text: The Company has also established a process to identify and assess potential risks arising from cybersecurity threats associated with our use of critical third-party service providers. This process includes, as appropriate, conducting assessments of third-party providers' cybersecurity capabilities and reviewing third party providers' processes for alignment with our internal cybersecurity requirements.


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.

companyName: AbCellera Biologics Inc.

ticker: ABCL

secItem: Item 1C


text: The Chief Legal and Compliance Officer (CLO), and our dedicated information technology (IT) team, lead the Company's overall cybersecurity efforts. The CLO oversees the Company's cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, risks from cybersecurity threats. As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board.


text: Management is responsible for the day-to-day management of risks we face, while our Board of Directors (Board), as a whole and through its committees, provides guidance on the oversight of risk management.


text: The Audit Committee reviews the effectiveness of the Company's governance and management of cybersecurity risks, including those relating to business continuity, regulatory compliance and data management. The Audit Committee, at least annually, reviews and considers the results of our ERM process, including as it relates to risks from cybersecurity threats, and provides updates, as appropriate or required, to management and the Board.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. In partnership with our designed outsourced technology provider, we have implemented extensive processes and controls to assess, manage and protect against material risks from cybersecurity threats, including the following: • a managed detection and response platform that is monitored at all times by members of our third-party technology provider's Security Operations Center team; • periodic penetration testing and vulnerability scans; • quarterly cybersecurity training and phishing email exercises for all employees and officers; • vendor cybersecurity diligence; • cybersecurity insurance; and • a cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to "Risk Factors – Risks Related to our Company and Structure – Operational risks, including the risk of cyberattacks, may disrupt our business, resulting in loss or limited growth" in Item 1A of this Annual Report on Form 10-K for an additional description of our cybersecurity risk and the potential related impacts.


text: Pursuant to its charter, the Audit Committee of our board of directors oversees our risk management program, which focuses on the most significant risks we face, including cybersecurity risks. Audit Committee meetings include discussions of specific risk areas, and our Chief Compliance Officer, or our CCO, regularly reports to the Audit Committee on cybersecurity risks we face, as well as the status of measures undertaken by the Company to manage those risks. Pursuant to our Incident Response Plan, the chair of the Audit Committee will be notified in the event of a cybersecurity incident meeting a specified severity level. In addition, all members of our board of directors, including members of the Audit Committee, participate in quarterly training on cybersecurity threats, including those facing the Company.


text: Our CCO and our Chief Financial Officer, or our CFO, work collaboratively with senior members of our outsourced technology firm to comprise our Cybersecurity Team. Our Cybersecurity Team has primary responsibility for overseeing, implementing and managing our processes and controls to assess, identify and manage material risks from cybersecurity threats, including those described above in Risk Management and Strategy.


text: Our Incident Response Team, in coordination with external advisors, is responsible for responding to and managing cybersecurity incidents pursuant to our Incident Response Plan. Our Incident Response Team includes our Cybersecurity Team and our Chief Executive Officer, along with other Company personnel as appropriate based on the nature of the incident.


text: The members of our Cybersecurity Team have various levels of experience in information technology and cybersecurity matters. Our third-party technology firm is a global information technology and cybersecurity provider with a seasoned executive team possessing decades of experience and various cybersecurity certifications, such as Certified Information Systems Security Professional certification. Our CCO and CFO each has extensive experience managing risks at the Company, including risks arising from cybersecurity threats. Our CCO also holds a CERT Certificate in Cybersecurity Oversight issued from the CERT Division of the Software Engineering Institute at Carnegie Mellon University and the National Association of Corporate Directors.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. In partnership with our outsourced technology provider, we have implemented extensive processes and controls to assess, manage and protect against material risks from cybersecurity threats, including the following: • a managed detection and response platform that is monitored at all times by members of our third-party technology provider's Security Operations Center team; • periodic penetration testing and vulnerability scans; • quarterly cybersecurity training and phishing email exercises for all employees and officers; • vendor cybersecurity diligence; • cybersecurity insurance; and • an Incident Response Plan that includes procedures for responding to cybersecurity incidents.


text: Our Incident Response Team, in coordination with external advisors, is responsible for responding to and managing cybersecurity incidents pursuant to our Incident Response Plan. It includes our Cybersecurity Team, our Chief Executive Officer and other Company personnel as appropriate based on the nature of the incident.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Funko, Inc.

ticker: FNKO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We perform an annual assessment to measure the maturity of our information security program in a manner aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any specific technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to implement controls to combat and respond to cybersecurity risks.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a designated team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management and • a third-party risk management process for certain service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A: Risk Factors" above for additional information on risks related to, for example risks related to cyber-attacks, information and system breaches, and technology disruptions and failures; our reliance on using and protecting certain intellectual property rights; keeping pace with technological developments; legal and regulatory developments; and obtaining hardware, software and operational support from third-party vendors.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of overall risk assessment and management, which includes cybersecurity and other information technology risks.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as where it deems appropriate, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management and senior IT team, including our Interim Chief Executive Officer, Chief Financial Officer and Operating Officer, Chief Legal Officer, Sr. Director, IT Infrastructure and Operations, and SVP, People & Culture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team's experience includes over 40 years in system engineering, risk management, data privacy and compliance monitoring. We also engage an external Data Protection Officer to monitor data collection and security in the European Union.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a designated team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management and • a third-party risk management process for certain service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to, for example risks related to cyber-attacks, information and system breaches, and technology disruptions and failures; our reliance on using and protecting certain intellectual property rights; keeping pace with technological developments; legal and regulatory developments; and obtaining hardware, software and operational support from third-party vendors.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as where it deems appropriate, regarding any material cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management and senior IT team, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Global Head of Technology, and SVP, People & Culture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global Head of Technology's experience includes over 20 years in system engineering, risk management, data privacy and compliance monitoring. We also engage an external Data Protection Officer to monitor data collection and security in the European Union.


