text: We engage consultants, auditors, or other third parties in connection with our risk assessment processes. These professionals assist us in the design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. In addition, in order to mitigate cybersecurity risks associated with our use of third-party service providers, we require certain third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our computer systems, or those of any of our CROs, manufacturers, contractors, consultants or other third parties or potential future collaborators, may fail or suffer security incidents or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA

secItem: Item 1C


text: One of the key functions of our board of directors (our "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Our Senior Director, Information Technology, along with the members of our Incident Response Team, which includes our Senior Vice President, Finance and our General Counsel, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Incident Response Team is supported by an experienced managed service provider and an incident response provider with extensive global cybersecurity expertise, who each monitor, assess and report threats to us. Additionally, our Senior Director, Information Technology has over twenty years of experience operating in the information technology, security and cybersecurity space. In particular, he has experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation.


text: Our Senior Director, Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above and, along with and informed by the Information Technology organization and our Incident Response Team, monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Depending on the severity of the security incident, the Incident Response Team will report the security incident to our Audit Committee, including the financial impact of the security incident and any regulatory violations. As our Information Technology organization monitors the security and effectiveness of our policies and procedures, they also work to keep the Senior Director, Information Technology and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure.


text: Our Audit Committee receives an annual briefing regarding our company's cybersecurity risks and activities, including the status of cybersecurity system development, company-wide cybersecurity training programs, material changes to the cybersecurity system, policies or practices, any recent cybersecurity incidents and related responses, cybersecurity systems testing and engagement of third-party service providers in support of our cybersecurity system. Special meetings may also be called with the Audit Committee to brief the members on any material cybersecurity incidents and related responses thereto. After such briefings, our Audit Committee will provide an update to the Board on such reports. In addition, the Board will receive periodic updates in meeting materials or directly from our Senior Vice President, Finance on cybersecurity risks and activities.


text: Cyber Risk Management and Strategy Our manager of information technology works in conjunction with our third-party managed security service provider to establish and maintain our cybersecurity risk management processes, which are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework. We also leverage our managed security services provider and other third-party consultants, providers, and technologies to support our internal information technology resources to monitor, identify, and address cybersecurity risks, including managing our monitoring and alerting tools and conducting periodic assessments of certain system applications.

companyName: MYOMO, INC.

ticker: MYO


text: Further, as part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.


text: We conduct periodic risk assessments of our information technology systems as part of our cybersecurity risk management processes and to evaluate the effectiveness of applicable security controls. Our efforts to address cybersecurity risks also include training employees, both from programs provided by our third-party managed security service provider and internal policies and training, which are designed to increase awareness of cybersecurity threats.


text: We have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through review of applicable certifications and security reports, where available, and contractual requirements, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information please see the section entitled "Risks Related to Cybersecurity and Data Protection" in Item 1A- Risk Factors.


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Chief Financial Officer, in consultation with internal information technology resources, other members of senior management and our third-party security managed service provider. The Chief Financial Officer is responsible for identifying, evaluating, and implementing risk management control and methodologies to address any identified risks, including risks from cybersecurity threats, with advice from our third-party managed security service provider as appropriate.


text: The Chief Financial Officer periodically provides reports to the technology, quality and regulatory committee of the board of directors regarding information technology and cybersecurity matters and associated risks. The technology, quality and regulatory committee is responsible for reviewing and overseeing the Company's risk management process and strategy, including risks from cybersecurity threats. The technology, quality and regulatory committee periodically reports on cybersecurity risk management to the full board of directors.


text: Processes and Risk Assessment We rely on the cybersecurity program implemented by GECM. In order to assess, identify and manage material risks from cybersecurity threats, GECM has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, fund investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Great Elm Capital Corp.

ticker: GECC


text: GECM has implemented an information security policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that it stores or processes and the maintenance of critical services and systems. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. GECM's policies and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. GECM's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: (1) cybersecurity risks associated with its physical and digital devices and infrastructure, and (2) cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. This program is based on recognized industry standards and is supported by both management and our Board. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use recognized industry standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by Great Elm's Information Technology & Security Committee ("IT Committee"), comprised of GECM's Chief Operating Officer and other members of Company management as well as its third-party IT and consultant. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires third parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs periodic reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.


text: GECM also provides its employees with cybersecurity awareness training at onboarding and semiannually, as well as interim security reminders and alerts. GECM's third-party consultants conduct regular phishing tests and provide additional training as appropriate.


text: In May 2024, the SEC adopted amendments to Regulation S-P, which, beginning in December 2025, require investment companies and SEC-registered investment advisers to adopt written policies and procedures for incident response programs to address unauthorized access to, or use of, customer information, including providing notice to certain individuals affected by any such incident. We will need to comply with this amended rule beginning December 2025. With the SEC particularly focused on cybersecurity, we expect increased scrutiny of our and GECM's policies and systems designed to manage cybersecurity risks and related disclosures.


