text: The Company relies heavily on its information systems, and the availability and integrity of these systems is essential to conducting its business and operations. As a developer of modern energy economy technology systems and services, the Company faces various security threats, including cybersecurity threats, to gain unauthorized access to its sensitive information or to render its information or systems unusable, and threats to the security of its facilities and infrastructure or third-party facilities and infrastructure, such as gathering and processing and other facilities, and pipelines. This risk may be heightened as a result of an increased remote working environment, similar to the one created by the COVID-19 outbreak in 2020. The potential for such security threats subjects its operations to increased risks that could have a material adverse effect on its business, financial condition, results of operations and cash flows.

companyName: ConnectM Technology Solutions, Inc.

ticker: CNTM


text: As the Company implements various procedures and controls to monitor and mitigate such security threats and to increase security for its information, systems, facilities and infrastructure it may result in increased costs. Moreover, there can be no assurance that such procedures and controls will be sufficient to prevent security breaches from occurring. If any of these security breaches were to occur, they could lead to losses of, or damage to, sensitive information or facilities, infrastructure and systems essential to its business and operations, as well as data corruption, communication interruptions or other disruptions to its operations, which, in turn, could have a material adverse effect on its business, financial position, results of operations and cash flows.

secItem: Item 1C


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Stride, Inc.

ticker: LRN


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the National Institute of Standards and Technology Special Publication (SP) 800-53. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and SP 800-53 as a framework to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, including incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We operate in markets that are dependent on Information Technology (IT) systems and technological change. Failure to maintain and support customer-facing services, systems, and platforms, including addressing quality issues and execution on time of new products and enhancements, could negatively impact our revenues and reputation" and "Risk Factors – The failure to prevent a cybersecurity incident affecting our systems could result in the disruption of our services and the disclosure or misappropriation of sensitive information, which could harm our reputation, decrease demand for our services and products, expose us to liability, penalties, and remedial costs, or otherwise adversely affect our financial performance".


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee on any incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including our Chief Information Security Officer ( CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 20 years of experience managing the security and compliance organization for global companies, providing online and cloud-based services to more than a majority of the Fortune 500 and the United States Government.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cyber Risk Management Strategy Adtalem recognizes the importance of safeguarding sensitive information pertaining to our students, employees, institutions, and operations. Our Cyber Risk Management Framework ("CRMF") is designed to fortify our defenses against potential cyber threats and to protect the integrity, confidentiality, and availability of critical data. Our CRMF includes continuous risk assessments, threat modeling, vulnerability scans, and monitoring for indicators of compromise. These assessments inform control implementations based on likelihood and impact to operational, financial, and reputational harm.

companyName: Covista Inc.

ticker: CVSA


text: Program Highlights The CMRF is anchored by our Enterprise Information Security Framework ("EISF"), which adheres to the guidelines set forth by the National Institute of Standards and Technology ("NIST") 800-53 Framework. To enhance comprehensiveness, our policies also harmonize with other leading frameworks such as the ISO 27001 Standard, Family Educational Rights and Privacy Act of 1974 ("FERPA"), Payment Card Industry Data Security Standard ("PCI DSS"), Gramm-Leach-Bliley Act ("GLBA"), California Consumer Privacy Act ("CCPA"), General Data Protection Regulation ("GDPR"), and other pertinent local, state, national, and international regulations governing data privacy and information security. Our cybersecurity program has adopted controls mapped to these frameworks and incorporated them into Adtalem's policies, risk registers, control testing plans, and vendor assessments.


text: Our Chief Information Security Officer ("CISO") manages Adtalem's enterprise-wide cybersecurity program and reports to Adtalem's Chief Financial Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Adtalem since 2018. The CISO has over twenty years of information technology and cybersecurity experience, including executive leadership roles at Fortune 500 organizations within regulated sectors including financial services and healthcare. The CISO leads a team of experienced subject matter experts with focus on strategy formulation, architecture design, incident response, colleague training, risk management, and governance functions. This team includes diverse industry backgrounds spanning financial services, healthcare, and government. The CISO provides regular updates to executive management and ensures independent validation of key controls through internal and external reviews. The CISO's function operates independently of IT operations, with direct access to the Audit and Finance Committee as needed.