text: Risk Assessment and Management We have become increasingly dependent upon digital technologies, including information systems, infrastructure and cloud applications and services, to operate our businesses, process and record financial and operating data, communicate with our employees and business partners, analyze seismic and drilling information, estimate quantities of met coal reserves, as well as other activities related to our businesses. We own and operate some of these systems and applications while others are owned and operated by third-party service providers.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. This program, along with a robust information technology internal controls framework, helps to ensure the confidentiality, integrity and availability of our information systems. The program includes elements for identifying, assessing and managing material risks from cybersecurity threats. Our incident response and change management policies and procedures were designed based on guidelines from the National Institute of Standards and Technology Cybersecurity Framework.


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. We employ continuous monitoring systems and other technologies and security controls to assist us with the identification of cybersecurity risks and threats. At least annually we conduct a third-party risk assessment to identify cybersecurity risks associated with third-party vendors and service providers. When cybersecurity risks are identified, we prioritize mitigation strategies based upon risks' potential impact, likelihood, velocity and vulnerability, considering both quantitative and qualitative factors. These strategies include, among others, the application, adoption or modification of cybersecurity policies and procedures, implementation of administrative, technical and physical controls and employee training, education and awareness initiatives.


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. Our Information Systems and Technology Department (the "IT Department") monitors security alerts or indicators and initiates triage, verification and remediation actions when needed. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.


text: In the event of a significant cybersecurity incident, we establish an incident response team that works in conjunction with the IT Department to identify, contain, eradicate and, if necessary, recover from a cybersecurity incident. Through third parties we are also able to rapidly deploy forensic analysis, legal services, notification and call center services and credit and identity monitoring if required.


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Further, our cybersecurity program is periodically reviewed by senior members of management and adjusted as needed in an effort to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge and regulations change.


text: We separately operate an enterprise risk management ("ERM") program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.


text: We maintain an incident response policy and program focused upon detecting, managing, documenting and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we appoint a dedicated incident team, including a team leader, responsible for managing and coordinating incident response efforts. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. At least annually we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. Additionally, we employ a number of third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technology initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective and responsive measures. For additional discussion of our cybersecurity related risks, see "Item 1.A Risk Factors."


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, other members of senior management and other personnel and advisors, as requested by the Board, report on our financial, operating and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.


text: The Audit Committee. The Audit Committee reviews with our management team, including our Senior Vice President – Information Systems and Technology, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies and risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Senior Vice President – Information Systems and Technology, who reports to our Chief Financial Officer. The IT Department's security team, a cross-functional group composed of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation and remediation of cybersecurity incidents and also for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.


text: In addition, we operate an enterprise risk management ("ERM") program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.


text: Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Senior Vice President – Information Systems and Technology, who reports to our Chief Financial Officer. The IT Department's security team, a cross-functional group composed of members who all have 12 to 26 years of professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation and remediation of cybersecurity incidents and also for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.


text: At Cannae, the board of directors oversees management's process for identifying and mitigating risks, including cybersecurity risks. Senior leadership, including our Chief Information Security Officer ("CISO"), works diligently to identify, assess and manage material risks through our Enterprise Risk Management ("ERM") program. As part of that program, we conduct risk assessments to identify and assess our material business, operational and environmental risks and works with our management team to develop strategies and plans to mitigate and manage those risks, including cybersecurity risks related to the use of third-party service providers.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: Our ERM program is overseen by a group of proficient individuals and is tailored to the unique structure of our business. As a holding company with a small group of highly qualified employees, we are well positioned to maintain operations in the event of a disaster or a material disruption to our information technology ("IT") infrastructure and networks. Our CISO has extensive information technology and program management experience as do many of the employees in the information security group for our third-party provider. Our CISO, as well as others in our third-party provider's information security group, hold certifications such as the Certified Information System Security Professional certification. Each of our various businesses separately maintains business continuity functions that adhere to the unique requirements of their business.


text: On an ongoing basis, management assesses the cybersecurity risks of Cannae and aligns its procedures and its audit plan with the identified and addressable risks. The underlying controls of the cyber risk management program are based on the recognized standards as outlined in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We utilize a third party to manage our IT network and processes and our ERM personnel work directly with the provider on all aspects of the Company's IT infrastructure and cybersecurity risks. Risks are evaluated over various timeframes; however, the focus of management's risk assessment is on risks to the long-term solvency and sustainability of the ongoing operations of Cannae. Risks with the potential for an adverse impact to the Company in the near term are prioritized to the extent they present a material risk to the financial viability of the Company.


text: We apply a comprehensive approach to the mitigation of identified security risks, including monitoring our third-party IT service provider and management of our unconsolidated affiliates. As a holding company with relatively low volumes of personnel and third-party data, we have established policies, procedures and controls, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of IT risk monitoring and risk mitigation techniques tailored to the unique nature of our business, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and business continuity management.