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by the IT Committee. The members of the IT Committee collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. The IT Committee is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by the IT Committee, with support from third-party consultants. The IT Committee alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing their severity and determining potential responses, as well as communicating with business leaders and senior management and the Board of Directors, as appropriate.


text: Our Board monitors cybersecurity risk as part of GECM's overall risk management program. Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have not occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; customer attrition; and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Our cybersecurity risk assessment process helps identify our cybersecurity threat risks by assessing our cybersecurity program against industry and best practices standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and the Center for Internet Security ("CIS"), as well as by annually engaging experts to attempt to infiltrate/test our information systems (as such term is defined in Item 106(a) of Regulation S-K).


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our senior leadership and executive team on a monthly basis. At the management level, we have established an information security risk committee, chaired by our Chief Information Security Officer ("CISO") and comprised of employees and executive management, to, among other things, coordinate and communicate the direction, current state, security risks (gaps) and governance of our information security program. Our cybersecurity program focuses in particular on the following key areas: Collaboration


text: To identify and assess material risks from cybersecurity threats, our Cybersecurity Governance, Risk and Compliance ("GRC") team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter experts, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: We employ a range of tools and services including (but not limited to) regular network and endpoint monitoring, vulnerability assessments and penetration testing to inform our professionals' risk identification and assessment.


text: Technical Safeguards We regularly assess and deploy internal and third party technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: We have established incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and board of directors on our response to a cybersecurity incident. We also have relationships with third party experts that can be utilized in the case of an incident.


text: Our cybersecurity risk processes address risks associated with our use of third-party service providers, including subcontractors used by those third-parties. Third-party risks are included within our GRC and procurement program, including the selection and oversight of our third-party service providers.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly train employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also have annual specialized training of our development staff that focuses on secure development best practices.


text: External Assessments We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures for handling and control of sensitive data and systems in an effort to identify areas for continued focus, improvement and/or compliance under various applicable regulatory frameworks (e.g., SOC, SOX, PCI, HIPAA).


text: Board's Oversight Role Cybersecurity is an important part of our risk management processes and an area of continued focus for our board of directors, audit committee and management. Our board of directors is responsible for the oversight of the overall corporate approach to cybersecurity risks. The board of directors has delegated such enterprise and cybersecurity risk management to its audit committee. At least quarterly, the audit committee and/or board of directors receives an overview from management of our cybersecurity threat risk management and strategy, covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and any material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the audit committee and the board of directors are also encouraged to engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management programs.


text: Under its charter, the audit committee is charged with discussing our major financial, information technology and cybersecurity risk exposures and the steps management has taken to monitor and control such exposures as well as the oversight of management's plans to address such risks. One member of our audit committee and board of directors has a strong background in information technology and cybersecurity risk management through service in related senior executive positions of other publicly traded companies meets regularly with our CISO to discuss our cybersecurity risk management processes.


text: Our cybersecurity program, which is discussed in greater detail under the "Risk Management and Strategy" heading above, is led by our CISO, who has over 20 years of prior work experience in various roles with large public companies involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. In addition, our CISO manages a team of highly trained and experienced cybersecurity professionals in support of the cybersecurity program.


text: Disclosure Controls and Procedures In addition to the information security risk committee discussed above, we maintain a disclosure committee with certain responsibilities that include among other things, the discussion of cybersecurity matters for materiality, proper internal reporting systems and incident disclosure evaluation. The disclosure committee also has a cybersecurity subcommittee that meets at least quarterly to discuss ongoing internal and external cyber-events, as well as mapping out the response process in the event of a cybersecurity incident that may reasonably be viewed as potentially material, including assessing the incident, materiality and disclosure obligations.


text: Cybersecurity Risks In 2024, we did not identify any cybersecurity threats that resulted in a material adverse effect on our business strategy, results of operations, or financial condition. Notwithstanding the discussion above and our efforts to address cybersecurity risks, we cannot guarantee that we can mitigate or eliminate all cyber-related risks, including those related to operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We urge you to read our discussion regarding whether and how risks from identified cybersecurity threats could materially affect us as part of our risk factor disclosures at "Item 1A - Risk Factors"—Risks Related to Our Business and Industry" and "—Risks Related to Our Technology and Intellectual Property" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Risk Management and Strategy Standard BioTools regularly assesses risks from cybersecurity threats; monitors our information systems for potential vulnerabilities; and tests those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to protect against cyber security incidents, as well as to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks (NIST, ISO) and include a review of our information security controls, policies and procedures to assess cybersecurity maturity against industry standards. In accordance with our IT Risk Management Program, we actively identify and assess risks based on the probability and potential impact to key business systems and processes. All risks identified are assessed to identify the range of possible outcomes and risks are prioritized by their level of importance. Each risk is assigned to a risk owner who will track, monitor, and report on the status with a risk response aligned to the probability and impact of occurrence. Risks that are considered high are incorporated into our corporate risk management program overseen by the Audit Committee of our Board of Directors (the "Audit Committee") and our Board of Directors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: All employees receive cybersecurity training upon hire with at least annual training thereafter with job-specific topic considerations. Our Information Security team, consisting of the VP of Information Technology, Sr. Manager of Network Security and IT Security Manager, among others, engage third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring for cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems through testing and threat intelligence awareness. The employees within our Information Security team and broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.