text: The CISO team is supported by a Security Operations team reporting into the Information Technology ("IT") function. This IT team provides engineering and technical expertise. The team is further supported by a 24x7 Security Operations Center ("SOC"). Adtalem has a Cyber Incident Response Plan ("Incident Response Plan") that delineates the requirements of notification, classification, analysis, and communication of cybersecurity incidents based on the identified severity level. The Incident Response Plan includes initial steps to convene a response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and possible disclosure requirements, and consider involving law enforcement. The Incident Response Plan also provides for a lessons learned review to identify improvements that could be made. Adtalem's Legal and Compliance teams also provide incident response support to the CISO and manage cybersecurity-related legal and compliance issues. Processes are in place to escalate cybersecurity incidents promptly so that decisions regarding public disclosure and regulatory reporting can be made by management in a timely manner.


text: An integral component of Adtalem's Incident Response Plan is our Privacy Incident Response Plan (the "Privacy Response Plan") which addresses privacy of our students' records, including under the FERPA. The Privacy Response Plan requires annual training for our employees on how to recognize and report potential privacy incidents.


text: We regularly conduct Incident Response Plan tabletop exercises, including simulations of malware and ransomware attacks. Our IT environment and cybersecurity-related controls are reviewed by our internal audit function and external third parties. We sponsor third-party assessments, including cyber risk reviews and penetration testing, to evaluate our cybersecurity program independently.


text: Adtalem subjects its systems to penetration testing to identify potential exposures, ensuring that our infrastructure maintains an acceptable level of cyber risk. In addition, Adtalem leverages third-party experts to enhance its cybersecurity program and Incident Response Plan. Our organization has not identified or discovered any cybersecurity threats over the past three fiscal years that have materially impacted or are reasonably likely to materially impact our business strategy, operations, or financial condition. Expenses related to cybersecurity incidents have not been material.


text: Our year-round cybersecurity awareness program mandates training for all system users, covering essential topics such as safeguarding sensitive information, identifying phishing attempts, securing mobile devices, and understanding the risks associated with artificial intelligence ("AI") platforms. Our cybersecurity awareness training is mandatory for all employees and is conducted at least annually, with targeted phishing simulation campaigns conducted throughout the year. Third-party suppliers are subject to a formal onboarding process that includes completion of a cybersecurity questionnaire, review of SOC 2 or ISO certifications where available, and risk scoring. New engagements with third parties are contingent upon affirmative evaluations or adherence to risk mitigation/acceptance protocols. Contracts with third parties include provisions for breach notification, investigation, root cause analysis, and remediation.


text: Cybersecurity is acknowledged as an important enterprise risk at Adtalem. Our Audit and Finance Committee ("AFC"), comprised entirely of independent directors, is responsible for oversight of risks from cybersecurity threats. The Chair of our AFC has received a CERT certificate in Cybersecurity Oversight from Carnegie Mellon University in partnership with the National Association of Corporate Directors. Our CISO briefs the AFC on cybersecurity matters, including the evolving threat landscape and Adtalem's threat mitigation efforts, four times a year. At each quarterly meeting, the Chair of our AFC also briefs the full Board on cybersecurity matters discussed at AFC meetings. Cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of our annual enterprise risk management ("ERM") assessment.


text: Governance and Oversight Bio-Techne's cybersecurity program is led by the Company's Chief Information Officer ("CIO"), with day-to-day management and administration of our cybersecurity program performed by the Director of IT Infrastructure and Security and the IT Security Operations team. The Director of IT Infrastrcuture and Security reports to the CIO, and the CIO reports to the Chief Financial Officer. The CIO is supported by the Incident Response Team ("IRT"), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions. The IRT supports the CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation. In addition to leadership and support within management, we also work with security service providers to monitor for vulnerabilities and threats, and which are reported to the Security Operations team. All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises. We also conduct periodic tabletop exercises for key personnel involved in cybersecurity risk management, including the IRT.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Our Board of Directors ("Board") holds overall oversight responsibility for the Company's strategy and risk management, including in relation to cybersecurity risks. The Board exercises its oversight function through the Audit Committee, which oversees the management of risk exposure across various areas, including data security risks, in accordance with its charter. In addition, the Audit Committee is specifically responsible for the review and approval of any cybersecurity incident disclosure, as set forth in the Committee's charter. In the event of a potentially significant cybersecurity incident, the Audit Committee's charter requires that management promptly communicate and consult with the Audit Committee.