text: In the event of a cybersecurity incident, we have established protocols for management's response to incidents and we regularly test those protocols with appropriate management personnel. Such protocols include an incident response playbook with the assessment of cybersecurity risks and procedures and hierarchies for escalating and reporting incidents to executive management, the board of directors, investors, government agencies and the general public.


text: The employees at our consolidated companies are the strongest assets in protecting information and mitigating risk. We monitor the security practices of our employees, including training programs that focus on applicable privacy, security, legal, and regulatory requirements that provide ongoing enhancement of their respective security and risk cultures. Our employees participate in an annual Information Security Training.


text: The Board administers its risk oversight function directly and through committees and our Board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy are overseen by the audit committee. At each regular meeting of the audit committee of our Board, management provides reports relating to existing and emerging risk at our companies, including, as appropriate, cyber and data security risks, and any security incidents. At least annually (or more frequently in the event of material changes to the Company) the update to the audit committee includes a summary of management's complete reassessment of the Company's risk and control environment identified through our ERM program. Our audit committee chairman reports on these discussions to our Board on a quarterly basis.


text: See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity and IT.


text: Our ERM program is overseen by a group of highly-qualified individuals and is tailored to the unique structure of our business. As a holding company with a small group of highly qualified employees, we are well positioned to maintain operations in the event of a disaster or a material disruption to our information technology ("IT") infrastructure and networks. Our CISO has extensive information technology, cybersecurity and program management experience as do many of the employees in the information security group for our third-party provider. Our CISO, as well as others in our third-party provider's information security group, hold certifications such as the Certified Information System Security Professional certification. Each of our various businesses separately maintains business continuity functions that adhere to the unique requirements of their business.


text: We recognize that the safety and security of our systems, technology and infrastructure (and those of key third-party service providers upon which we rely), as well as our content and confidential or sensitive user and employee information, is critical to maintaining the trust and confidence of our users and subscribers, consumers, advertisers and investors (among other stakeholders). As a result, Company management has established programs and related processes designed to manage cybersecurity issues, including the assessment, identification and management of cybersecurity risks, together with related mitigation and recovery efforts. Our board of directors, directly and through our Audit Committee, oversees Company management in the execution of its cybersecurity responsibilities, including the assessment of the Company's approach to cybersecurity risk management.

companyName: Angi Inc.

ticker: ANGI


text: Cybersecurity Risk Management and Strategy Overview. Our cybersecurity programs and related processes generally consist of the following key elements: (i) risk assessment and management efforts, (ii) technical safeguards and incident response and recovery efforts, (iii) third-party risk management efforts, (iv) education, training and preparedness efforts and (v) governance efforts.


text: Risk assessment and management efforts. We assess, identify and manage cybersecurity risks as part of a comprehensive information security program that is intended to align with standard industry frameworks, such as International Standard for Organization (ISO) 27000 and the National Institute of Standards and Technology (NIST) Cyber Security Framework.


text: As part of the ongoing refinement of our information security program, we engage (as appropriate) various third-party risk management services to assist with the identification of potential cybersecurity issues, such as those involving software vulnerabilities, configuration errors, data exposure and credential theft (among others), as well as consult with external legal counsel, third-party experts and other advisors to assist with incident response and recovery efforts, forensic investigations, extortion negotiations and crisis management or readiness for the same. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur.


text: In addition, as discussed in more detail below under the caption "Cybersecurity Governance," the assessment, identification and management of cybersecurity risks have been integrated into our overall enterprise risk management ("ERM") efforts.


text: Technical safeguards and incident response and recovery efforts. As part of our information security program, we have implemented a number of tools and procedures designed to identify and remediate vulnerabilities and misconfigurations in our applications and infrastructure, as well as manage access and identities throughout their lifecycles. These tools and procedures are intended to be consistent with ISO and NIST frameworks. In addition, we have implemented an incident response policy that outlines established processes for addressing cybersecurity issues that leverages a cross-functional cybersecurity incident response team and outside advisors intended to allow the Company to take action in a timely and decisive manner in compliance with applicable laws, rules and regulations during the response, investigation and remediation of a given cybersecurity incident.


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.


text: Education, training and preparedness efforts. Education, training and preparedness are an important part of our information security program. In connection with our education and training efforts, we have developed and implemented a set of Company-wide policies and procedures regarding cybersecurity matters that impose responsibility on our employees through the course of their work to: (i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner. In addition, we generally mandate information security training for our employees and our software developers generally receive mandatory additional technical training, each on an annual basis. In connection with our preparedness efforts, we periodically participate in tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur. We also maintain documented incident response policies to help ensure that our response activities are consistent and appropriate. Governance. See the disclosure under the caption "Cybersecurity Governance" below.


text: Our board of directors is responsible for overseeing Company management's execution of its cybersecurity responsibilities, including our approach to cybersecurity risk management. Our board of directors executes this oversight in coordination with our Audit Committee, which pursuant to its charter, assists the Board with risk assessment and risk management policies as they relate to cybersecurity risk exposure (among other risk exposures), as well as part of its regularly scheduled meetings and through discussions with Company management on an as needed basis.


text: In addition, the assessment, identification and management of cybersecurity risks has been integrated into our ERM efforts. As part of that annual process, cybersecurity risks across our businesses are included in the risk universe that our Executive Risk Committee (consisting of members of Company senior management) evaluates to identify our top enterprise risks and develop related mitigation plans. The cybersecurity and other risks are reviewed during the year through our ERM process and discussed with our Audit Committee at least semi-annually and with our board of directors at least annually.