text: Additionally, we require each third-party service provider with access to our internal systems, applications or data to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our practice is to perform due diligence, including the completion of security questionnaires and risk assessments, as appropriate, on these third parties.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in our risk factor titled "Security incidents, loss of data, cyberattacks, and other information technology failures could disrupt our operations, damage our reputation, and adversely affect our business, operations, and financial results," in Part I, Item 1A. "Risk Factors." Refer to this risk factor for additional description of cybersecurity risks and potential related impacts on our Company.


text: As previously disclosed, in early 2019, we became aware of a ransomware attack that infiltrated and encrypted certain information technology systems, including systems containing critical business data. The financial impact of this incident was not material, and there were no changes to the previously released financial results or financial statements. As previously disclosed, immediately following the discovery, we commenced an investigation and were able to recover access to the compromised systems and restore their operation without significant loss of business data within weeks of the incident. Following the incident, we implemented additional protective measures and internal control policies and procedures. We also retained a professional cybersecurity investigation firm to conduct a full forensic analysis of the incident, and concluded that there was no evidence of malware, persistence mechanisms or other compromised exchange on-premises accounts within the Company's environment.


text: In early 2024, Standard BioTools completed a merger with SomaLogic. Critical to integration activities has been a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment with the objective of deploying and maintaining those which serve to reinforce our security presence to the greatest extent. While these activities continue, it has been noted that the SomaLogic organization takes a comparable, if not more stringent, approach to their cyber and information security posture inclusive of their ongoing ISO 27001 compliance certification.


text: While our management team is responsible for the day-to-day management of the risks Standard BioTools faces, our Board of Directors has the responsibility to oversee management's processes for identifying, monitoring, and addressing enterprise risks, evaluate and discuss with management its assessments of matters relating to enterprise risks, and oversee and monitor management's plans to address such risks. The Board of Directors takes an enterprise-wide approach to risk management designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance, and to enhance stockholder value. In order to understand the most significant risks faced by the Company and the steps being taken to manage those risks, Standard BioTools conducts quarterly enterprise risk management assessments, facilitated by the Company's executive leadership team in collaboration with the internal audit function, which are presented by management at each quarterly Board of Directors meeting. The Board of Directors' review of our business is an integral aspect of its assessment of management's tolerance for risk and its determination as to the appropriate level of risk for our Company.


text: Although the Board of Directors has determined that enterprise risk management should be the responsibility of the Board of Directors as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board of Directors and its committees and in other meetings and discussions, management reports to the Board of Directors and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes are led by our Chief Financial Officer and our Vice President of Information Technology. Our Vice President of Information Technology has over 19 years of work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and has carried relevant degrees and certifications, including Certified Information Systems Auditor. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters, on an at least annual basis. Should a material breach be identified, as defined by the Board of Directors and the executive team, these management team members will notify the executive team and the Board of Directors and draft the required disclosure.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: Q32 Bio Inc.

ticker: QTTB


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We leverage the support of third-party information technology and security providers, including for periodic security testing, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors. We have also engaged a third-party with specialized expertise in cybersecurity to conduct an audit, which resulted in no notable findings, and reported the results to the Audit Committee.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team as part of the Board's continuing education on topics that impact public companies.


text: Our management team, with the assistance of the Company's third-party information technology providers, is responsible for assessing and managing our material risks from cybersecurity threats. Internal personnel, including our Senior Vice President, Finance, have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our senior management do not have direct cybersecurity expertise obtained through certifications, but their experience managing the Company, which includes consulting and coordinating as necessary with third-party information technology and cybersecurity experts, enables them to assess and manage material risks from cybersecurity threats.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our IT environment.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management processes, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity processes, which are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), are supported by a third-party Managed Service Provider ("MSP") that assists us in managing our information technology systems.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: We implement a multi-layered approach to cybersecurity that includes, but is not limited to, employee security awareness training, phishing simulations, incident response planning, and various cybersecurity tools and technologies. We leverage the support of third-party information technology and security providers to manage our information technology systems, including through the performance of system scans and threat intelligence analysis. We have also previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we are adapting our cyber risk strategy in an effort to mitigate emerging cybersecurity risks.


text: We maintain a risk-based process to assess and review the cybersecurity practices of our third-party vendors, as appropriate, based on the level of access which the vendor has to critical operations, our information technology systems, and personally identifiable information.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third party vendors may also experience threats and cybersecurity incidents from time to time. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Related to Cybersecurity Risk Management is responsible for identifying, considering and assessing material risks for the business, including risks related to cybersecurity, on an ongoing basis. Our Chief Information Officer ("CIO") is responsible for our overall IT strategy and operations, including the strategic direction of our cybersecurity program, cybersecurity risk oversight and monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The individual serving as our CIO has over 10 years of experience in information security.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our CIO provides quarterly updates to the Audit Committee regarding our cybersecurity risks and an annual enterprise risk management update, which includes updates on plans intended to enhance our overall cybersecurity posture, to the Audit Committee. The Audit Committee updates the full Board of Directors on matters relating to cybersecurity risk management as needed.