text: Bio-Techne's General Counsel updates the Audit Committee multiple times per year regarding Bio-Techne's cybersecurity programs, including regularly-tracked metrics on incident response, internal security testing, and measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Audit Committee regularly updates the full Board on these matters. In addition, on at least an annual basis, the CIO provides the full Board with a thorough review of the Company's cybersecurity program, including current status, industry risks and exposure, and future strategy.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect Bio-Techne, including our business strategy, results of operations or financial condition. However, please see Item 1A. Risk Factors – "A significant disruption in, or breach of security of, our information technology systems or data, or violation of data privacy laws, could result in damage to our reputation, data integrity and/or subject us to costs, fines, or lawsuits under data privacy or other laws or contractual requirements."


text: Cybersecurity Risk Management and Strategy Bio-Techne's cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our internal and our customers' data while supporting our and our customers' business needs. Our cybersecurity program follows industry standards and best practice for preventing, detecting, remediating, and mitigating potential cybersecurity threats, including regular processes to identify, evaluate and manage potential risks.


text: Our IT Security Operations team administers and monitors the prevention, detection, mitigation, and remediation of potential cybersecurity risks. This team leverages both Bio-Techne's internal IT resources, including its personnel, as well as managed security service providers and other third-party security software and technology services, as well as through other means. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity, including risks arising from our use of third-party providers software and service providers. In addition to our evolving processes and systems, we foster a culture of cybersecurity education, training, and testing. Every year, employees must take and pass rigorous information security and protection training.


text: We partner with experienced external consultants to assess our cybersecurity program, and to perform penetration testing as well as other testing programs designed to identify vulnerabilities and areas for fortification. Also, as part of our cybersecurity risk management program we maintain cyber insurance, with coverage amounts and terms that are typical and appropriate for a company of our size and type. This insurance may not be sufficient to cover us against all types of claims related to security breaches, cyberattacks and other related breaches.


text: As a leading global, diversified animal health and mineral nutrition company, we are increasingly reliant on information technology systems and infrastructure to support critical operations and manage our business effectively. These systems process, transmit, and store electronic information, including customer, employee, and company data. This reliance exposes us to data security breaches and cybersecurity attacks. For more information on these risks, see "Item 1A. Risk Factors — Risk Factors Relating to Our Business — We may be subject to information technology system failures, network disruptions, and breaches in data security."

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Although the aggregate impact on our operations and financial condition has not been material to date, the Company has been the target of cybersecurity attacks and anticipates continued attempts as threats become more sophisticated and frequent. Future incidents may have a material effect on our business.


text: Our information security program is led by the Director of IT Cybersecurity and Compliance, who reports directly to the Chief Information Officer (the "CIO"). The program is aligned with the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Israel National Cyber Directorate. We are also members of the New Jersey Cybersecurity and Communications Integration Cell, which enhances our industry awareness and proactive response capabilities by facilitating information sharing, identifying attack profiles, and promoting continuous improvement.


text: We employ a range of tools and practices to assess, monitor, and mitigate cybersecurity risks. These practices extend to third-party service providers who have access to our systems and data. At least every two years, we engage an independent third party to conduct penetration testing and risk assessments of our cybersecurity posture.


text: Over the past year, we have made significant progress in strengthening our cyber defense capabilities. Our Security Operations Center and Managed Detection and Response services continue to evolve and improve daily. This progress is driven by real-time incident response, continuous team development, and the incorporation of lessons learned from both internal experiences and external industry intelligence. To complement these efforts, we have implemented an advanced cyber threat intelligence process that enhances our ability to detect threat actors, anticipate emerging risks, and align our detection and prevention strategies with global threat trends. Monthly cybersecurity training for all users; Bi-weekly phishing simulations; and A monthly interactive cyber awareness magazine.


