text: Identify, analyze, and determine strategic risk tolerance and/or mitigation direction for compliance risks identified as high and/or those with an increasing risk profile.


text: Review all regulatory examination reports impacting compliance and/or risk as well as any required responses The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.

companyName: Waterstone Financial, Inc.

ticker: WSBF

secItem: Item 1C


text: The Board of Directors, through the ITSC and CRMC, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board of Directors review and approve the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President.


text: The CIO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. The CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the ITSC and CRMC.


text: Management, including the CIO, regularly reviews with the Board of Directors the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Board of Directors outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting financial institutions. We recognize the critical importance of maintaining the safety and security of our systems and data and employ a multi-layered strategy for overseeing and managing cybersecurity and related risks. Our board of directors (the Board) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We believe we have not experienced any cybersecurity incidents that have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: Risk Management and Strategy Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology (NIST), the Federal Financial Institutions Examination Council (FFIEC), and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment using the FFIEC Cybersecurity Assessment Tool that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.


text: Multi-Layered Defense and Continuous Monitoring - We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. We use a third-party Managed Security Service Provider (MSSP) to provide comprehensive cyber threat detection and response capabilities and maintain a 24x7 monitoring system which complements the technology, processes, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. At least annually, we engage third party consultants or auditors to assist in assessing, identifying and/or managing cybersecurity threats.


text: Information Sharing and Collaboration - We work with government, customer, industry and/or supplier partners, such as the Financial Services Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain.


text: Training and Awareness - We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate quarterly in required training, including privacy, phishing, and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.


text: Third-Party Service Provider Management – We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management, and the Board on our response to a cybersecurity incident.


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by external auditors and regulatory examiners. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. The Board receives regular reports from our Vice President Director of Information Security on various cybersecurity efforts, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. In addition, we have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: Management ' s Role Our cybersecurity program is coordinated by our Vice President Director of Information Security, who reports to our Senior Vice President Chief Risk Officer and Chief Administrative Officer, in partnership with our Director of Information Systems and Technology ("IS&T"). Our Director of Information Security started with us in 2012 and holds numerous credentials including: Certified Information Systems Security Professional, Certified Public Accountant, and Certified Fraud Examiner. The Director of Information Security is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the IS&T team and our Managed Services Provider, who is overseen by the Director of IS&T. The Director of IS&T started with us in 2020, holds a Bachelor of Science in Business Administration, Information Technology and has over 14 years of direct experience managing information systems and technology. The Director of IS&T is responsible for implementing and maintaining the systems and tools to protect the technology stack we use. The Director of IS&T reports to the Senior Vice President, Chief Operating Officer.


text: HighPeak Energy maintains a cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including internal risk assessment and policy implementation, to incorporate a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Risk Management and Strategy The Company recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an important component of our overall risk management strategy. HighPeak Energy's cybersecurity team consists of certain of our executive officers as well as internal and third-party cybersecurity personnel. The cybersecurity team, led by professionals with cybersecurity expertise across multiple industries, takes a cross-functional approach to addressing these risks and engages in discussions with the Board and our executive management team on an as-needed basis.


text: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. We also require our employees and contractors to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises to test the effectiveness of our incidence response plan ("IRP") and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. We use encryption methods to protect sensitive data. This includes the encryption of our customer data, financial information, and other confidential data. We have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.


text: Third parties also play a role in the Company's approach to cybersecurity and its associated risk management framework. HighPeak Energy leverages technological tools and partners with the goal of augmenting and enabling the efforts of its internal cybersecurity team. Separately, management and oversight of the risks from cybersecurity threats associated with our engagement of third-party service providers is included in our internal auditing processes. In connection with and pursuant to the IRP, our incident response team, made up of management, employees and third-party cybersecurity personnel, works collaboratively across HighPeak Energy to carry out a program that has been designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to respond to potential cybersecurity incidents.


text: We have an IRP that delineates the procedures to be followed for handling a variety of cybersecurity incidents; categorizes potential cybersecurity incidents and the required timeframe for reporting each; establishes cybersecurity incident response levels; provides for investigations designed to help us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident.


text: The Board, in coordination with the Audit Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the Audit Committee include overseeing policies and management systems for cybersecurity matters and reviewing HighPeak Energy's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the Audit Committee receive regular presentations and reports on cybersecurity risks that address a range of topics, including developments, technological trends or tools, third party updates, and regulatory standards. The HighPeak Energy IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity with our executive officers and cybersecurity personnel.


text: Management plays a role in assessing and managing our material risks from cybersecurity threats through membership on our cybersecurity team, as well as by making final materiality determinations and disclosures and other compliance decisions, as reflected in the HighPeak Energy IRP.