text: Our process for managing cybersecurity risk is comprised of technologies, controls, and procedures designed to detect, assess, and manage threats and control access. We utilize a variety of systems, software, and services including firewalls, network and endpoint monitoring, anti-malware, detection and response, patch management, and backups to mitigate, identify, analyze, and respond to identified vulnerabilities and incidents in a timely manner.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: We evaluate our security posture on an ongoing basis via vulnerability scans, penetration testing, and threat intelligence monitoring. We periodically conduct third-party security assessments and regularly evaluate our processes against industry standard security frameworks. We conduct regular security training to elevate awareness and foster a security conscious culture among all employees.


text: We leverage third party service providers and solutions in many aspects of our operations. Our vendor management and oversight procedures include assessment of cyber security risk.


text: We do not believe there are any currently known cybersecurity risks that are reasonably likely to materially impact our business strategy, operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Our internal computer systems, or those of our third-party collaborators or other service providers, may fail or suffer security breaches and cyber-attacks, which could result in a material disruption of our development programs."


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors, or Board, and management.


text: The Audit Committee of our Board, or Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Potential material cybersecurity threat risks are also considered during Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of Information Technology who has served in various roles managing information technology and information security for over twenty-five years and reports directly to the Chief Financial Officer.


text: Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures. Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, and engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.


text: We face various cybersecurity threats, including unauthorized access, malware, ransomware, and phishing attacks. These threats could compromise the security of our information systems and the data we store and process. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the three year period ended December 31, 2024. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: We have established an information security third party risk management program to identify and manage these risks. This program includes regular risk assessments, third party risk provider reviews, and implementation of security measures such as encryption and firewalls, and ongoing monitoring of our systems for potential threats. We also engage with industry consultants to assist with our risk assessments.


text: On a regular basis, the technology steering committee, led by management, receives comprehensive reports summarizing cybersecurity threat monitoring and incident management activities. These reports also include details about remediation efforts to address identified threats and incidents. Additionally, both internal and external assessments of our company's cybersecurity threat monitoring capabilities are shared with the committee. Meeting minutes from these committee sessions are diligently maintained and provided to the Board of Directors.


text: The Board of Directors has responsibility for approving and overseeing management's policies related to information system security and cybersecurity threats and incidents. They also supervise management's overall approach to securing the company's information systems. The Board of Directors delegates the oversight of cybersecurity risk management to the Information Technology Committee of the Board.


text: The Information Technology Committee, in turn, reviews reports on our cybersecurity risk management processes. These reports cover assessments of management's handling of cybersecurity threats and incident management functions. The committee receives periodic updates from the Chief Information Officer, including information on social engineering risks, the effectiveness of cybersecurity training, and results from vulnerability and penetration assessments conducted both internally and by external parties. Audit reports related to information systems and cybersecurity threat monitoring are also part of this reporting process.


text: ChoiceOne recognizes the importance of cybersecurity and has established a comprehensive framework to assess and manage material risks from cybersecurity threats. The Company's cybersecurity risk management program is overseen by the Information Technology Committee, which is responsible for developing and implementing policies and procedures to protect the Company's information assets. Key members of ChoiceOne's cybersecurity team include:


text: Chief Information Officer ("CIO") has extensive experience in managing complex IT environments and mitigating cybersecurity risks. The CIO is responsible for overseeing cybersecurity and technology vendors, assessing risks in these areas, and ensuring the effective execution of the information security program.


text: Vice President of Network Security is a Certified Information System Security Professional (CISSP) with over 10 years of experience in managing IT and cybersecurity operations.


text: The cybersecurity team has several other members with expertise in network security, technology, and administration. The cybersecurity team meets regularly to review and assess the Company's cybersecurity posture, identify potential threats, and implement appropriate measures to mitigate risks. The committee also collaborates with external cybersecurity experts to stay informed about the latest threats and best practices in the industry.


text: Our policies for Cybersecurity and the Safeguarding of Data, Computing Systems and Confidential Client Information policies establish the administrative, technical, physical safeguards and risk mitigations which are implemented to protect the security and confidentiality of all customer information as set forth by the federal regulatory authorities' interagency guidelines mandated by Section 501 of the Gramm-Leach-Bliley Act of 1999 and Part 364, Appendix B of the FDIC Rules and Regulations. Our objective is to emphasize compliance with all information and cybersecurity requirements, including those detailed in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, FFIEC guidance and regulatory agency guidelines which provide established standards for cybersecurity and the safeguarding customer information and Bank assets.

companyName: River Financial Corp

ticker: RVRF


text: Security Operation and Governance Our Board Chartered, IT Committee oversees implementation, monitoring, and assessment of cybersecurity risks as it relates to the comprehensive Information Systems Security Program (ISSP). In fulfilling its duties, the Committee ensures the development of appropriate policies. The Committee reviews and discusses policies, procedures, and projects with management and after taking into consideration any matters that the Committee may deem advisable, the Committee annually recommends such policies to the Board of Directors for review and ultimately approval.


text: The Board of Directors receives cybersecurity status updates, training and is encouraged to engage with questions. Frequency of these cybersecurity updates are driven by the events in the world, cyber threats, and alerts received by the Bank's ISO, Management, or Technology Administrator.


