, and to implement changes to our processes that are designed to comply with laws applicable to our organization; • implement policies and procedures to identity organizational assets, data and critical IT systems, assess (and periodically re-assess) those assets, data, and systems for cybersecurity risks, and to develop management plans for identifying and remediating identified risks; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to handle confidential data and systems in a legally compliant and acceptable manner; • employ technical security tools that are designed to protect our critical data and information systems from cybersecurity threats, including network firewalls and access controls, vulnerability scanners, intrusion prevention and detection systems, anti-malware/endpoint protection systems, and identity and access management systems which are evaluated for effectiveness and improved through vulnerability assessments and cybersecurity threat intelligence; • provide quarterly, mandatory training for our employees regarding cybersecurity threats to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • implement administrative processes and procedures to define acceptable security parameters and baselines of IT assets and information systems, and utilize access controls to prevent unauthorized alterations to system parameters and to maintain oversight over configuration changes and modifications to those systems; • conduct third party security reviews of critical and high-risk third-party suppliers and vendors; • conduct quarterly phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • implement a formal Incident Response Plan, based upon NIST, HITRUST, and SOC2 frameworks, to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident, which Incident Response Plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation; and • carry information security risk insurance to insure against potential losses arising from a cybersecurity incident.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party independent Risk Assessor review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers, manufacturers and other third parties who have access to patient and employee data or our IT systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and we continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading under Risk Factors titled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation", which disclosures are incorporated by reference herein.


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager. Our audit committee also receives prompt and timely information regarding any material cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Fidelity and its Enterprise Cybersecurity organization, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its shareholders. The Fund does not currently have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Private Credit Co LLC


text: The Fund depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Fund, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers, The frequency of such reviews is generally based on the nature of the Fund's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Directors as part of periodic reports.


text: Fidelity's Enterprise Cybersecurity organization has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Fund participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in Fidelity's Enterprise Cybersecurity organization and the Fund's management, including Fidelity's Chief Information Security Officer ("CISO"), members of the CISO's staff and the Fund's CCO. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over twenty years of experience in technology and information security and has served as Fidelity's CISO since May 2021. The CCO has been responsible for this oversight function as CCO to the Fund since the Fund's inception and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Board is also made aware of material cybersecurity incidents which impacted the Fund.


companyName: Fidelity Private Credit Fund


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Trustees as part of periodic reports.


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in Fidelity's enterprise cybersecurity organization and the Fund's management, including Fidelity's Chief Information Security Officer ("CISO"), members of the CISO's staff and the Fund's CCO. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The Company recognizes the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security Risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee (ERC) of the Board of Directors provides oversight of the Company's written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established polices, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.

companyName: LAKE SHORE BANCORP, INC.


text: The Company's Information Security Officer (ISO) is responsible for the design and execution of the Information Security Management Program and the information and cyber security aspects of the Information Technology Governance Program. The ISO provides the ERC with regular reports on the status and effectiveness of the Programs and risk management activities, as well as cyber and information security issues that may affect the Company. In addition, the ISO regularly reports the status to Executive Management.


text: The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council (FFIEC) Information IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool (CAT), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology Cybersecurity Framework (CSF), 12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Standards for Safety and Soundness Gramm-Leach-Bliley Act (GLBA) 501(b).


text: The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified through regular automated vulnerability scanning tools and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the Information Technology and Information Security Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the FFIEC CAT to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company's information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.


text: The Company has an Incident Response Plan to help reduce the risks related to security incidents by providing guidelines on responding to incidents; focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled appropriately.


text: The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Risk Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company's risk and information security expectations.


text: The Company's Security Awareness Program provides annual, mandatory training for personnel on information security to prepare personnel with the knowledge of how to properly use and protect Company resources from internal and external threats. The Program also conducts regular phishing assessments and targets new hires and other groups with specific training related to their job activities or risk levels. The Program also communicates information security policies, standards, and practices to personnel and requires annual review and acknowledgement of the policies.