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" for additional information.


text: Risk Management and Strategy The Company has processes in place to identify, assess and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls and information systems.

companyName: Cohen & Co Inc.

ticker: COHN


text: The Company's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.


text: The Company contracts with external firms to assess the Company's cybersecurity controls relative to its peers using the NIST CSF. The Company also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Certain employees also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: The Company engages in cyber crisis response simulations to assess the Company's ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures is subject to disciplinary action. The Company's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication and principles of Zero Trust to ensure that access to information and communication is vetted and secure.


text: The Company also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate the Company's security posture. The Company also engages external firms to measure the Company's NIST CSF maturity level.


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.


text: Role of the Board and Management The Company's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. The Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Company's Management Cybersecurity Committee (the "Cybersecurity Committee"). Pursuant to its charter, T he Cybersecurity Committee must consist at least four (4) members of Company's executive management team, which shall include the Company's Director of Technology, Chief Operating Officer, Chief Compliance Officer and Chief Financial Officer, each of whom is required to have working familiarity, knowledge and competencies in relevant areas, including data privacy, public policy, information technology ("IT") strategy, IT development and deployment, or IT risk assessment and management, including information security management. In addition, the Company's Director of Technology has formal education in information technology and extensive experience working in and leading the Company's information systems and technology function.


text: Review and provide oversight on the effectiveness of the Company's information security and privacy policies and procedures with respect to its products and services and internal-use information technology systems;


text: Review and provide oversight on the policies and procedures of the Company in preparation for responding to any material information security or privacy incidents;


text: Review and provide oversight on the Company's disaster recovery, business continuity, and business resiliency capabilities, including escalation protocols, relating its customer-facing products and services and internal-use information technology systems; Review annually the appropriateness and adequacy of the Company's cyber-insurance coverage;


text: Review and provide oversight on the policies and procedures of the Company with respect to data privacy, and oversee the Company's compliance with applicable data privacy and cybersecurity laws and regulations; Evaluate the Cybersecurity Committee's composition and performance on an annual basis;


text: Review and reassess the adequacy of the Cybersecurity Committee's written charter annually and recommend to the Board any changes the Cybersecurity Committee determines are appropriate;


text: Perform any other activities required by applicable law, rules or regulations (including the Securities Exchange Act of 1934 and The NYSE American Stock Exchange regarding reporting and disclosure obligations related to cybersecurity risks, costs, and incidents), and take such other actions and perform and carry out any other responsibilities and duties delegated to it by the Board or as the Cybersecurity Committee deems necessary or appropriate consistent with its purpose.


text: The Cybersecurity Committee, including the Company's Director of Technology, receive regular updates from the Company's management on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: Risk management and strategy Our information technologies, system networks, information technology infrastructure, enterprise applications and financial reporting platforms are critical components of our operations. Our business operations rely on the secure processing, transmitting, collecting and storage of sensitive and confidential data. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We partner with a third-party information technology company to address and manage each of the critical aspects of cybersecurity risk mitigation. The user aspect is addressed by deploying endpoint detection and response software on all endpoints, as well as extensive phishing testing and training for every user. This is further reinforced with additional monitoring to identify any aberrant activity within our network or software as a service ("SaaS") tools. A 3-2-1 backup strategy is used, resulting in a copy of all backup data offsite in the unlikely event that the disaster recovery plan is required. Our backup system is regularly confirmed through occasional data recoveries, test recoveries and monitoring that alert to any unexpected errors or failures with the system.


text: In our business operation, we utilize various third-party service providers, including credit card companies, banks and financial platform providers, to process financial transactions and implement various software and information system processes. To that effect, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.


text: We are not aware of any risks from cybersecurity threats, nor have we experienced any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" in this Form 10-K for discussion of risk factors.


text: Cybersecurity is an important part of our risk management processes. Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board of Directors oversees the management of systemic risks, including cybersecurity threats, in accordance with its charter.


text: Our management, represented by senior management, leads the cybersecurity risk assessment and mitigation processes, along with information technology management staff and our third-party business technology partner. Our third-party business technology partner has over 20 years of experience in cybersecurity and information technology. Continuous monitoring and routine meetings are conducted in order for the Company's information technology team and third-party business technology firm to update senior management regarding prevention, detection, mitigation and remediation of any cybersecurity threats or incidents.