text: The rapid emergence of AI technologies has had a notable impact on our operational and strategic environment. These technologies quickly entered our ecosystem, and we responded by implementing necessary user awareness programs and governance mechanisms. Responsible adoption of AI technologies remains a key focus area. Our efforts encompass raising organizational awareness, deploying suitable monitoring tools, and fostering innovation while ensuring compliance with privacy regulations and industry standards. Our program continues to evolve to ensure the safe, ethical, and compliant use of AI across the enterprise.


text: In parallel, we are enhancing our third-party cybersecurity and regulatory risk management framework. This includes a structured process for evaluating and monitoring external entities using standardized risk questionnaires, internal knowledge repositories, and validation procedures. These mechanisms are applied both prior to onboarding new suppliers, service providers, or technologies, and as part of periodic reviews of existing third-party relationships. Identify security and compliance gaps early in the vendor lifecycle;


text: Prioritize suppliers based on their risk profile and level of exposure; and Ensure that third-party engagements align with our corporate, regulatory, and contractual obligations. Together, these measures strengthen our organizational cyber resilience, regulatory preparedness, and long-term operational integrity.


text: In the event of a cybersecurity or data privacy incident, our triage team evaluates the probable frequency and magnitude of potential loss. Incidents are categorized by severity and escalated to the CIO, Chief Executive Officer, and the Senior Vice President, General Counsel, and Corporate Secretary ("Legal Counsel"), who determine any additional communication or disclosure requirements. The Board of Directors is notified of high-severity incidents. Each incident is followed by a formal investigation, root cause analysis, and remediation plan. Additionally, our cyber insurance program is reviewed regularly to ensure adequate coverage in support of our layered protection model.


text: Our CIO manages our information technology systems. He has over 45 years of experience in digital systems and technology in the animal health, bio-tech pharmaceutical, pharmaceutical, and oil and gas industries. He has held multiple leadership roles driving business value for investments in digital solutions. He also spent six years as a leader within internal auditing, providing experience and wisdom in business-driven risk management.


text: The CIO provides periodic reports to the Board of Directors, the executive management team, and our Legal Counsel. These reports include updates on our cybersecurity risks and threats, assessments of our information security program, and any changes in the threat landscape. Our information technology systems are regularly evaluated by internal and external consultants, with the results of the review reported to the executive management team and the Board of Directors.


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: VSEE HEALTH, INC.

ticker: VSEE


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.


text: In addition, our Board of Directors will oversee any cybersecurity risk management framework and a dedicated committee of our Board of Directors or an officer appointed by our Board of Directors will review and approve any cybersecurity policies, strategies and risk management practices.


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats. For a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section.


text: IRadimed employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third-party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis.

companyName: IRADIMED CORP

ticker: IRMD


text: Our cybersecurity team works in conjunction with management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. The Chief Executive Officer is responsible for overseeing our information technology leadership team and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into IRadimed's enterprise risk management process, and our information technology leadership team reviews the Company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into the enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to, information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing, training and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources; and the formation of a multidisciplinary cybersecurity incident response team.


text: The Board provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risks and assists the Board of Directors in fulfilling its oversight responsibilities regarding Company policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing our information security policies and internal controls regarding information security; and reviewing the annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the cybersecurity program and receives regular updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. The Audit Committee oversees the Company's disclosure of any cybersecurity incident deemed material (and such materiality determination will be made by the Board upon recommendation of the Audit Committee) as required by the SEC or any other governmental authority, as applicable. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of vertical applications are required to document user access reviews regularly. We request a System and Organizational Controls ("SOC") 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, IRadimed invests significantly in the cybersecurity elements outlined above. In addition, the Company has made investments to fulfill the operational and financial regulatory requirements laid out by the Sarbanes-Oxley Act of 2002.


text: IRadimed faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: iBio, Inc.

ticker: IBIO


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. iBio's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on iBio's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. iBio acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: Cybersecurity, Risk Management, Strategy and Governance There continues to be a rise in electronic fraudulent activity security breaches and cyber-attacks within the financial services industry. We are confronted with a spectrum of cyber threats, ranging from common attacks such as ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners. Maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and to maintain customer confidence in our financial services.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security ("IS") Officer leads our cybersecurity program, reporting directly to the Chief Risk Officer ("CRO") and provides reports and updates to the information Technology ("IT") Committee, and the Board of Directors monthly or more frequently as required.