text: Information Technology and Cybersecurity Management Our Information Security Officer (ISO) is responsible for overseeing the Bank's strategies necessary to ensure the confidentiality, integrity, and availability of electronic information by communicating risk to senior administration, creating, and maintaining enforceable policies and procedures, and ensuring compliance with regulatory requirements.


text: Under the oversight and guidance of the IT Committee, the Board of Directors, and the HR Department's ISO Job Description, the ISO is responsible for the following: • Overall security/control of the network and computing systems. • For coordinating the education and training of new and existing employees on Network and Physical Security Policies as outlined in the Information Systems Security Policy. • Management of all detection systems directly connected to the Internet/network and subjected to on-going review of generated reports and risk assessments performed by independent auditors and vulnerability identification software. • Management of the audit function, which will periodically review the information security policies, standards, and procedures and ensure the adequacy of information system controls and compliance. • Provide reports to the IT Committee, Senior Management, and the Board of Directors, as needed or required, concerning the Bank's security posture. • Oversight and management of technology vendors and suppliers.


text: Security Competencies The Information Security Program oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. This level of competency is attained through regulatory examination, scheduled audits, internal risk assessments, security scanning of assets, and annual testing. We participate in annual programs including the FFIEC Cybersecurity Assessment Program which measures and defines our inherent risks and the maturity of our preparedness. This process is overseen by our IT Committee and presented to the Board of Directors.


text: Any new organization or party that we show interest in establishing a relationship with the Bank will/may require the potential to share or access confidential client information must go through a series of guidelines for qualification prior to releasing information or implementing services. These procedures are in place in order to demonstrate our commitment to safeguarding confidential information while documenting due diligence. New third parties are assessed through our pre- engage ment process. The next level of engagement involves a Risk Dependency Assessment, to determine the vendor's Tier Level and a full due-diligence review of policies and independent audits of Critical Vendors as defined in policy.


text: Security Awareness and Education The Bank provides annual, mandatory, onsite training for personnel regarding security awareness to equip personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Bank's information security policies, standards, processes, and practices. Staff IT training process is monitored, tracked and reported to the IT Committee and Board of Directors. We have also employed a program of staff phishing tests with staff response evaluated and reported to the IT Committee and the Board of Directors. Incident Response Program (IRP)


text: The Bank's ability to respond to security incidents in a planned and coordinated fashion is important to the success of its information systems security program. The IRP has been developed to provide protections for both the Bank and the Bank's customers and to mitigate the negative effects of cybersecurity events or security breaches on the Bank itself. Program also identifies the Bank's Information Security Incident Response Team (ISIRT) Policy and program procedures which are tested annually.


text: A 24/7 monitored intrusion prevention system, internal intrusion detection system, and firewalls to assist in the identification of unauthorized system access is in place. Network and application security reports are reviewed by Bank personnel and used to help in the detection process.


text: Our ISO and Management Committees are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our Information Security Team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our ISO oversees the implementation of and the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the Information Security Incident Response Plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: We take cyber risk seriously as a part of modern enterprise risk management, protecting our stakeholders and assets, and building resilient processes. The modern threat landscape requires us to consider cyber risks, and make determinations regarding how to treat the risks. We evaluate cybersecurity risks alongside other business risks.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To that end, we rely on a multidisciplinary team (including from our IT function, senior management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: S enior management is directly involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Senior management participates in cybersecurity incident response efforts by being part of the incident response team and helping direct our response to cybersecurity incidents.


text: To augment internal knowledge, we have engaged a virtual Chief Information Security Officer ("vCISO") from a third-party firm that has provided IT and security services for over 18 years and utilizes industry expertise to recommend and implement best practice solutions for operational needs. The service provides a named vCISO as part of an advisory team to assess and help manage our cybersecurity program.


text: Cybersecurity risks are identified and processed in a Risk Register by an information security team that includes the vCISO and internal management. We conduct risk assessments, penetration testing, vulnerability scanning, receive alerts from security tools, and engage in an ongoing discussion of business processes and policy management. We use advanced tools to track governance, risk, and compliance tied to a security framework tailored from industry standards and best practices, and we test our tools and policies regularly.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, software, and our critical data including confidential, personal, proprietary, and sensitive data. Accordingly, we maintain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess any potential material impact to our business. Based on our assessment, we implement and maintain risk management processes to our information assets and mitigate harm to our business. In addition to internal systems and concerns, we manage risks from third parties that are a part of business operations. This includes assessing cybersecurity risks during the vetting process and recurring assessments during the life of the engagements. Relative levels of assessment are considered with regard to business criticality of the relevant third parties. We rely heavily on our third party CROs and CDMOs to manage our clinical trials and manufacture our investigational products, and a cybersecurity incident at a CRO, CMDO or other third party upon which we rely could materially adversely impact us. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report on Form 10-K for additional information on cybersecurity risks we face.


text: Information from the risk management process is managed by the Information Security Team and is reported to the Board of Directors on a regular basis. We provide cybersecurity updates to our Audit Committee on a quarterly basis. In the case of an incident, relevant members of the Information Security Team are involved to assess and oversee incident response operations as needed, including adequate reporting of material incidents if/when appropriate.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are included in our overall risk management program and designed to protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Cybersecurity risks are also periodically reevaluated in additional detail based on our experience and on external information regarding emerging risks. To protect our information systems from cybersecurity threats, we use various security tools, tracking procedures and investigational procedures to identify, investigate, and resolve potential security incidents in a timely manner. We also engage third-party vendors to assist with security management, incident detection and response.

companyName: Mural Oncology plc


text: We have adopted guidelines and processes, led by our information technology ("IT") department, for preventing cybersecurity incidents and for assessing and responding to such incidents should they occur. These guidelines and processes, as well as our overall cybersecurity risk management, include consideration of cybersecurity threats associated with our use of third-party service providers. We also consider the internal risk oversight programs of our third-party service providers before engaging them in order to help protect us from any related vulnerabilities.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company.


text: In an effort to deter and detect cybersecurity threats, we periodically provide all employees with a cybersecurity training and compliance program, which covers timely and relevant topics and educates employees on the importance of reporting immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.


text: Our management is responsible for day-to-day risk management, while the audit committee of our board of directors has responsibility for the oversight of risk management, including overseeing the management of our risks from cybersecurity threats.


text: Our Vice President, Information Technology ("VP IT") is responsible for developing, implementing, and maintaining our processes and procedures for cybersecurity risk management and response. Our current VP IT has over thirty years of experience, which includes cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within pharmaceutical and biotechnology companies. Any cybersecurity incidents are evaluated for potential impact and are reported, as appropriate to the severity, to our management, our Information Security Committee, our executive leadership and/or our board of directors. Our Information Security Committee, which is led by our VP IT and includes representatives from our IT, finance, and legal departments, meets regularly to review the incidence, impact assessment, and resolution of cybersecurity incidents, if any, and to assess evolving risks. Our Information Security Committee provides updates on cybersecurity incidents and responses and on cybersecurity risk management as needed and provides updates to executive leadership and to our Board of Directors.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information, or collectively Information Systems and Data.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Our cybersecurity function, which comprises, in part, our Interim Chief Financial Officer and third-party service providers (including our managed security services provider, or MSSP), helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting threat assessments for internal and external threats (including third party threat assessments), using external intelligence feeds, coordinating with law enforcement regarding certain threats, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, network security controls, systems monitoring, and asset management, tracking, and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers. We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations and contract manufacturing organizations. We manage cybersecurity risks associated with our use of these providers by reviewing their conducting audits and imposing contractual obligations on the vendor to protect our information.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Interim Chief Financial Officer, who oversees outsourced IT (including cybersecurity).


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Interim Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Interim Chief Financial Officer. Our Interim Chief Financial Officer and others work with our incident response team (including our MSSP) to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting certain cyber incidents to the audit committee.


text: The audit committee receives periodic reports from our cybersecurity function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our guests, business partners, associates and other stakeholders, and the processes implemented to address the risks related to cybersecurity threats are an important part of our overall risk management efforts. More specifically, we seek to address cybersecurity risks by focusing on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program focuses on the following key areas: • Governance/Board-Level Oversight: Our Audit Committee is briefed on cybersecurity risks as a standing agenda item at each regularly scheduled quarterly meeting. The Chief Information Officer ("CIO") reports quarterly to the Audit Committee and such report typically addresses an overall assessment of our compliance with our cybersecurity policies and includes topics such as risk management and control decisions, updates on our cybersecurity roadmap and self-assessment, training results, security threats, incidents (if any) and responses, and recommendations for changes and updates to our policies and procedures. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, 24x7 monitoring by a third party security operations center, and antimalware functionality and access controls, which are periodically evaluated through vulnerability assessments and cybersecurity threat intelligence. • Business Continuity and Disaster Recovery: We have established and maintain comprehensive business continuity, incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for our associates regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our information security policies, standards, processes and practices.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are shared with executive management and, as needed, the Audit Committee and the Board. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Operational responsibility for assessing and implementing our processes and procedures related to cybersecurity risk is led by our CIO. The CIO leads a team of internal full-time associates and external consultants and vendors that manage all aspects of our risk management tools. The CIO reports directly to the Chief Administrative Officer and General Counsel ("CAO"), who manages legal and insurance coverage matters related to cybersecurity risks. Additionally, our Chief Financial Officer and relevant associates on her staff are involved in the management of cybersecurity threats in relation to our internal controls environment, and, in the event of an incident, relevant investor relations needs. Our policies and procedures provide that the Chief Executive Officer, the Audit Committee, and the Board are to be informed in a prompt, timely manner in the event of any material cybersecurity event.


text: Our CIO has Bachelor of Science degrees in Information Technology and Business Administration and Science and has served in various roles in information technology for over 30 years, including nearly 20 years in roles directly related to implementing and managing cybersecurity measures.


text: For additional information on cybersecurity risks, see the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Vroom, Inc.

ticker: VRM


text: We design and assess our program guided by a number of well-known industry standards, such as the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001, and Center for Internet Security (CIS) Controls V8. This does not imply that we meet all of these standards, specifications, and requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key features of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and, information; • an information security program, led by our Chief Technology Officer, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Cybersecurity and Privacy— If we or our third-party providers sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences. "