text: Risk Management and Strategy As a financial institution, we believe that the risk of cybersecurity incidents is a significant, increasing, and always evolving risk for our business. Federal law and regulations require us to maintain a comprehensive written information security program, and federal banking regulators regularly issue guidance regarding cybersecurity threats intended to enhance our cybersecurity risk management. Accordingly, we have developed and implemented processes for assessing, identifying and managing material risks from cybersecurity threats designed to comply with federal law and regulations and protect against cybersecurity threats to our business. Our program is supported by management and the Company's Board of Directors (the "Board of Directors"). The Company maintains an active cyber insurance policy to enhance protections against material data intrusions or loss of privacy. For an overview of the federal banking laws and regulations that govern our management and oversight of cybersecurity risks, refer to Item 1. Business – Supervision and Regulation – "Financial Privacy and Cybersecurity Requirements," incorporated by reference into this Item 1C.

companyName: Investar Holding Corp

ticker: ISTR


text: The Company's Information Security Program (the "Program") is comprised of five pillars: the Information Security Policy, the Enterprise Information Security Risk Assessment, the Incident Response Plan, a formalized Security Awareness Campaign, and an enterprise monitoring and reporting program.


text: The Information Security Policy contains numerous distinct administrative and technical controls that govern data security for the organization and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The policy is reviewed and approved by the Board of Directors annually.


text: The Enterprise Information Security Risk Assessment quantifies risk criteria utilizing the same impact measures, including financial, strategic, operational, and reputational, set forth by the Enterprise Risk Committee. The risk assessment is reviewed and approved by the B oard of Directors annually. The Enterprise Risk Committee includes members of management from various departments and members of the Board of Directors and oversees the overall risk management of the Company. The Enterprise Risk Committee meets as often as appropriate to perform its responsibilities, but no less than once per calendar quarter and reports findings and provides recommendations to the Board of Directors on a routine basis.


text: The Incident Response Plan ("IRP") includes procedures for responding to actual or potential cybersecurity incidents, including providing timely notice to customers and our bank regulatory agencies when appropriate. The IRP is based on the NIST Cybersecurity Framework. The plan is tested annually through tabletop exercises.


text: The Security Awareness Campaign is designed with the goal that employees are educated on policy, threats, and best practices from onboarding and throughout their tenure at the Company. This effort includes an onboarding training program, annual attestation and training, and weekly communication designed to help instill in employees a security mindset through repetition.


text: The Company maintains an enterprise monitoring and reporting program, which identifies key risk indicators for tracking and identifying trends. The key risk indicators are presented to the Company's Information Technology Committee ("IT Committee") and th e Board of Directors on a monthly basis.


text: The Program is monitored each year through various internal and external audits, as well as OCC regulatory exams. Vulnerability and penetration testing are also conducted at least annually by an independent third party to supplement the vulnerability and patching program routinely performed by internal staff. Third-party vendors supplement the Company's internal patching program as necessary. The Company also utilizes a third-party "SOC as a Service" to monitor extended detection and response logs and network traffic.


text: Third-party service provider risk is evaluated prior to and throughout the relationship. Third-party service providers must meet a minimum set of baseline security standards prior to being onboarded. During onboarding, the third party and the services they provide are added to the Information Security Risk Assessment, including consideration of inherent risk factors and mitigating controls. Alternative vendors and the effort to transition between vendors are identified during onboarding as well as in the event that the selected provider may fail in providing contracted services at any time. After a third party is onboarded, they are subject to the annual third-party risk management program, specific to their assigned risk criticality. This effort includes the review of service organization controls reports, business continuity and disaster recovery efforts, insurance certificates, and other compliance related concerns when applicable.


text: During the last three years we h ave not experienced any cybersecurity incidents that have materially affected our Company, including our business, strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats may be reasonably likely to materially affect us, refer to Item 1A. Risk Factors – Risks Related to our Business – "We rely on information technology and telecommunications systems, many of which are provided by third-party vendors" and – "Cyberattacks or other security breaches could adversely affect our operations, net income or reputation," incorporated by reference into this Item 1C.