text: Our Chief Technology Officer ("CTO") is responsible for the development and implementation of our information security program on a Company-wide basis, together with a dedicated team of experienced, Company-wide information security analysts. Our CTO has over twenty years of experience leading the development, implementation, and oversight of information security programs. Other members of our information security team are generally seasoned professionals with broad cybersecurity experience and expertise, including with respect to cybersecurity threat assessment and detection, mitigation technologies, incident response, and training on such topics.


text: Our CTO is also responsible for reporting on the status of our information security program and related efforts and processes to Company senior management periodically, and to the Audit Committee on a quarterly basis. In addition, our CTO reports cybersecurity matters to Company senior management and the Audit Committee on an as-needed basis. At each regularly scheduled meeting of our board of directors, the Chair of our Audit Committee provides quarterly updates regarding significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled board meeting (including cybersecurity matters, as and if applicable), as well as timely updates outside of quarterly updates on an as needed basis. Our CTO promptly informs Company management and our Audit Committee (and IAC management) of cybersecurity incidents that meet established reporting thresholds or when otherwise determined appropriate, as well as provides ongoing updates regarding any such incidents until they have been resolved.


text: Cybersecurity Risks As discussed above and under Item 1A. Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure from time to time. While to our knowledge we have not, to date, experienced a cybersecurity incident or threat that has materially and adversely affected our business, financial condition and results of operations, we cannot provide assurances that they will not be materially affected in the future by such incidents.


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party service provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.


text: Cybersecurity Risks As discussed above and under Item 1A. Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and from time to time we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Our cybersecurity and information technology ("IT") program includes a number of safeguards, such as network segmentation, conditional analysis, external threat monitoring, access and authentication controls, incident response planning and testing of controls and procedures. We assess for internal and external vulnerabilities through the use of quarterly vulnerability scanning, annual third-party penetration testing and periodic cybersecurity maturity assessments. The results from these assessments are comprehensively addressed based on risk priority and are used to continually improve our cybersecurity risk posture.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors and annual due diligence with respect to key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.


text: Our employees receive regular cybersecurity training to address a broad range of key and emerging issues. In addition, we provide additional periodic training modules to address emerging threats or trends within the cybersecurity environment, perform regular simulated phishing exercises and require comprehensive cybersecurity training for all new employees.


text: We utilize expert cybersecurity independent consultants, including a contracted Chief Information Security Officer ("CISO") and additional third-party managed service providers, who work with and reports to our Vice President of Accounting and Administration ("VPAA") to identify potential risks from cybersecurity threats and proactively mitigate their potential impact. The CISO and related team have extensive experience in assessing, detecting, responding and mitigating cybersecurity risk, including holding several different relevant certifications as well as experience working with, and assessing cybersecurity risk of, IT managed service providers.


text: The CISO and his related team perform regular assessments and vulnerability tests and work with other third-party service providers to perform penetration testing and periodic cyber maturity assessments on our behalf through our Enterprise Risk Management ("ERM") framework. Our CISO and related team work with our VPAA and third-party managed service provider to manage IT troubleshooting and user experience. Additionally, along with our own relationships, we benefit from the extensive third-party service provider relationships of our CISO, which may be used to assist with cybersecurity containment and remediation efforts.


text: We perform specific cybersecurity risk assessments, which are informed by our ongoing vulnerability assessments, external penetration testing and cybersecurity maturity assessments, among other items. Additionally, cybersecurity and IT is also an element of the ERM assessment performed by management on an annual basis, with quarterly reassessments, under the supervision of the Audit Committee and Board of Directors.


text: In the event of a cybersecurity incident, we maintain a regularly tested incident response program, including response programs specifically designed for common threats. Pursuant to our escalation protocols, designated personnel, including our CISO and VPAA, along with appropriate members of our management and executive team, are responsible for assessing the severity/priority of a cybersecurity incident and associated threat, containing the threat, and remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.


text: Our Audit Committee, in connection with the Board of Directors, maintains oversight of our Enterprise Risk Management framework, including oversight over our cybersecurity and information technology policies and programs.


text: The CISO and VPAA meet with our IT Executive Committee, comprised of all of our executive officers, on at least a quarterly basis to oversee our cybersecurity and IT framework and more frequently in the event of significant cybersecurity developments. Our management team, including our CISO, updates the Audit Committee and Board of Directors at least twice a year with respect to key developments and updates relating to our cybersecurity and IT infrastructure and the overall threat environment, including recent and emerging trends. With respect to any significant cybersecurity events or incidents, the VPAA, along with the IT Executive Committee, reports to the Board of Directors promptly in accordance with our escalation protocols, as appropriate, depending on the nature of the events.


text: To date, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding cybersecurity risks, see " Item 1A. Risk Factors."


text: We utilize expert cybersecurity independent consultants, including a contracted Chief Information Security Officer ("CISO") and additional third-party managed service providers, who work with and report to our Vice President of Accounting and Administration ("VPAA") to identify potential risks from cybersecurity threats and proactively mitigate their potential impact. The CISO and related team have extensive experience in assessing, detecting, responding and mitigating cybersecurity risk, including holding several different relevant certifications as well as experience working with, and assessing cybersecurity risk of, IT managed service providers.


text: In the event of a cybersecurity incident, we maintain a regularly tested incident response program, including response playbooks specifically designed to address our areas of higher risk. Pursuant to our escalation protocols, designated personnel, including our CISO and VPAA, along with appropriate members of our management and executive team, are responsible for assessing the severity/priority of a cybersecurity incident and associated threat, containing the threat, and remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We also maintain cybersecurity insurance coverage; for more information regarding cybersecurity insurance, see " Item 1A. Risk Factors ".