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Information Technology Officer.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The Incident Response Team ('IRT") members include senior management and other relevant personnel with defined roles and responsibilities. The IRP addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. The IRT is notified of all incidents, and incidents are elevated to the Board of Directors when warranted.


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness. We have regular and ongoing security education and training for employees and recovery and resilience tests. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessments results are shared with the IT Committee and Board of Directors.


text: Our information assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our IS and IT teams meet to ensure that risks are timely identified, patches and vulnerability requirements are monitored, and the necessary changes are implemented.


text: Our IT governance ensures alignment between the Company's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Company's risk appetite.


text: Oversight and Identification of Risks Associated with Third Parties Third party risk management is a component of our vendor management program. New vendors are reviewed prior to onboarding to ensure proper oversight and identify potential risks. Ongoing monitoring of emerging risks related to third-party services providers is performed periodically according to the vendor's risk rating. Vendor reviews include risk reviews for financial, reputation, information security, cybersecurity and business resiliency risk. These reviews are reported to the IT Committee and Board of Directors for approval..


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements and guidance regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the timely recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If a financial institution fails to observe the regulatory guidance, they could be subject to various regulatory sanctions, including financial penalties.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations to store and transmit sensitive data. We employ a layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our cybersecurity program is managed by the Information Security Officer who leads our IS team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Officer provides periodic reports to the IT Committee and Board of Directors. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operations Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.


text: Our Information Security Officer has more than 40 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security, information technology, and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from Missouri State University with focus on Business Administration Systems coursework.


text: Processes for Assessing, Identifying and Managing Risks from Cybersecurity Threats We, like any other organization operating in the biotechnology and pharmaceutical space, are subject to cybersecurity threats. In order to be prepared to respond to a potential cybersecurity threat, we have implemented an Information Technology ("IT") Security Guidelines Policy. Such policy sets forth a framework for management of all Company-managed IT systems and equipment. In connection with such policy, we have also implemented an IT Security Incident Response Plan, which sets forth processes in the event of a suspected cybersecurity incident. The processes set forth in such IT Security Incident Response Plan are part of our overall enterprise risk management system. As set forth in the IT Security Incident Response Plan, we may engage third-party consultants to assist us with the response to any suspected cybersecurity incident. We engage third parties on a periodic basis in connection with our overall enterprise risk management assessment. With respect to third-party service providers that we may engage in connection with our day-to-day operations, we attempt to assess such service provider's processes regarding potential cybersecurity threats in connection with first engaging such service provider.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Head of Human Resources, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition for the years of financial statements presented in this report.


text: Notwithstanding the approach we take to cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of risks related to cybersecurity threats.


text: Oversight of Risks Related to Cybersecurity Threats Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: TXO Partners, L.P.

ticker: TXO


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a team of IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; and • cybersecurity awareness training of all our employees.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business could be negatively affected by security threats, including cybersecurity threats, and other disruptions".