text: The Board of Directors is responsible for oversight of risks from cybersecurity threats. Oversight of cybersecurity risk management is performed primarily by the Board of Directors and the IT Committee. The IT Committee consists of members of the Board of Directors and key members of management. The IT Committee's primary purpose is to assist the Board of Directors in its oversight of technology and innovation strategies, plans and operations related to cybersecurity, data privacy, and third-party technology risk management. The Chief Information Security Officer ("CISO") provides monthly information security reports on cybersecurity programs, policies and controls, key risk indicators and trends including responses to any cybersecurity events, and efforts to improve security. Annually, the CISO provides security training to the Board of Directors. The CISO also provides the Board of Directors with an annual Information Security Program Summary Report in compliance with federal banking guidelines.


text: The program is managed by the CISO who reports to the Chief Operations Officer and is reviewed by regulators as well as internal auditors. The Chief Information Officer ("CIO") and information technology staff support the CISO in cybersecurity operations as necessary to mitigate risks to the Company's technology infrastructure. The CISO holds two cybersecurity industry leading certifications (CISSP, CCSP) and has more than 20 years of technology experience. Information technology staff are generally subject to professional education, experience, and certification requirements, and receive education and mentoring from the CISO and CIO.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and is one of the key risks identified for oversight by the Board through our annual ERM assessment. Our ERM approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's information; and (iv) protect our intellectual property.

companyName: CEVA INC

ticker: CEVA


text: Vigilance: We maintain 24/7 cybersecurity threat operations in order to rapidly detect, contain and respond to cybersecurity threats and incidents.


text: Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments.


text: Third-Party Management: We screen venders, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented users of our systems..


text: Education: All of our employees are trained at least annually on cybersecurity threats and our information security procedures, which reinforces our information security policies, standards and practices.


text: Incident Response Planning: We have established and continue to maintain an incident response plan that addresses our response to a cybersecurity incident.


text: Communication and Coordination: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management, internal audit and other key business functions, as well as including our board of directors in an ongoing dialogue regarding cybersecurity threats and incidents.


text: Governance: Our board of directors' oversight of cybersecurity risk management is supported by our Chief Financial Officer and Compliance Officer, who interacts directly with, and is provided relevant information by, our cybersecurity team. While our board of directors has the ultimate oversight responsibility over the management of cybersecurity risk, our audit committee reviews the risk management process relating to cybersecurity on a regular basis.


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We regularly engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures. The assessments include information security maturity evaluations, independent environmental security control reviews, operating effectiveness and penetration testing. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our board receives regular presentations and reports from the management team on information regarding the policies, processes and practices that we implement to address risks from cybersecurity threats including, for example, discussion of recent developments, evolving standards, third-party and independent reviews, the threat environment and technological trends. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, the board will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.


text: Our cybersecurity team is composed of the global head of Information Technology & Management Information Systems, the Chief Information Security Officer ("CISO") and deputy CISO. The cybersecurity team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our cybersecurity team members each possess 15-25 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training. We believe this collective experience allows us to effectively manage risks emerging from cybersecurity threats.


text: The cybersecurity team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our broader management team when appropriate.


text: We have not previously experienced any material cybersecurity incidents. In addition, cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to affect, the Company, including our business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Our overall risk management program includes a cybersecurity risk assessment process, that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee as part of their involvement in managing and overseeing cybersecurity risks.


text: Key aspects of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training for our employees, incident response personnel, and management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See " Item 1A. Risk Factors – Our business is subject to cybersecurity risks " included elsewhere in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from IT leadership, which includes our Chief Sustainability and Administrative Officer ("CSAO"), or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our cybersecurity team, led by the CSAO, is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Partnership stakeholders and external advisors. Our cybersecurity team includes the CSAO and IT leadership. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity team includes professionals with deep cybersecurity expertise across multiple industries.


text: Our management team stays informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel, threat intelligence and other information obtained from public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy Our information security program includes administrative, technical and physical safeguards and is designed to provide an appropriate level of protection to maintain the confidentiality, integrity and availability of our Company's and our customers' information. This includes protecting against known and evolving threats to the security of customer records and information, and against unauthorized access, compromise, or loss of customer records or information.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Our information security program is designed to continuously adapt to an evolving landscape of emerging threats and available technology. Through data gathering and evaluation of emerging threats from internal and external incidents and technology investments, security controls are regularly monitored and adjusted on an as needed basis. We have developed a data security strategy that is integrated within our overall risk management strategy and implemented through layers of controls embedded throughout our technology environment that establish multiple control points between threats and our assets. We test the effectiveness of our controls and data protection processes through internal and independent external audits and assessments, including regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate hacker attacks. Our information security program is supported by regular training of information technology employees and awareness training and activities for executives, directors, and employees companywide through which we communicate our information security policies, standards, processes and practices.