text: Our Audit Committee, in connection with the Board of Directors, maintains oversight of our ERM framework, including oversight over our cybersecurity and information technology policies and programs.


text: Cybersecurity Risks To date, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding cybersecurity risks, see " Item 1A. Risk Factors ".


text: Cybersecurity Risks We rely on information technology systems and networks to process, transmit, and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers, and employees. We use various information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information, and personal information of our customers, suppliers, and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: urban-gro, Inc.

ticker: UGRO


text: Despite our security measures, our information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyberattacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position, and additional costs to remediate the issue.


text: Cybersecurity Practices We have implemented various measures to manage our risk of information technology systems and networks damage, disruption, or unauthorized access, including employee training, monitoring of our systems and networks, maintenance of backup and protective systems, and use of modern endpoint detection and response tools which are integrated into urban-gro's risk management systems and processes. We also operate in a fully cloud-based environment, which enhances our scalability, flexibility, and resilience and utilize 3rd parties to perform early internal and external vulnerability assessment and risk identification. We have established extensive backup and recovery procedures to ensure the continuity of our operations in a cyber incident. We also maintain cyber liability insurance coverage as part of our comprehensive risk management program. However, these measures may not be sufficient to prevent, detect, or mitigate the impact of such damage, disruption, or unauthorized access. Moreover, the regulatory environment related to information security, data protection, and privacy is increasingly demanding and complex, and compliance with applicable laws and regulations may result in significant costs or require changes in our business practices that could adversely affect our operations.


text: Cybersecurity Leadership Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors receives quarterly updates on our cybersecurity posture, threats, and incidents from our Senior Vice President of Technology. Our Board of Directors also delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls, and audit results. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.


text: Our cybersecurity operations are led by our Senior Vice President of Technology, who has over 20 years of experience in the field of cybersecurity. He is responsible for developing and implementing our cybersecurity strategy, policies, standards, and practices. He also oversees our cybersecurity team, which includes a staff member who recently completed his master's degree in cybersecurity. Our cybersecurity team monitors, detects, responds, and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.


text: urban-gro adheres to the NIST Cybersecurity Framework 2.0, which provides a set of standards, guidelines, and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities, and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted over 12 internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy, and our password policy. We regularly conduct phishing simulations, vulnerability scans, penetration tests, and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. We have experienced, and may continue to experience, cybersecurity incidents that could have a material adverse effect on our business, financial condition, results of operations, and prospects. For example, in 2019, we were a victim of a wire fraud scheme, in which a fraudulent party compromised the email account of one of our employees and sent a fraudulent wire transfer request to our bank. We believe the bank did not follow its verification procedures and executed the wire transfer without our authorization. Please see Legal Proceedings section for more information. After this incident, we implemented multi-factor authentication (MFA) across all our systems and email accounts, to prevent unauthorized access and impersonation. We also enhanced our internal controls and training to prevent and detect wire fraud and other cyber risks.


text: We face rapidly evolving and sophisticated threats of breaches of our systems and networks as well as those of our suppliers and third-party service providers. To mitigate this threat to our business, we take a comprehensive approach to cybersecurity and expend considerable resources on cybersecurity risk management, strategy, and governance.

companyName: Elastic N.V.

ticker: ESTC


text: We integrate our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats into our enterprise risk management program based on recognized frameworks and applicable standards. Our cybersecurity program encompasses the key elements described below:


text: Collaboration. We employ a cross-functional, risk-based approach to identify and address anticipated and real-time threats to our cybersecurity. Our internal security, risk, and compliance personnel meet regularly to develop strategies for preserving the confidentiality, integrity and availability of corporate, customer, and other third-party information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents, if applicable, can be made in a timely manner.


text: Risk Assessment. At least annually, we conduct a cybersecurity risk assessment that takes into account information from our internal security, risk, and compliance functions, known information security vulnerabilities, and information from external sources, including reported security incidents that have affected other companies, industry trends, and evaluations by third parties and consultants. We also conduct risk-based cybersecurity tabletop exercises periodically to test our internal readiness and response planning.


text: Our cybersecurity program includes a dedicated cybersecurity function led by our Chief Information Security Officer ("CISO"). As part of our cybersecurity function, our Distributed Security Incident Response Team ("DSRT") administers a program to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. The DSRT provides threat intelligence information from internal and external resources to our CISO, broader security and resiliency organization, and relevant business units and functional areas as one source within our risk assessment process. Our cybersecurity function partners closely with our Data Privacy organization, led by the Business Integrity Officer, and others within the Legal organization to ensure prompt response on data breach and any other regulatory notification requirements. We have incident response and recovery plans that we test and evaluate for effectiveness in accordance with industry standards.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of certain third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in the risk assessments, including information supplied by providers and third parties. In addition, we require these providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers.


text: External Assessments. Our cybersecurity program is regularly assessed by consultants and third-party auditors. These assessments include information security maturity evaluations, audits, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, our board of directors, and our Audit Committee. We adjust our cybersecurity processes based on these results. We have obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us. Information about such certifications can be found on our website.


text: Our board of directors oversees the Company's risk management process. It has delegated to our Audit Committee the primary responsibility for executing oversight of our cybersecurity risk management processes. In performing this role, the Audit Committee receives regular reports from our CISO and other members of management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. The Audit Committee also considers regular updates from management on our cybersecurity risk profile based on risk assessments, progress of risk reduction initiatives, third-party auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The Audit Committee reports quarterly to our board of directors regarding the Audit Committee's activities in overseeing cybersecurity risk management.


text: Our cybersecurity program efforts are directed by our CISO who, with the support of the chief operating officer, the chief product officer, and the chief legal officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements. Our CISO has served in various roles in information technology, information security and risk management for over 27 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.


text: Although our "Risk Factors" section in this report presents information about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. Notwithstanding our investment in cybersecurity, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition. Although we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured. For a discussion of cybersecurity risks affecting our business, see "Item 1A—Risk Factors—Risks Related to our Business and Industry—If we experience a security incident, or unauthorized access to or other unauthorized processing of confidential information, including personal data, otherwise occurs, our software may be perceived as not being secure, customers may reduce the use of or stop using our products, and we may incur significant liabilities."


text: We face rapidly evolving and sophisticated threats of breaches of our systems and networks as well as those of our suppliers and third-party service providers. To mitigate this threat to our business, we take a comprehensive approach to cybersecurity and expend corresponding resources on cybersecurity risk management, strategy, and governance.


text: Our cybersecurity program efforts are directed by our CISO who, with the support of the Chief Financial Officer, the Chief Product Officer, and the Chief Legal Officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements. Our CISO has served in various roles in information technology, information security and risk management for over 28 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess, and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company also engages third-party providers to conduct periodic internal and external penetration testing and maturity assessments. The Company stores data on premise and in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Ecovyst Inc.

ticker: ECVT


text: Our cybersecurity program is managed by the Cyber Incident Response Team (the "CIRT"), which is led by the Global IT Director, System Infrastructure Manager and the Network Infrastructure Manager, each with over 20 years of experience in IT. The CIRT serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The CIRT is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The CIRT classifies detected cyber incidents to allow prioritization, response and escalation. Incidents are documented for internal reporting processes and regularly shared with senior management.


text: In the event of a potential cybersecurity incident, the CIRT will conduct an assessment to determine the nature and scope of the incident and manages the incident in accordance with our incident response plan until the incident is contained and resolved. The CIRT will document findings and make them available to the Disclosure Committee, which includes cross functional senior management representation from information technology, legal, finance, investor relations and business segments. The Disclosure Committee, in conjunction with third-party experts, including outside legal counsel, is responsible for assessing the materiality of any cybersecurity incident and coordinating external communications and disclosures, including with the Securities and Exchange Commission.


text: On a quarterly basis, our employees, contractors, and other users of the Company's systems and networks are required to take cybersecurity training. The training is designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. These trainings are administered through a collaboration with third-party services and systems and address various topics, including how to handle sensitive and personal information, physical security of intellectual property, how to identify phishing attempts, reducing our risk to being phished and how to improve cybersecurity intelligence while working from home.


text: As of December 31, 2023, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for Ecovyst's management and Board of Directors. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain.


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board carries out its risk oversight and management responsibilities by monitoring risk directly as a full Board and, where appropriate, through its committees. The Board has delegated to the Audit Committee the responsibility to oversee the integrity of the Company's information technology and cybersecurity risks and to assess the risks and incidents relating to cybersecurity threats. While our Board and Audit Committee oversee cybersecurity risk, management, through the CIRT, is responsible for the implementation and management of cybersecurity risk management systems and processes and for the communication of incidents to senior management and the Audit Committee.


text: The CIRT meets with the CEO and other members of our senior management on a quarterly basis and meets with the Audit Committee at least annually. Additionally, the Audit Committee regularly meets with members of the Company's internal audit function to discuss risk management activities, compliance, best practices, and other related matters.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company also engages third-party providers to conduct periodic internal and external penetration testing and maturity assessments. The Company stores data on premise and in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.


text: On a quarterly basis, our employees, contractors and other users of the Company's systems and networks are required to take cybersecurity training. The training is designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. These trainings are administered through a collaboration with third-party services and systems and address various topics, including how to handle sensitive and personal information, physical security of intellectual property, how to identify phishing attempts, reducing our risk to being phished and how to improve cybersecurity intelligence while working from home.


text: As of December 31, 2024, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.


text: Cybersecurity Risk Strategy We drive an aggressive cybersecurity roadmap aligned to internationally recognized cybersecurity frameworks and focused on evolving global threats, new cybersecurity insurance requirements and continuous improvement of incident response. Our cybersecurity program is aligned with the NIST Cybersecurity Framework and we also maintain ISO 27001 certification. Pursuant to the framework, we utilize industry leading cyber solutions and techniques to prevent, detect, and respond to incidents using a layered security model. We conduct an annual gap assessment against the NIST Cybersecurity Framework, the results of which are used to establish goals and measure progress against our cybersecurity roadmap. Based on the gap assessment, for example, we have taken a number of actions intended to reduce our cybersecurity risk, including implementing network segmentation, enhancing our email and end-point security programs and improving our web application filtering programs. We are focused on the continuous improvement of key processes such as asset management, access control, vulnerability management, incident response, and third-party risk management. We also maintain business continuity management certification to ensure the ongoing review of our business continuity, disaster recovery and incident management processes, including as a result of a cybersecurity breach.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: Our Information Technology (IT) team is responsible for our cybersecurity monitoring and leverages a 24x7 Managed Detection & Response (MDR) third-party vendor to provide real-time cybersecurity threat monitoring and incident response, as well as to conduct a quarterly risk assessment. Pursuant to our incident response policy, any identified cybersecurity threats are immediately evaluated for the level of potential risk to us, with our response and remediation plan based on the potential severity of the incident. This incident risk assessment is continuously updated as we become aware of any new information regarding an identified incident. Pursuant to this plan, we will also utilize third-party experts to help identify, contain and remediate any incident that could have a significant impact on us. In addition, we use third-party experts to assist us in performing annual penetration testing and active breach assessment simulations to verify implementation of security tools, mitigating controls, and our ability to respond to real-world scenarios pursuant to our incident response policy.


text: As part of our cybersecurity roadmap, we also assess third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We are highly focused on cybersecurity awareness and perform annual certification of our employees, execute ongoing phishing campaigns, intervene with phish-prone individuals, publish monthly cybersecurity newsletters, and participate in Cybersecurity Awareness Month, in October each year.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: Cybersecurity Risk Governance Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board of Directors in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of cybersecurity risk to the Audit Committee and the Audit Committee reports on its activities and findings to the full Board of Directors. Key cybersecurity topics are presented regularly to the Audit Committee. In addition, if any cybersecurity incident is determined under our incident response policy to pose a risk in excess of an identified threshold (as set forth in the policy), our Chief Legal Officer will promptly notify the Audit Committee regarding the incident. The notification to the Audit Committee will include management's determination regarding whether or not the incident is material to us.


text: On an operating level, our cybersecurity program is managed by a dedicated Chief Information Security Officer (CISO), reporting to our Chief Information Officer (CIO), who together lead a geographically dispersed team comprised of our employees, highly skilled contractors and other key functional third-party resources. Our CISO holds a Masters of MIS in Information Security and prior to joining Ribbon, served as the Director of Information Security & Privacy at Ericsson for the Americas. Prior to Ericsson, she held cybersecurity positions at Walgreens, Fortunes Brands Home & Security, and W.W. Granger. She is a Certified Information Security Manager, has operated her own security firm, and has over 19 years of cybersecurity experience, including her time as a US Navy Operations and Training Manager. Our CIO has held that position (or Head of IT) at Ribbon for over 6 years. He has over 25 years of experience in the IT area including over eight years overseeing IT cybersecurity, cybersecurity roadmaps and IT general controls. During his career he has overseen initial ISO 27001 certifications, as well as the implementation of over 30 cybersecurity platforms. The CIO and CISO are part of our cybersecurity council, which also includes our CEO, CFO and other key leaders. The cybersecurity council meets monthly to review the cybersecurity metrics, new potential threats, and progress against the cybersecurity roadmap. Key matters from these monthly council meetings are presented to the Audit Committee.


text: We have implemented cybersecurity measures and processes to address and mitigate material risks from cybersecurity threats. We utilize the services of third party providers to develop, maintain, and implement cybersecurity systems and measures designed to protect our information systems from unauthorized access and damage. Our security measures are periodically assessed, tested, and updated. We do not have employees with information technology or cybersecurity expertise and accordingly we obtain an assessment of our cybersecurity systems and measures from a third party provider different from the provider that is primarily responsible for installation, update, and maintenance of information technology and cyber security systems. Our information technology and cybersecurity service providers primarily interface with members of our accounting and finance group. These processes are an integral part of our internal controls and risk management and the results of the third party assessment are reported annually to the Audit Committee along with a report from management on the effectiveness of internal controls.

companyName: Serina Therapeutics, Inc.

ticker: SER


text: We are not aware of the occurrence of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that material cybersecurity incidents will not arise or be discovered in the future.


text: The Company is subject to various cybersecurity risks that could impact our systems and our ability to operate. We have developed processes to assess, identify and manage our risks related to cybersecurity threats which are incorporated into the Company's overall risk management process. On an ongoing basis we utilize threat prevention systems to monitor, block and protect our information technology systems which are monitored continuously by trained security personnel. Our process to prevent cybersecurity incidents involves layered security architecture to protect our networks, end-user devices, servers, and cloud solutions. On a regular basis, we conduct phishing email simulations and provide training resources to our employees. We have an Incident Response Plan to outline our process to manage cybersecurity threats and incidents. We utilize industry recognized security and compliance experts for regular security assessments. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we review their compliance against internationally recognized standards.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: As of the filing of this Form 10-K, we are not aware of any cyber attacks that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We describe whether any risks from cybersecurity threats, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "The Company's business could suffer if information technology systems are disrupted, cease to operate effectively or become subject to a cybersecurity breach" included within our risk factor disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K, which information is incorporated herein by reference.


text: Cybersecurity is among our Board's oversight priorities. Through their oversight role, the Board has allocated oversight of cybersecurity risk to our Audit Review Committee of the Board. Our Audit Review Committee plays a vital role in our cybersecurity risk management process and regularly reviews the Company's cybersecurity and other information technology risks, controls and procedures. At multiple points throughout the year, management provides the Audit Review Committee with updates to our cybersecurity risk management process and our security monitoring and protection systems. The Audit Review Committee is kept informed of new security solutions planned for deployment. As part of their regular review of reports from management, the Audit Review Committee regularly reports cybersecurity risk updates to the Board, which enables the Board to incorporate the insights of such reports into its overall risk oversight analysis.


text: Our cybersecurity risk management processes are led by our VP, IT Business Solutions who has over 22 years of experience in various roles involving managing information systems and cybersecurity functions and developing cybersecurity strategies. Through these roles the VP, IT Business Solutions has implemented information technology security and privacy policies across multiple infrastructure and application platforms and led identity and access management. In order to enable the Company to prevent, detect, mitigate and remediate cybersecurity incidents, our security monitoring and protection systems are continuously monitored. The VP, IT Business Solutions is kept informed in accordance with our Incident Response Plan and reports matters to the Audit Review Committee as necessary. Additionally, we have a Cyber Security Task Force in place that is comprised of individuals across our various departments within our organization including information systems, legal, finance, internal audit, sales and marketing, engineering and supply chain teams which meets regularly to further advance our cybersecurity strategy.


text: The Company is subject to various cybersecurity risks that could impact our systems and our ability to operate. We have developed processes to assess, identify and manage our risks related to cybersecurity threats which are incorporated into the Company's overall risk management process. On an ongoing basis we utilize threat prevention systems to monitor, block and protect our information technology systems which are monitored continuously by trained security personnel. Our process to prevent cybersecurity incidents involves layered security architecture designed to protect our networks, end-user devices, servers, and cloud solutions. On a regular basis, we conduct phishing email simulations and provide training resources to our employees. We have an Incident Response Plan to outline our process to manage cybersecurity threats and incidents. We utilize industry recognized security and compliance experts for regular security assessments. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we review their compliance against internationally recognized standards. However, this does not mean that the Company, or our third-party service providers, will meet, or maintain, any particular technical standard, specification, or requirement in the future, but rather we use these standards as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business.


text: As of the filing of this Form 10-K, we are not aware of any cybersecurity incidents that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We describe whether any risks from cybersecurity threats, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our business could suffer if information technology systems are disrupted, cease to operate effectively or become subject to a cybersecurity incident." included within our risk factor disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K, which information is incorporated herein by reference.


text: Cybersecurity is among our Board's oversight priorities. Through their oversight role, the Board has allocated oversight of cybersecurity risk to our Audit Review Committee of the Board. Our Audit Review Committee plays a vital role in our cybersecurity risk management process and regularly reviews the Company's cybersecurity and other information technology risks, controls and procedures. Throughout the year, management provides the Audit Review Committee with updates to our cybersecurity risk management process and our security monitoring and protection systems. The Audit Review Committee is kept informed of new security solutions planned for deployment. As part of their regular review of reports from management, the Audit Review Committee regularly reports cybersecurity risk updates to the Board, which enables the Board to incorporate the insights of such reports into its overall risk oversight analysis.


text: Our cybersecurity risk management processes are led by our VP, IT Business Solutions who has over 23 years of experience in various roles involving managing information systems and cybersecurity functions and developing cybersecurity strategies. Through these roles the VP, IT Business Solutions has implemented information technology security and privacy policies across multiple infrastructure and application platforms as well as identity and access management enhancements. In order to enable the Company to prevent, detect, mitigate and remediate cybersecurity incidents, our security monitoring and protection systems are continuously monitored. The VP, IT Business Solutions is kept informed in accordance with our Incident Response Plan and reports matters to the Audit Review Committee as necessary. Additionally, we have a Cyber Security Task Force in place to support our VP, IT Business Solutions that is comprised of individuals across our various departments within our organization including information systems, legal, finance, internal audit, sales and marketing, engineering and supply chain teams which meets regularly to further advance our cybersecurity strategy.


text: Cybersecurity is a critical component of our overall risks given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a member of the information technology organization, reporting directly to the Chief Information Officer and regularly reports on the state of the program to the Risk Committee of our Bank's Board of Directors.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Federal Financial Institutions Examination Council ("FFIEC") regulatory guidance, and other industry standards such as the Center for Internet Security ("CIS"). In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Information Officer regularly collaborate with industry groups to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We leverage people, processes, and technology with an in-depth, layered, defensive strategy as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program. Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe.


text: Therefore, we will experience risk to potential vulnerabilities now and in the future but have built a program to recognize and respond to these vulnerabilities for the purposes of identification and remediation of those vulnerabilities and the impact they can have on our business. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks.


text: Additionally, we maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate management and/or executives. We have created and maintain a Crisis Management Plan as part of our overall Incident Response Plan which provides for the escalation path and management of an incident by the appropriate designated executives. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of the information technology management team are embedded by design. The Crisis Management Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Further, our risk from cybersecurity threats includes failure in or breach of our operational or security systems or infrastructure managed by third-party vendors and extends to other third parties, which could disrupt our businesses, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs, and/or cause losses.


text: While we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company. For further discussion of risks from cybersecurity threats, see the section captioned "A failure in or breach of our operational or security systems or infrastructure, or those of our third-party vendors and other service providers or other third parties, including as a result of cyber-attacks, could disrupt our businesses, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses." in Item 1A. Risk Factors.


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, threat intelligence, control evaluation and assessment, incident response, vulnerability assessment, threat intelligence, third-party risk management, change management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function. The second line of defense function is separated from the first line of defense function through organizational structure and overall cybersecurity management is independently reviewed by a third line through the audit function. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Various management committees exist including the Information Technology Steering Committee, which focuses on technology impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Chief Information Officer and includes other executives across the Bank and the Chief Information Security Officer is a part of this committee. This committee meets quarterly to provide oversight of technology projects and services including strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks.


text: The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at the meeting and the actions taken to the Risk Committee of our Board of Directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).