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program described above.


text: Our Manager of Information Technology periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives reports from our IT team on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.


text: Our IT team, including our Manager of Information Technology, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents that impact our systems and information through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our corporate IT environment.


text: Our Manager of Information Technology is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for leading our overall cybersecurity risk management program. Our Manager of Information Technology has over 20 years of experience in the cybersecurity field.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including information pertaining to Hosts, guests, employees, and other users. Our cybersecurity risk management program includes a cybersecurity incident response plan ("Incident Response Plan").

companyName: Airbnb, Inc.

ticker: ABNB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and, while distinct in certain aspects described below, the program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information security team who, in collaboration with the broader technology organization, manages and maintains our (1) cybersecurity risk assessment processes including our Incident Response Plan, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • an Incident Response Plan that includes procedures for recognizing and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Risk and Compliance Committee (the "Audit Committee") oversight of cybersecurity, privacy and other information technology risks. The Audit Committee has responsibility for oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports and briefings from management on our cybersecurity risks and cybersecurity risk management program updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Legal Officer, our Chief Security Officer and our Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security team and our retained external cybersecurity consultants. Our management team has over 20 years of cybersecurity technology leadership experience.


text: Our management team supervises our information security team's efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, or external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including information pertaining to hosts, guests, employees, and other users. Our cybersecurity risk management program includes a cybersecurity incident response plan ("Incident Response Plan").


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and confidential information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: EVERTEC, Inc.

ticker: EVTC


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and digital assets; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, senior management and our Board of Directors; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, based on their critically and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk factors - We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Information Technology Committee (the "IT Committee") oversight of cybersecurity and other information technology risks, which includes, among others things: • oversight of IT and cybersecurity related risks with regard to the Company's IT platforms and investments; • advising and making recommendations to the Board regarding the state of the Company's cybersecurity preparedness, including review of the threat landscape facing the Company; and • monitoring and evaluating the effectiveness of IT security and cybersecurity protocols within the Company, including disaster recover capabilities.


text: The IT Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the IT Committee, as necessary, regarding any significant cybersecurity incidents.


text: Board members receive presentations on cybersecurity topics. For example, February 2024, the full Board held a cybersecurity tabletop exercise to help prepare to respond to a cyberattack or other security incident.


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 17 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 18 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.


text: At Rapid7, cybersecurity risk management is integrated into our overall enterprise risk management program and is one of the pillars of our broader cybersecurity program. Our cybersecurity risk management program is designed based on prevailing security standards and controls, such as NIST-800 and ISO 27001, and to continuously evaluate cybersecurity risks in alignment with our business objectives and operational needs. Our information security team manages a framework for handling both information security risk management and operational cybersecurity threats and incidents, including those associated with the use of products and services provided by third-party service providers, suppliers, and vendors. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of such cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party service provider, supplier, or vendor), implementing cybersecurity countermeasures and mitigations and an escalation path for informing management, the audit committee of the board of directors (the "Audit Committee"), and our full board of directors (the "Board") of cybersecurity threats, incidents and risks.

companyName: Rapid7, Inc.

ticker: RPD


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, consultants, and auditors in evaluating and supporting our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Our cybersecurity program, which is managed by our information security team, includes: • efforts to comply with prevailing cybersecurity standards; • regular risk assessments and annual penetration tests designed to help identify potential cybersecurity risks to our critical systems, networks, products, services, and our broader enterprise information technology environment; • a cybersecurity incident response plan and procedures for responding to cybersecurity threats and incidents; • a security operations team responsible for detection of, and response to, cybersecurity threats and incidents; • a third-party risk management process for third-party service providers, suppliers, and vendors; and • annual cybersecurity awareness training of our employees, including senior management.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risk management. Our Audit Committee consists of Board members with a diversity of expertise in risk management, technology, finance, and cybersecurity, including oversight of security teams. The Audit Committee is responsible for overseeing that management has processes in place designed to identify, assess and manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. The Audit Committee also reports on the cybersecurity program to our Board.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Security Officer ("CSO"), who receives reports from our information security team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CSO and dedicated personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications. Management, including the CSO and our information security team, regularly update the Audit Committee on the Company's cybersecurity program, including cybersecurity vulnerabilities, risk, threats and incidents, and developments in the cybersecurity risk landscape.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: At Rapid7, cybersecurity risk management is integrated into our overall enterprise risk management program and one pillar of our broader cybersecurity program. Our cybersecurity risk management program is designed based on prevailing security standards and controls, such as NIST-800 and ISO 27001, and to continuously evaluate cybersecurity risks in alignment with our business objectives and operational needs. Our information security team manages a framework for handling both information security risk management and operational cybersecurity threats and incidents, including those associated with the use of products and services provided by third-party service providers, suppliers, and vendors. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of such cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party service provider, supplier, or vendor), implementing cybersecurity countermeasures and mitigations and an escalation path for informing management, the audit committee of the board of directors (the "Audit Committee"), and our full board of directors (the "Board") of cybersecurity threats, incidents and risks.