text: Further, our information security program is designed to provide oversight of third parties who store, process or have access to sensitive Company or customer data, and we require similar levels of protection from third-party service providers as are required for the Company. We maintain supplier risk assessment processes to identify risks associated with third-party service providers.


text: We employ business continuity, backup and disaster recovery procedures for systems that are used for storing, processing and transferring customer information, and we periodically test and validate our disaster recovery plans to validate our resilience capabilities. Additionally, we maintain insurance coverage that, subject to applicable terms and conditions, may cover certain aspects of cybersecurity and information risks. However, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate.


text: Our information security program is designed and managed to be consistent with the framework and guidelines of the FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook and FFIEC Cybersecurity Assessment Tool. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur. Along with periodically being examined by our regulators, the Company regularly engages external experts to audit, evaluate and validate our controls against these standard frameworks, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these examinations, audits and evaluations.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company to date. While we are not currently aware of any cybersecurity threats that are reasonably likely to materially affect the Company there is no assurance that we will not be materially affected by such threats in the future. For additional information on our risks related to cybersecurity, see Item 1A, Risk Factors—Operational Risks.


text: Our Board of Directors and executive officers are responsible for oversight of our information technology framework, including cybersecurity, information security, information technology and business continuity. The Chief Information Officer ("CIO") and other members of senior management report to the Board of Directors and executive officers at least annually and on an as needed basis. In the event of an immediate cyber threat to our business operations, the CIO would promptly initiate the Company's incident response plan including notifying executive officers, Board of Directors and regulators.


text: While our Board of Directors provides oversight of our information technology environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management. The CIO, with assistance from internal and external resources, is responsible for the implementation and providing oversight to our organization and maintaining the appropriate level of expertise to manage and implement cybersecurity policies, programs and strategies. The CIO has served for over 30 years in information technology and various roles within the Company.


text: The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. Our cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Risk Management and Strategy The Company and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our systems, train our employees and generally advise on cybersecurity processes. At least annually, our information technology team make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and employees, and the latest threats that have emerged, including a presentation from the third-party security firm.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our information technology team and a third-party security firm.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.


text: Incident Response and Recovery Planning: The Company has established a comprehensive incident response and recovery plan that addresses the response to a cybersecurity incident and plans to test and evaluate that plan on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: A third-party security firm provides training to our employees, helping our information technology team to maintain a state-of-the-art cybersecurity system and staying up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency MBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives periodic reports from management, the information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate. Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. The Company maintains a comprehensive risk-based cybersecurity program to identify, measure, manage, and disclose material cybersecurity risks. The Company utilizes the Federal Financial Institution Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") as a diagnostic test to help identify the Company's cyber risk level and determine the maturity of our cybersecurity program. The CAT is supplemented by an annual self-assessment and external audits and reviews, the results of which drive the development and implementation of the Company's cybersecurity strategy to ensure that cyber risk management practices are aligned with the risk profile of the Company.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: The Company uses the Center for Internet Security ("CIS") Critical Security Controls framework to balance cybersecurity risk exposure with investment in mitigation strategies. This framework provides a prescriptive, prioritized set of cybersecurity safeguards that fully align with those of the National Institute of Standards and Technology, the International Standards Organization 27000 series, and the requirements and guidance from applicable regulatory authorities, including the Federal Financial Institutions Examination Council.


text: The Company's cybersecurity strategy is enabled by people, processes, and technology that provide multilayered defenses including advanced capabilities for early and rapid cyber threat identification, detection, protection, response, and recovery. The Company employs a team of dedicated, skilled talent to operationalize the cybersecurity strategy. The internal team is supported by arrangements with a third party to provide continuous endpoint monitoring and incident response.


text: The Company's entire workforce receives mandatory cybersecurity training that includes quarterly social engineering exercises and informative online courses assigned based on assessed skill gaps. The Company also provides cyber risk awareness guidance to customers and promotes customer cyber hygiene through periodic communications. The Company conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world cybersecurity incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of the Company's incident response and management programs and provide the basis for continuous improvement.


text: The Company actively monitors and evaluates threats, events, and the performance of its business operations and continually adapts its risk mitigation activities accordingly. To that end, the Company maintains a comprehensive vulnerability management program that includes regular internal scans of the entire network to identify and measure the severity of security vulnerabilities, a team of dedicated network engineers who are responsible for fixing identified vulnerabilities within pre-defined timeframes based on severity, and at least annual independent network penetration testing by a qualified third party.