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Chief Technology Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security program and personnel and certain of our retained external cybersecurity consultants. She has over twenty-five years of experience in the technology industry. In addition, the Vice President of Engineering has involvement in managing cybersecurity risk and has over 30 years of experience in the technology industry.


text: Vroom's Chief Technology Officer reports to the Committee on a quarterly basis on our cybersecurity risks. In addition, the Chief Technology Officer updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee periodically reports to the full Board regarding its activities, including those related to cybersecurity. Committee members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.


text: Our management team, including Vroom's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, VP of Human Resources, and Chief Technology Officer, stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program to assess, identify and manage cybersecurity threat risks. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, processes, and practices, which are integrated into the Company's overall risk management process. To help protect the Company's information systems from cybersecurity threats, the Company uses various security tools and personnel that help the Company identify, escalate, investigate, resolve, and recover from security incidents.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Managing Material Risks & Integrated Overall Risk Management The Company has incorporated cybersecurity risk management within its Enterprise Risk Management framework. Led by the Company's Senior Vice President of Operations, the Company's risk management team, comprised of senior management team members, integrates the evaluation of cybersecurity risks in accordance with its business objectives, operational needs, and legal requirements.


text: Acknowledging the intricate and dynamic landscape of cybersecurity threats, the Company collaborates with external experts, such as cybersecurity assessors, consultants, and auditors, to assess and test its risk mitigation tools. The Company's engagement with these external entities encompasses routine reviews, threat assessments, and ongoing consultations to enhance the Company's security measures.


text: Prior to engagement, the Company undertakes security assessments of third-party providers that process or store confidential Company information, and monitors their activities for alignment with the Company's cybersecurity standards. This monitoring involves evaluations performed by the Company's team of security analysts, and annual review by the Company's Chief Information Security Officer ("CISO").


text: Risks from Cybersecurity Threats To date, the Company believes that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have no t materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Refer to the risk factor captioned "A failure in the Company's operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company's business, its reputation, and / or cause losses which would have a material effect on the Company's business operations and financial results" in Part I, Item 1A. "Risk Factors" for additional information on cybersecurity risks that could adversely impact the Company's business, results of operations or financial condition.


text: Management's Role Managing Risk The CISO advises the Enterprise Risk Management Committee (the "ERM Committee") of the Board of Directors on cybersecurity risks. The CISO provides the following information to the ERM Committee on a quarterly basis: • Company threat profile and emerging threats; • Status of cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: The Company conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk mitigation strategies. This review helps in identifying areas for improvement and aligning cybersecurity efforts with the overall risk management framework.


text: Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the CISO. The CISO, has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making. The CISO oversees the information security policies and data protection programs, implementation of protective and detective tools, tests the Company's compliance with standards, and remediates known risks. These initiatives include phishing simulations, semi-annual cybersecurity education to employees, and competency assessments. Additionally, the Company conducts table-top incident response practices and other measures to enhance overall cybersecurity preparedness. These efforts underscore the organization's commitment to addressing a wide range of potential threats and cybersecurity challenges.


text: Monitoring Cybersecurity Incidents The CISO is informed about the developments in cybersecurity, including potential threats and risk management techniques. This ongoing knowledge acquisition is crucial for the prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, the CISO is equipped with a cyber incident response plan ("CIRP") supported by a cross-functional cyber incident response team ("CIRT"). The CIRT oversees and responds to cybersecurity incidents. Its core objectives encompass detection and response, conducting incident analysis and investigation, implementing containment and eradication measures, and facilitating recovery processes. It also entails coordinating and communicating with the Company's management, regulators, affected parties, and external security experts. The CIRT determines the materiality of the incident, maintains documentation and reporting practices, and fosters a culture of improvement.


text: Reporting to Board of Directors The ERM Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The CISO, in his capacity, informs the Chief Executive Officer, the Chief Financial Officer, the Chief Audit Executive, the Chief Information Officer, and the Legal Department of aspects related to cybersecurity risks and incidents. Furthermore, the CISO escalates significant cybersecurity matters to the ERM Committee.


text: The Board has established oversight mechanisms to govern risks associated with cybersecurity threats because they recognize the significance of these threats to the Company's operational integrity and stakeholder confidence.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology and cybersecurity functions. By fully outsourcing our IT environment and placing it within expert third-party software-as-a-service, human resource, and clinical providers our primary means of avoiding cyber risk is not having sensitive data within our enterprise. All third parties are managed by our team, and we review our vendors to ensure that they have risk management procedures in place, including physical, procedural, and technical safeguards (such as: response plans, regular tests on the systems, third-party auditing, incident simulations and routine review of appropriate policies and procedures to identify risks and refine security practices). Our Senior Director of IT Operations and Security is responsible for vendor management regarding our vendor risk experience and reports directly to our Chief Financial Officer. We track security risk as a company and review it annually at the senior management level.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. As needed, the audit committee of our board of directors (the "Board") provides oversight over cybersecurity risk and provides updates to the Board regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: To deter and detect cyber threats, we annually provide our employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting security incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats. Our processes include, but are not limited to, the following: • Engaging cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices; • Providing periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • Employing a variety of preventative and detective tools designed to monitor and block suspicious activity.

companyName: Velocity Financial, Inc.

ticker: VEL


text: Our Chief Information Officer (the "CIO") is primarily responsible for this cybersecurity component, reporting directly to the Chief Executive Officer, who periodically reports to our Board of Directors. To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents.


text: We recognize the importance of maintaining the safety and security of our critical systems, information, products, services, and broader information technology environment (collectively, our "Information Systems and Data"), and we have developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability thereof.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Cybersecurity risks are addressed as a component of our overall enterprise risk management program. As such, our information security team works with management to prioritize our risk management processes and to mitigate those cybersecurity threats that are more likely to lead to a material impact on our business. Features of our cybersecurity risk management program include: • Periodic risk assessments designed to help identify cybersecurity risks that could materially impact our Information Systems and Data; • A security incident response team that is principally responsible for managing our cybersecurity risk assessment processes, information security controls, and response to any cybersecurity incident; • A cyber and data security incident response plan that establishes policies and procedures for identifying, managing, and recovering from a cybersecurity incident, including escalating tiers of notification depending on an incident's nature and severity; • Periodic tabletop exercises with management and other employees to discuss, prepare for, and simulate our responses to potential cybersecurity incidents; • The use of third-party service providers, as appropriate, to assess, test, and assist with aspects of our information security controls; • The use of a third-party risk management process for our service providers, suppliers, and partners; • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents; • Cybersecurity policies and procedures, including those governing encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices; and • Required annual privacy and cybersecurity training (including spear phishing and other awareness exercises) for employees.


text: Because the techniques used to obtain unauthorized access, disable/degrade service, or sabotage systems change frequently, we have invested and continue to invest in the security and resiliency of our systems and networks to help protect our Information Systems and Data. For a discussion of cybersecurity-related risks that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Information Technology, Cybersecurity, and Intellectual Property" section of this Report.


text: Our Board is responsible for overseeing our overall enterprise risk management program, and each of its committees assists in this risk oversight role. Our Board has delegated the monitoring and oversight of risks relating to data privacy, technology, information security, and cybersecurity to our Audit Committee, which regularly reports to our Board regarding its activities, including those related to the management of these risks. Our Board also receives periodic briefings from management regarding our cybersecurity risk management program, including presentations on cybersecurity topics from our CTO, our information security team, and other third-party experts.


text: Our Audit Committee oversees management's implementation of our cybersecurity risk management program. It receives regular updates from our CTO and other members of management on cybersecurity trends and developments, the cybersecurity risks that are most relevant to our business, and our cybersecurity strategy, as well as other updates, as appropriate, regarding certain cybersecurity incidents.


text: A cross-functional management team, including members of our information security, technical infrastructure, engineering, and legal departments, is responsible for identifying, assessing, and managing the risks from cybersecurity threats that are relevant to our business, as well as managing our response to any cybersecurity incident (and, depending on an incident's potential nature and severity, reporting it to our Audit Committee and considering with management whether public disclosure is appropriate or required). This team has primary responsibility for our cybersecurity risk management program, including our cyber and data security incident response plan, supervises our internal personnel and third-party service providers, and communicates our cybersecurity risk management processes to management, our Board, and our Audit Committee. This team reports to our CTO, who has more than 15 years of experience in the technology sector, and possesses nearly 60 years of combined experience in cybersecurity matters, including threat assessment and detection, mitigation technologies, incident response, cyber forensics, and regulatory compliance. In addition to relevant educational and industry experience, members of this team, including the heads of our information security and technical infrastructure departments, hold relevant cyber and information security certifications, including from ISACA (Certified Information Security Manager and Certified Information Systems Auditor) and ISC2 (Certified Information Systems Security Professional). This team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, the operation of our cyber and data security incident response plan, briefings from internal security personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including our third-party service providers, and alerts and reports produced by security tools deployed in the information technology environment.


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. We, in conjunction with our Manager, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats which prioritizes detection and analysis of and response to known, anticipated, or unexpected threats, effective management of security risks and resilience against cyber incidents. The Manager's cybersecurity program is aligned to the National Institute of Standards of Technology (NIST) Cybersecurity Framework. Our Manager's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risk from cybersecurity. Our Manager has implemented and continues to implement procedures to address internal and external threats to the security, confidentiality, integrity and availability of our and our Manager's data and systems along with other material risks to operations and information of our shareholders and other third parties who entrust us with their sensitive information.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: As part of its collective risk management process, our Manager engages a third party information technology consultant ("IT Consultant") to evaluate risks associated with the Manager's information and technology system(s), network and physical devices. Our Manager's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of our Manager. Our Manager also has annual certification requirements for employees, including employees who provide services to us pursuant to our Management Agreement with respect to certain policies supporting the cybersecurity program including Chicago Atlantic's Information Security and Electronic Communications policy, Data Protection Policy and Privacy Policy. Our Manager undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Manager and our critical third-party vendors and other partners. Our Manager also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: Material Impact of Risks from Cybersecurity Threats As of the date of this report, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."