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, consultants, and auditors in evaluating and supporting our risk management systems. Our collaboration with these third parties includes regular independent audits, threat assessments, and consultation on security enhancements.


text: Our cybersecurity program, which is managed by our information security team, includes: • efforts to comply with prevailing cybersecurity standards; • regular risk assessments, security assessments and penetration tests designed to help identify potential cybersecurity risks to our critical systems, networks, products, services, and our broader enterprise information technology environment; • a cybersecurity incident response plan and procedures for responding to cybersecurity threats and incidents; • a security operations team responsible for detection of, and response to, cybersecurity threats and incidents; • a third-party risk management process for third-party service providers, suppliers, and vendors; and • annual cybersecurity awareness training of our employees, including senior management.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Security Officer ("CSO"), who receives reports from our information security team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CSO and dedicated personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications. Management, including the CSO and our information security tea m, regularly update the Audit Committee o n the Company's cybersecurity program, including cybersecurity vulnerabilities, risk, threats and incidents, and developments in the cybersecurity risk landscape.


text: As discussed further in "Item 1. Business—Our Manager and Ellington," we are externally managed and advised by our Manager, an affiliate of Ellington. Our Manager does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. We rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Ellington Credit Co

ticker: EARN


text: Ellington's cybersecurity processes and practices are integrated into Ellington's risk management and oversight program. In general, Ellington seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Ellington collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur.


text: Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Trustees' oversight of cybersecurity risk management is supported by the Audit Committee of our Board of Trustees (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board of Trustees, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect the Company. While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.


text: Our Board of Trustees, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at Ellington, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Ellington employs internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.


text: Ellington's cybersecurity team is lead by Ellington's outsourced Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has lead large technical efforts such as the development of Ellington's proprietary whole loan management system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has lead several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: As discussed further in "Item 1. Business—Our Adviser and Ellington," we are externally managed and advised by our Adviser, an affiliate of Ellington. Our Adviser does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. We rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of our Board (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect us. Cyber criminals do, however, target us, Ellington and Ellington's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or Ellington's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors—We are highly dependent on Ellington's information systems and those of third-party service providers, including mortgage servicers, and system failures could significantly disrupt our business, which could materially adversely affect our business, financial condition and results of operations, and our ability to pay dividends to our shareholders." and "—Because we are highly dependent on information systems when sharing information with third party service providers, systems failures, breaches or cyber-attacks could significantly disrupt our business, which could have a material adverse effect on our results of operations and cash flows."


text: While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.


text: Our Board, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at Ellington, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Ellington employs internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.


text: Ellington's cybersecurity team is led by Ellington's Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has led large technical efforts such as the development of Ellington's proprietary internally hosted rapid application system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has led several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct periodic data handling and use requirement training for our employees; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • Conduct regular phishing email simulations for all employees Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our tenant and employee data or our systems. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.


text: We understand the importance of preventing, assessing, identifying and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies and controls to assess, identify and manage material risks. Specifically, we engage a third-party information technology and cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.


text: To manage our material risks from cybersecurity threats and to protect against, detect and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • monitor emerging data protection laws and implement changes to our processes to comply; • conduct periodic data handling and use requirement training for our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • conduct regular phishing email simulations for all employees.


text: Our incident response plan coordinates the activities that we and our third-party information technology and cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement and compliance.


text: Our Audit Committee of the Board is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Our management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology and cybersecurity personnel and our third-party vendors. Our management team supervises efforts to prevent, detect and mitigate cybersecurity risks and incidents through various means, which may include briefings from both internal and external information technology and cybersecurity personnel, threat intelligence and other information obtained from governmental, public or private sources as well as alerts and reports produced by security tools deployed in our information technology environment.