text: Cyber risk monitoring also includes the Company's arrangements with and exposure to third party service providers. We identify the criticality of our third-party service providers, in part, by determining their use of and access to confidential customer information. We conduct comprehensive cybersecurity reviews on all third parties that have access to confidential information. Our third-party reviews make use of technology that provides significant visibility into third party organizations, in real time, to assess third party compliance with a host of globally recognized IT security standards and frameworks and the likelihood of a cyberattack on a third party.


text: The Company also maintains a robust firewall system and firewall management program to restrict inbound and outbound network traffic. A dedicated team of network engineers manages firewall rulesets and monitors firewall health and alerting.


text: The risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations, or financial condition. Although the Company has invested substantial resources to manage and reduce cybersecurity risk, it is not possible to eliminate this risk. The Company obtains insurance that protects against certain losses, expenses, and damages associated with cybersecurity risk. See Item 1A, "Risk Factors," for additional information regarding cybersecurity risk.


text: Cybersecurity Governance The Company's Board of Directors devotes significant time and attention to its oversight of cybersecurity risk. Select members of the Board serve on the Information Systems Steering Committee ("ISSC"), which is responsible for approving IT strategic plans and all IT-related policies and for oversight of the information security program, among other matters. To fulfill its responsibilities, the ISSC receives periodic reports on the cybersecurity risk management program, including information security risks and incidents, emerging threats, and both internal and independent audit reports on the effectiveness of the control environment.


text: Executive leadership is responsible for management of the cybersecurity program. The IT Security Director supervises daily operations of the cybersecurity program and reports directly to the Chief Risk Officer ("CRO"). The CRO chairs the Information Security Sub-Committee ("Sub-Committee"), a management committee that meets at least monthly to receive regular updates on the status of the cybersecurity risk management program and strategic cyber initiatives. The Sub-Committee's actions and activities are reviewed by the ISSC at least quarterly. The Company has a management level Change Control Board ("CCB") which is responsible for reviewing and approving actions of the vulnerability management team, changes to hardware/software including the introduction of new hardware/software, and changes to firewall rulesets. The IT Security Director serves as a voting member of the CCB. Additionally, the Company has a Cyber Incident Response Team ("CIRT") which includes key members of management including the CRO and IT Security Director. The CIRT manages significant cyber-specific events with escalation up to executive leadership and the Board.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including but not limited to the following risks: operational, regulatory compliance, reputational, strategic, information technology, data security and privacy, and market risks such as interest rate, credit, liquidity and price risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Board of Directors is responsible for risk oversight over all significant risks facing the Corporation and fulfills this responsibility mainly through its committees. While our Board of Directors takes an oversight role in cybersecurity risk tolerance, we rely to a large degree on management and outside consultants in overseeing cybersecurity risk management. Our Director of Information Security, who reports directly to our Chief Information Officer, is primarily responsible for this cybersecurity component and is a member of management's Operational Risk and IT Steering Committees, and regularly attends and presents to the Risk Committee of our Board of Directors ("Risk Committee").

companyName: FIRST OF LONG ISLAND CORP


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, audits, and threat intelligence feeds to facilitate and promote program effectiveness.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the ability to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including notification of and escalation to the appropriate team members as well as executive management and the Board of Directors. The Incident Response Plan is coordinated through the Director of Information Security and key members of management. The Incident Response Plan facilitates coordination across multiple departments and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyberattacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks. To date, the Corporation has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Corporation.


text: The Director of Information Security provides information security updates to the IT Steering Committee and the Risk Committee. Cybersecurity metrics are reported to the IT Steering Committee monthly and to the Risk Committee on a quarterly basis. Security training is provided to all staff through targeted training overseen by the Director of Information Security. All Board members receive cybersecurity training annually.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program. At least annually, the Director of Information Security and the Chief Risk Officer report to the Risk Committee the overall status of the Information Security Program. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Bel employs a full-time Cyber Security Expert who reports directly into our Senior Director of Global IT Services. During 2023, the Company worked with third-party cybersecurity companies to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: The Audit Committee of the Board of Directors is responsible for overseeing the management of cybersecurity risks. The Audit Committee is informed about cybersecurity risks through quarterly reports from the Senior Director of Global IT Services and, as necessary, to the full Board. The Audit Committee also reviews and approves the company's cybersecurity policies and the Company's Senior Director of Global IT Services is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. This includes our overall information security strategy, policy, security engineering, operations and cyber incident detection and response reporting in alignment with Company policies. The current Senior Director of Global IT Services has more than 15 years of information technology and program management experience which includes information security, and others on our IT security team have years of cybersecurity experience and certifications.