text: The ISO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 12 years. The ISO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor (CISA). The ISO reports to the Chief Financial Officer (CFO) as well as the Chairperson of the ERC.


text: For the year ended December 31, 2023, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company's business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Technology.


text: We rely on information systems and the data stored on them to conduct our operations. As such, we have implemented processes designed to mitigate risks posed by cybersecurity threats.

companyName: Societal CDMO, Inc.


text: Our approach to cybersecurity risk management is multi-faceted and includes, but is not limited to, engaging third-party information technology and cybersecurity providers and consultants for support as appropriate, including to conduct annual penetration testing and cybersecurity risk assessments, as well as other vulnerability analyses on a periodic basis. We also utilize a third-party to implement and manage automated tools designed to conduct ongoing monitoring for potential critical risks from cybersecurity threats. Additionally, we have implemented an employee education and training program, offered during onboarding and on an ongoing, periodic basis thereafter, that is designed to raise awareness of cybersecurity threats. As part of this employee training, we engage in periodic phishing simulations designed to raise employee awareness of such risks.


text: We maintain processes to inform and update management and, as needed, the audit committee, regarding security incidents that may pose a significant risk for the business, as applicable. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have experienced threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Our Director of Information Technology, who reports directly to our Chief Financial Officer, is responsible for the day-to-day management of our cybersecurity risk management processes. The Director of Information Technology role is currently held by an individual who has thirty years of information technology and cybersecurity experience.


text: Our audit committee is responsible for overseeing our cybersecurity risk management program. Our Director of Information Technology and/or Chief Financial Officer periodically update the audit committee on cybersecurity risks and mitigation strategies and related cyber matters. In the event of a cybersecurity incident, we have implemented processes for the Director of Information Technology and/or the Chief Financial Officer to discuss incident response strategies with the audit committee. The Director of Information Technology and/or the audit committee update the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.


text: The General Partner has written plans, procedures and policies that govern the Partnership's general information security program. The General Partner has a Risk and Control Self-Assessment ("RCSA") framework to help identify, measure, monitor and report important operational risks faced by the General Partner. Man Group has a Cyber Incident Response Plan ("CIRP") which dictates how the Partnership reviews and responds to security alerts, events and incidents. Pursuant to the written incident response plan, in the event of a cybersecurity incident, the security team first identifies the incident, triages, and responds. The General Partner's compliance team is also notified of the cybersecurity incident and, in conjunction with the legal team, assists in incident remediation and determining the materiality. As applicable, RCSAs are filed with the General Partner's operational risk team in order to keep the General Partner informed on cyber risks. Ultimately, an aggregate response to a cyber incident is reported to Man Group's risk committees, creating awareness and consideration of the top risks and overall levels of risk exposure.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: The operational risk team also has service provider monitoring in place in order to oversee and identify cybersecurity threats associated with the Partnership's use of third-party service providers. Prior to onboarding, the Partnership conducts due diligence for key new third-party services providers. This involves a diligence questionnaire sent by a cybersecurity training company that is then reviewed by the Partnership. The training company also assess the Partnership's security status during onboarding for services providers and, for critical suppliers, at regular intervals throughout the life of the supplier's contract.


text: The Audit and Risk Committee ("ARCom") of the board of directors of the General Partner's parent entity, (the "Board") is responsible for risk governance and management frameworks, determining risk strategy and ensuring that risk is monitored and controlled effectively. The risk management framework requires that the Partnership operates within acceptable risk tolerances, while risk governance provides a foundation for potential oversight in an evolving cyber environment. The ARCom meets quarterly to discuss cybersecurity risks and events and reports its findings to the Board. The chief information security officer presents to the ARCom quarterly, including providing incident reports for potentially material security incidents, and all Board members have the opportunity to ask questions. The full Board also discusses cybersecurity risks and events quarterly.


text: The General Partner uses both internal and external auditors for cybersecurity services. The General Partner maintains an Information Security Steering Committee chaired by Man Group's chief information security officer ("CISO") and which contains, among other members, Man Group's chief technology officer ("CTO"). The CISO is a Certified Information Systems Security Professional ("CISSP") and has over a decade of experience in the fields of technology and security. The General Partner utilizes a Security Operations Center ("SOC") model and annual reports to prevent, detect, and respond to cybersecurity incidents. The General Partner has regular cybersecurity audits conducted by KPMG. Further, the General Partner contracts third parties to perform quarterly phishing testing, annual penetration tests, and a bi-annual red team exercise. These exercises consist of virtual simulations of cybersecurity incidents in order to test the effectiveness of the General Partner's cybersecurity protection program. The exercises also help prepare the General Partner and Partnership to sufficiently respond in the instance of cybersecurity incidents. The General Partner also has a dedicated compliance function that focuses on the General Partner's international operations in order to comply with international cybersecurity laws. The General Partner uses these processes as well as the RCSA and CIRP to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Employees are required to complete annual cybersecurity training. The training is updated periodically in order to stay up to date with current laws and was last updated in the fourth quarter of 2023. The General Partner models risks, including security risks, and allocates risk capital accordingly, and does not carry cyber insurance.


text: In the past, the Partnership has experienced actual and attempted cybersecurity events and incidents. While prior incidents have not materially affected the General Partner's or the Partnership's business strategy, results of operations or financial condition, and although the General Partner's processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect the General Partner's or the Partnership's business strategy, results of operations or financial condition. To date, the General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner, the Partnership, the General Partner's business strategy, the Partnership's results of operation or the Partnership's financial conditions.


text: The General Partner and the Trading Advisor maintain information technology systems, consisting of infrastructure, applications and communications networks to support the Partnership as well as its own business activities. These systems could be subject to security breaches such as 'cyber-crime' resulting in theft, a disruption in the Trading Advisor's ability to close out positions and the disclosure or corruption of sensitive and confidential information. Security breaches may also result in misappropriation of assets and could create significant financial and/or legal exposure for the Partnership. The General Partner and the Trading Advisor seek to mitigate attacks on their own systems but will not be able to control directly the risks to third-party systems to which it may connect. Any breach in security of the General Partner's or the Trading Advisor's systems could have a material adverse effect on the General Partner or the Trading Advisor and may cause the Partnership to suffer, among other things, financial loss, the disruption of its business, liability to third parties, regulatory intervention or reputational damage.


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity and availability of our key information systems; • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • designated team members are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; and • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls.


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors – Cyber-attacks or other failures in our telecommunications or information technology systems, or those of our collaborators, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations."


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board receives periodic reports from management on the integrity of our technology communication infrastructure and any cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, along with third party infrastructure providers are responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program. Our Chief Financial Officer has experience supervising and managing company information technology departments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the information technology environment.


text: We rely on the cybersecurity policies and procedures implemented by BDT & MSD. BDT & MSD have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to BDT & MSD's Information Security Policy, the BDT &MSD Chief Technology Officer ("CTO") is responsible for the oversight and implementation of the Information Security Policy. At times BDT & MSD may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: MSD Investment Corp.


text: BDT & MSD use processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, BDT & MSD use systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, BDT & MSD also maintain an incident response plan that is utilized when cybersecurity incidents impacting us are detected. BDT & MSD also require that all employees, including employees of BDT & MSD complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and BDT & MSD as needed, but no less frequently than annually. The BDT & MSD CTO periodically reports to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of BDT & MSD's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: Security Program Overview The Company's cybersecurity program is framework-based, and risk and metrics-focused. The program uses and is measured against National Institute of Standards and Technology Standards ("NIST") 800-53(r5) and supporting standards. The Company utilizes a risk-based security program that strives for an effective balance of controls and processes across the Identify, Protect, Detect, Respond and Recover areas of the framework. As a service provider and technology partner, we have on-going initiatives that address the areas below to achieve a comprehensive security program.

companyName: CINCINNATI BELL INC


text: Security Governance – The Company's Board of Directors has designated a subcommittee of the Board that meets quarterly to provide oversight of risks from cybersecurity threats. The Company's Vice President and Chief Security Officer ("CSO") reports to this subcommittee to inform them on the Company's threat and risk landscape, and the management of cybersecurity incidents. This subcommittee consists of board members and the Company's executive leadership team. The CSO also leads a cross-functional, executive-level Security Council that meets quarterly and governs all aspects of the Company's security program. The Company maintains a risk-based security program that is supported by a comprehensive set of policies, procedures, and standards based on the NIST cybersecurity framework, which includes administrative, physical, and technical safeguards.


text: The CSO joined altafiber in 2023 with over 20 years of cybersecurity experience in highly regulated industries and the government in identifying, managing, and mitigating cybersecurity risk. Previously, the CSO held an officer role at a large Fortune 500 financial services firm developing cybersecurity strategy and leading teams focused on risk management, security architecture and engineering, incident response, and threat intelligence. The CSO also serves on multiple advisory boards related to cybersecurity and is the current board chair for Miami University's Center for Cybersecurity.


text: The Company established an Enterprise Risk Management (ERM) Committee that employs the International Organization for Standardization (ISO) risk management standards. Members of the ERM Committee include the Company's CSO, Chief Financial Officer, Chief Network Officer, Director of Safety and Risk Management and the Director of Internal Audit. The committee leverages a proprietary internal risk management tool to maintain a risk register, which systematically identifies, assesses, prioritizes, and manages risks within the enterprise. This structured approach enables us to conduct a formal, periodic risk assessment, ensuring the continuous enhancement of our security posture. In addition to threats, vulnerabilities, impacts and costs, the risk assessment process also identifies the costs and effectiveness of countermeasures and action plans to reduce risk.


text: Security Awareness and Training – The Company established a security awareness program that focuses on individual employees' impact to the overall security strength of the company. Via the use of web-based and in person training, surveys and published literature, the Company is constantly making the employees aware of the vital role they play in protecting both the Company and customers' data. Phishing exercises are also periodically conducted to improve employee knowledge of and response to security threats. Specialized web-based training covering Payment Card Industry ("PCI"), Health Insurance Portability and Accountability Act ("HIPAA") and Federal Tax Information is also required and tracked for employees who have access to that data.


text: The Company requires authorization of all personnel, including contractors, before being granted access to facilities, systems, and data. The Company's identity and access management systems are integrated with human resource applications and processes to facilitate provisioning and de-provisioning of badges and logical system access.


text: The Company employs a "defense in depth" approach to providing security around our networks, servers, and data. Most of our critical networks leverage redundant components and connections to ensure high levels of availability, reliability, and performance. The Company employs a security architecture that identifies rules for segmentation and access control based on risk and impact to the business. This includes infrastructure, applications, and data in the cloud.


text: Endpoint and Device Protection & Anti-Malware – The Company has hardening policies and processes and uses a "gold image" approach to deploying new clients and servers. Configurations that go into gold images are reviewed with security staff. Advanced anti-malware controls are in place and patching cadence and performance of endpoint devices are watched closely. Cincinnati Bell Inc.


text: Protection of Customer and Other Sensitive Data – The Company complies with regulations for Customer Proprietary Network Information protection (Title 47 section 222) and has taken measures over the past several years to limit or remove Personal Identifiable Information ("PII") and other sensitive information from databases and internal systems. Access to sensitive information from third party partners is managed through secure virtual terminal environments, and movement of PII is monitored on premise and in key cloud applications.


text: The Company's application security program is based on the Open Web Application Security Standard ("OWASP") and critical systems have been benchmarked for compliance with our security polices and standards. Security work is jointly prioritized with security staff and product/application/development organizations and third parties with responsibility for application development and maintenance. Security checklists have also been developed and are used in new product development lifecycle processes.


text: Third Party Risk Management – Third parties with access to data or infrastructure must go through a vetting process to ensure they comply with reasonable and industry accepted security practices. The vetting process includes assessments, review of third-party attestation and inclusion of standard security language in contracts. Security staff work closely with legal, procurement/sourcing personnel and other stakeholders within the Company on third party compliance practices.


text: Threat and Vulnerability Management – Vulnerability scanning and attack and penetration testing, quarterly and annually, is conducted on perimeter networks and E-commerce platforms by third parties and qualified internal personnel. The testing covers network, host, application, and data security. The Company uses the Common Vulnerability Scoring System ("CVSS") standard for vulnerability management. Various open source, third party and internally developed threat intelligence platforms are used to stay abreast of threats facing the Company and our industry.


text: Security Assessments – Various company environments are regularly audited by a third-party AICPA- and PCAOB-registered certified public accounting firm and has consistently obtained PCI DSS 3.2, SSAE18 SOC1, SOC2, CSAE34-16 SOC1 and SOC2 certifications and HIPAA compliance. The Company currently holds 20 such certifications.


text: Change Management and ITSM – The Company employs robust change, incident and problem management practices across core network, managed services, and information technology environments. Security team members are an active part of these processes.


text: Emergency Management, Incident Response and Cyber Insurance – The Company has invested in technology and processes for timely incident response to security and crisis events. Physical and cybersecurity staff, health and safety, legal, operational and human resources personnel are part of the overall emergency and incident response team. The Company has partnerships with third parties for forensics, and incident response consulting. The Company also maintains effective levels of cyber insurance against large data breaches or cybersecurity events.


text: Service and Business Continuity – The Company conducts service continuity exercises and monitors network fault and performance 24 hours a day, 365 days a year to quickly detect and respond to service degradation or impairment. A set of business continuity plans and scenarios are also in place to address catastrophic events to personnel, critical infrastructure, and applications. The Company conducts periodic internal tabletop exercises and joint exercises with customers. Business continuity efforts are overseen by the Company's Business Continuity Committee following policy set by the Company's Security Council.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors– Intellectual Property Tax, Regulatory, and Litigation Risks" in this annual report on Form 10-K.


text: Website Access and Other Information The Company was incorporated under the laws of Ohio in 1983 with its headquarters at 221 East Fourth Street, Cincinnati, Ohio 45202 (telephone number (513) 397-9900 and website address http://www.altafiber.com). The Company has ceased to be subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, but continues to voluntarily file annual, quarterly and certain other information with the SEC due to contractual provisions included in certain indentures. The SEC maintains an internet site that contains reports, proxy statements, and other information about issuers which file electronically with the SEC. The address of that site is http://www.sec.gov. Cincinnati Bell Inc.


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company also relies on the cybersecurity policies and procedures implemented by Varagon and its affiliates. Varagon has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to Varagon's Information Security (Safeguards) Policy (the "Information Security Policy"), the Chief Financial Officer of Varagon serves as the Information Security Policy Coordinator and is responsible for the ongoing and regular monitoring of the Information Security Policy to ensure that it is operating in a manner reasonably calculated to prevent unauthorized access to, or unauthorized use of, non-public information. Varagon has engaged and may engage, from time to time, assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks, subject to the continued oversight of Varagon.

companyName: Varagon Capital Corp


text: The Chief Financial Officer of Varagon is responsible for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing non-public information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, including those pertaining to the Company. Additionally, Varagon uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Varagon also maintains an incident response plan that is utilized when cybersecurity incidents impacting the Company or the Adviser are detected. Varagon also requires that all employees, including employees of the Adviser, complete periodic information security training, including new hire training, regular compliance training, and periodic informal training pertaining on specific areas of concern.


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, future incidents could have a material impact on its business. Additional information about cybersecurity risks the Company faces is described in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity Risks," which should be read in conjunction with the information above.