text: Risk Assessment and Strategy Fuel Tech regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our Information Technology Steering Committee on a quarterly basis, or more frequently if deemed appropriate.

companyName: FUEL TECH, INC.

ticker: FTEK


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.


text: the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks.


text: the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.


text: the deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities.


text: if necessary, the use of third-party security experts if and when an incident is detected We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.


text: Management Oversight Day-to day management of cybersecurity threats is conducted by our Information Technology department which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Information Technology Steering Committee, which is comprised of our Chief Executive Officer, Chief Financial Officer, General Counsel and Head of Information Technology.


text: The Audit Committee of our Board of Directors, which is composed of all non-employee directors, is responsible for oversight of management's efforts to eliminate cybersecurity risks.


text: The Company maintains a governance structure to address cybersecurity risk, which involves the Board, the Audit Committee, the Company's Director of Information Technology, and a dedicated Incident Response Team.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: The Company utilizes a cross-functional, multilayered approach risk management to its cybersecurity to identify, prevent, and mitigate cybersecurity threats to the Company designed to preserve the confidentiality, security, and integrity of the Company's information and data. The Company conducts periodic tests to assess the Company's processes and procedures and the threat landscape. The Board and the Audit Committee receive regular presentations on cybersecurity-related topics ranging from the results of penetration testing, recent developments, evolving standards, the threat environment, technological trends, and information security considerations facing the Company and its peers. At least annually, the Board discusses the Company's approach to cybersecurity risk management with the Company's Director of Information Technology, and at least annually, or more frequently as necessary, the Company's Director of Information Technology meets with the Audit Committee to discuss cybersecurity risk management. The Company's security program and IT-related controls are regularly examined by internal auditors, external auditors, and various regulators.


text: The Company's Incident Response Team is led by our Director of Information Technology and also comprised of various cross-functional members of management. The team is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks and will present regular reports to the Audit Committee and the Board. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a third-party consultant with expertise in cyber risks and incidents to advise on cybersecurity related matters. The Company's consultant is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also provides annual trainings for all employees designed to reinforce the Company's information technology risk and security management policies, standards and practices, as well as the expectation that all employees comply with these policies. These trainings are supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown and changing cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy, or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information.


text: Risk Management and Strategy We maintain an Information Systems Security Program to safeguard all Summit and Summit Community's information assets against unauthorized use, disclosure, modification, damage, or loss. This is achieved through a collaborative effort involving Operations, Technology, Compliance, Risk, and Senior Management. The Program is designed to: Uphold the security and confidentiality of customer and bank records as mandated by law. Proactively guard against potential threats or hazards to the integrity of these records. Prevent unauthorized access or use of records or information that could significantly harm our Company, Customers, and Employees. Develop and maintain guidelines for Information Technology compliance with external and regulatory demands. Implement and regularly test effective Business Continuity and Disaster Recovery strategies. The Company's Chief Operating Officer (COO) is designated as the program coordinator responsible for coordinating and overseeing the program.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: Risk and Compliance Protocols Annually, our Compliance Department conducts risk assessments to determine the effectiveness of controls outlined in the Information Systems Security Program. This is in alignment with the requirements of the Gramm-Leach Bliley Act ("GLBA") and the Federal Financial Institutions Examination Council ("FFIEC") guidance on securing customer information. Key focus areas include: Evaluating technology systems used for the collection, processing, and storage of information. Assessing both internal and external cybersecurity threats and vulnerabilities. Ensuring that penetration and controls testing are conducted regularly. Gauging the potential impact of compromised information or systems. Assessing the effectiveness of governance structures in managing information security risks.


text: Monthly internal and external penetration testing is conducted and reviewed either by independent third parties or qualified employees not involved in developing or maintaining the security program. An audit is performed annually by qualified internal auditors or contracted independent parties and is overseen by the Company's Audit & Compliance Committee of the Board of Directors ("Audit Committee"). Management promptly reviews test results to initiate necessary remediation, which are then reviewed by the Audit Committee, third-party auditors, and examiners. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers.


text: Cybersecurity Incident Response The Company has established a Cybersecurity Incident Response Testing Plan ("CSIRTP"), integrated into the Business Continuity Plan. This plan outlines a systematic approach to managing information security incidents, supplemented by specific playbooks for various attack types. The CSIRTP requires approval by the Information Technology Steering Committee and is governed by the Business Continuity Plan that is approved annually by the Board of Directors. We are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition.


text: Governance and Oversight The Information Systems Security Program, reviewed and updated annually by the Board of Directors, is our benchmark for protecting the Company's confidential information. The COO, with over 30 years of experience in operations and information security, reports security incidents and updates to the Board as needed.


text: The Board and Senior Management are tasked with comprehensively understanding the Company's risk environment. Incident management and response teams are in place to execute response protocols and strategies, mitigating business risk and supporting recovery initiatives. This team adapts based on the nature of incidents, ensuring a flexible and effective response.


text: The CSIRTP framework ensures timely reporting of cybersecurity incidents to the Executive Management Team. Incident severity is judged based on potential impacts, including damage, compromise, loss, and the likelihood of further exploitation. The Chief Risk Officer is informed of all incidents that are determined to be significant. The Chief Executive Officer and the Board of Directors are notified of these incidents as necessary.


text: For further information on risks to the Company from cybersecurity threats, see "Our information systems may experience failure, interruption or breach in security" under Item 1A. Risk Factors.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including the Chief Executive Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

companyName: RBB Bancorp

ticker: RBB


text: Third parties with which the Bank does business, that facilitate the Bank's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.


text: Bank customers are also sources of cybersecurity risk to the Bank and its information assets, particularly when their activities and systems are beyond the Bank's own security and control systems. The Bank provides information to its customers and other external parties concerning cybersecurity risks including opportunities to reduce cybersecurity risk.


text: The security program is commensurate with the size and complexity of the Bank. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Bank or its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank's Enterprise Risk Management ("ERM") framework. The information security and cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council ("FFIEC") and the National institute of Standards and Technology ("NIST") Cybersecurity Framework, and standards set by relevant legal and regulatory authorities. Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, detect intrusions into our systems, and respond to cybersecurity incidents.


text: The Chief Information Security Officer ("CISO") reports to the Chief Information Officer ("CIO") and Chief Risk Officer ("CRO"). The CISO leads the Information Security team, which is responsible for identifying and assessing information security and cybersecurity risks, and for implementing and maintaining controls to manage information security and cybersecurity threats. The CISO is responsible for the Bank's Information Security and Cybersecurity Program, which is designed to prevent, detect and respond to cybersecurity threats and incidents in order to help safeguard the confidentiality, integrity and availability of the Bank's information systems and information.


text: As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. The training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.


text: Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding our information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor our information systems and provide threat detection alerts. The Bank's strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of our systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.


text: The Bank has an incident response program designed to enable the Bank to respond to cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Bank actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding the full spectrum of cybersecurity risks and enhancing defenses and improving resiliency in the Bank's operating environment.


text: The Bank engages third parties on a regular basis to assess, test, audit or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including, but not limited to: consultants who assist with assessing risks, assess of our systems alignment with NIST Cybersecurity Framework, FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.


text: The Bank maintains a process to evaluate and manage risks associated with third-party service providers. We conduct a full vendor due diligence review before engagement, review specific security measures in our contracts, and maintain continued monitoring during the engagement including yearly due diligence reviews.


text: The IT Committee and Audit Committee are the principal board committees that oversees the Bank's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank's Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.


text: The membership of the IT Committee includes members of the executive management team as well as directors of the Bank. The CIO and CISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The CISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and CISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The CISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets eight times a year. The IT and Audit Committees assist the Board of Directors in its oversight.


text: As part of its oversight of management's implementation and maintenance of the Bank's risk management framework, the Bank's Board of Directors receives regular updates directly from both IT and Audit Committees concerning cybersecurity matters. These updates generally include information regarding cybersecurity and technology developments, the Bank's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Bank's efforts to address those incidents.


text: Notwithstanding our efforts at cybersecurity, the Bank cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Bank, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors – Risks Related to Our Business.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our information technology policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and engage external resources and advisors as needed. All employees are required to complete cybersecurity trainings each month through online trainings and simulations.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations would suffer in the event of a significant computer system failure, cyber-attack or deficiency in our cyber-security" in Item 1A- Risk Factors.


text: The full Board receives updates periodically or as needed during the year from the Company's Chief Information Officer and actively participates in discussions with management and amongst themselves regarding cybersecurity risks. Updates delivered to the full Board typically include discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. These updates also typically include a review of any recent enhancements to the Company's defenses and management's progress on its cybersecurity, as well as reports on key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats.