text: We conduct internal and external penetration testing and risk assessments on a regular basis, and have engaged consultants, auditors and other relevant third parties to assist us with cybersecurity risk management processes. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, and employee or vendor misconduct, and other external hazards could expose our data systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we have experienced cybersecurity incidents, to date, we are not aware that we have experienced a material cybersecurity incident. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents. For more information, see Part I of this Annual Report, Item 1A "Risk Factors—Risks Related to the Company's Business and Operation—A cyber-incident, cyber security breach, severe natural event or physical attack on our operational networks and information technology systems could have a material adverse effect on our financial condition, results of operations, liquidity and cash flows."


text: As part of our overall risk management approach, we prioritize the management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised fully of independent directors from our Board, oversees the Board's responsibilities relating to cybersecurity risks. Our Audit Committee is informed of such risks through reports from our Chief Information Officer ("CIO") on at least an annual basis.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA

secItem: Item 1C


text: Our Chief Information Security Officer ("CISO"), who has been a chief information security officer at Ormat for six years, is certified by the International Information System Security Certification Consortium as an Information Systems Security Management Professional ("ISSMP"), as an Information Systems Security Architecture Professional ("ISSAP"), and as a Certified Information Systems Security Professional ("CISSP"). Our CISO oversees compliance of our information security ("IS") standards and mitigation of IS risks. We also have the following internal bodies to support our processes to assess and manage cybersecurity risk as follows:


text: The Crisis Incident Management Team, which includes members of the executive management team, the CIO, CISO, and other senior executives across the Company, is alerted as appropriate to cybersecurity incidents, as well as other crises, such as natural disasters and outages. This team also periodically oversees tabletop drills on various cybersecurity incidents.


text: The Cyber Risk Disclosure Committee brings together senior management, including the CEO, CFO, General Counsel and other relevant functions to review the materiality of cyber incidents for disclosure purposes. The Cyber Risk Disclosure Committee members are also part of the Crisis Incident Management team.


text: The IT leadership team, led by our Chief Information Officer, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives. The team provides periodic presentations to senior management and the Board on cybersecurity risk and mitigation.


text: The VP of Technical and Maintenance chairs monthly cybersecurity meetings to review cyber risks or threats related to the operations of our geothermal projects.


text: At the level of the general employee population, we hold trainings on privacy and information security, records and information management, and information security regulatory compliance, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through broad communication and educational initiatives, depending on the employee's level, role and exposure to sensitive systems and the associated cybersecurity risk profile. We also contract with an external vendor to monitor alerts in real time on cybersecurity incidents.


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of Bimini. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: As an externally managed company, the Company relies on our Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on our Manager's processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by our Manager. All of the Company's executive officers are executive officers, directors and employees of Bimini.


text: Our Manager's cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.


text: Risk Management and Strategy The Company, our Manager and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our Manager's systems, train the Manager's employees and generally advise on cybersecurity processes. At least annually, our Manager has its information technology team make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and the Manager's employees, and the latest threats that have emerged, including a presentation from the third-party security firm.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our Manager's information technology team and a third-party security firm.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of the third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.


text: Incident Response and Recovery Planning: The Company has established a comprehensive incident response and recovery plan that addresses the response to a cybersecurity incident and plans to test and evaluate that plan on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our Manager's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: A third-party security firm provides training to our Manager's employees, helping our Manager's information technology team to maintain a state-of-the-art cybersecurity system and stay up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our Manager's information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency RMBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives reports from management, the Manager's information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary.


text: As noted above, the Company relies on its Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by its Manager. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our Manager's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate.


text: Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately twenty years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: We take an enterprise-wide approach to cybersecurity, using established processes for assessing, identifying, and managing risks from cybersecurity threats. We have implemented various measures across our organization to manage our cybersecurity risks, including implementing systems to identify, prevent, detect, investigate, resolve and recover from cyber security attacks. All employees participate in our security awareness training program, and additional training is required for various roles within the organization. Employees are trained and encouraged to identify and report security concerns, and cybersecurity is engrained in our culture.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: Our cybersecurity risk management program leverages the Center for Internet Security Critical Security Framework to provide a structured methodology to help ensure the confidentiality, integrity and availability of our systems and data. We regularly assess cybersecurity risks and monitor our systems for vulnerabilities. We conduct regular reviews and tests of our systems and our cybersecurity program, both internally and using consultants and external auditors. These tests include, but are not limited to, vulnerability testing, penetration testing, tabletop exercises, systems recovery tests, assessments and other activities to assess the readiness and effectiveness of our cybersecurity controls and protections.


text: Our Information Security program is led by our Chief Information Officer ("CIO"), who reports to our Chief Operating Officer ("COO"). Our CIO works with our Chief Privacy Officer ("CPO") to address cybersecurity and data privacy risks and concerns. The Information Security Governance Committee ("ISGC"), composed of executives from various corporate functions, oversees our cybersecurity policy and strategy. Our Board of Directors (the "Board") oversees our enterprise risk management activities in general, including cybersecurity risks. The Audit Committee of the Board has been designated with specific oversight responsibility with respect to cybersecurity and data privacy risk management. The Board receives a comprehensive update on the status of risks related to cybersecurity annually and periodic updates on particular matters. The COO and the ISGC meet with the CIO and CPO on a regular basis to review and monitor our cybersecurity risks and mitigation efforts. We engage external assessors, consultants, and auditors to assist us in evaluating and enhancing our cybersecurity risk management processes. We also have processes to oversee and identify such risks from cybersecurity threats associated with our use of third-party service providers.


text: While we have not experienced a material breach, our systems are frequently the target of cyber security attacks intending to steal, misuse, or destroy data, to impact our ability to do business, or otherwise negatively impact us. If we did experience a significant disruption in service, theft of data, or other significant attack, it could result in legal claims or proceedings, liability under federal and state laws that protect the privacy of personal information, regulatory penalties, remediation costs, increased cybersecurity costs, loss of revenue or customers, damage to our reputation or competitive position, or other harm to our business. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: IT Risk Management The Company maintains an Information Technology (IT) risk identification process that encompasses risks associated with enterprise solutions and products and services provided by third-party service providers. Cybersecurity risks are considered a subcategory of IT risks and are therefore part of this process. The Company maintains a risk register to document and track IT risks, including factors such as: Categories (including but not limited to cybersecurity, data privacy, governance, and application development)

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Approvals/exceptions The Company's Governance, Risk, and Compliance (GRC) team maintains the IT risk register and reports updates to the IT Risk Council, which meets regularly. The IT Risk Council is made up of members representing the Company's cybersecurity, network, server, client, database, and software teams.


text: Cybersecurity Operations and Incident Response Capabilities The Company maintains a Cybersecurity Operations Center (CSOC) comprised of in-house staff, contracted personnel, and other third-party security service providers. Our CSOC provides constant monitoring, assessment, and defense of all enterprise information systems (including web sites, applications, databases, servers, clients, and data centers) as well as service provider connections and provides incident reporting as needed.


text: The Company also maintains a Security Incident Response Team (SIRT) that responds to high-risk security incidents on a 24-hour basis. Members of this team include representatives of our CSOC and Networking Operations Center, as well as cloud/server engineering, network engineering, enterprise data, identity and access management, GRC, end-user computing, application development, and IT leadership teams.


text: Assessments and Audits The Company uses various methods to assess our cybersecurity maturity and IT risk management program, including periodic self-assessments and engagements of independent third-party assessors and consultants. We engaged third-party experts for the initial development of the IT risk management program, including preparation of the program charter, IT risk register, and responsibility assignment matrix. We use these external engagements to provide multiple assessments of our cybersecurity functions, including a compromise assessment, a security posture assessment, and a cyber-defense assessment.


text: Risks Associated with Third-Party Service Providers The Company's GRC oversees assessments of third-party service providers in collaboration with our IT contracts, data privacy, technical architecture, and legal teams. An initial review for any cybersecurity threat is completed when the provider is onboarded, with subsequent periodic reviews conducted thereafter. These subsequent reviews occur at different intervals, based on the nature of the business relationship, the type of data being exchanged (if any), and the overall potential impact to the Company, and include consideration of factors such as the third party's cybersecurity capabilities, data protections and privacy measures, and technical capabilities as related to required integrations with the Company's systems.


text: Material Findings from Cybersecurity Risks The Company faces many of the same risks and has experienced similar cybersecurity incidents as other transportation providers. None of these risks or incidents to date have materially affected our business strategy, operations, or financial condition.


text: The Board of Directors maintains oversight of risks from cybersecurity-related threats, primarily through the Audit Committee. The Audit Committee holds a special in-person meeting, typically in the fourth quarter, to review the Company's cybersecurity as well as the overall IT structure and planned changes with the Company's Chief Information Officer (CIO) and provides an update to the Board from that meeting. The Company's CIO also meets directly with the full Board of Directors, typically in the second quarter. At this meeting, the CIO reports and discusses relevant current and new IT risks and the general health and maturity of our overall IT risk management program. Other updates are provided throughout the year to the Audit Committee and the Board, as needed. In the event a cybersecurity incident is determined to be significant, a formal meeting of the full Board of Directors is convened.


text: The Company's CIO, senior vice president responsible for technical services, and vice president responsible for IT risk management manage all material risks associated with cybersecurity threats. Combined, these identified leaders have more than 50 years of IT and cybersecurity related experience across multiple industries. In the event of a cybersecurity incident, these leaders engage the Incident Response Team (IRT), a team comprised of senior- and executive-level leaders from various business units, legal and finance departments, and the corporate communications team, to help manage and maintain business operations throughout the incident and any recovery period. The IRT is responsible for reporting details of the incident and its impact on the business to the Executive Leadership Team (ELT) and making key recommendations for managing operations. The ELT is responsible for advising the Board of any material cybersecurity incidents. Both the ELT and the IRT have participated in formal cybersecurity response training.


text: Cybersecurity Risk Management, Strategy and Governance Cybersecurity is a material part of ConnectOne's business. As a financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation, although to date the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition. See "Item 1A- Risk Factors - We cannot predict how changes in technology will impact our business; increased use of technology may expose us to service interruptions or breaches in security."

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Cybersecurity risk is initially overseen at ConnectOne by the management IT Committee (the "ITC"). The members of this committee include, as co-chairs, the Chief Compliance Officer and the Chief Technology Officer. Additional members are our Information Security Officer, Information Technology ("IT") Manager, Chief Risk Officer, Chairman & Chief Executive Officer, Chief Strategic Operations Officer, Chief Digital Officer and Chief Brand and Innovation Officer.


text: Tarak Patel, Information Security Officer - Mr. Patel has facilitated the management of information security programs at financial institutions for over 17 years.


text: Sharif Alexandre, Chief Technology Officer - Mr. Alexandre has over 20 years industry experience including managing Information Technology and Software Development teams at organizations ranging from technology startups to Fortune 500 companies. He recently oversaw IT operations and currently leads the Software Development and Data Management teams at the Bank.


text: Laura Criscione, Chief Compliance Officer - Ms. Criscione oversees the company's Compliance and Information Security. Ms. Criscione has overseen Compliance and IT Operations throughout her more than 30-year career in financial institutions.


text: Dale Dwaileebe, IT Manager - Mr. Dwaileebe has over 20 years of IT experience, is a current member of Infragard, and holds multiple industry recognized certifications. Michael O'Malley, Chief Risk Officer – Mr. O'Malley oversees entity-wide risk management, including cybersecurity related risk.


text: Dana Zeller, Chief Strategic Operations Officer – Ms. Zeller's career has been primarily in bank operations, in which she has participated in end-to-end implementations and upgrades of core banking technology, from selecting a vendor to managing implementations, to leading enhancement and efficiency initiatives throughout the life of the application.


text: Ali Matera, Chief Digital Officer – Ms. Matera is a technology subject matter expert with over 13 years of IT leadership and over 18 years of financial service experience. In her career she has been responsible for technology/digital strategy, enterprise program management, data analytics and IT service management at other financial institutions. In addition to the members above, Frank Sorrentino III, Chairman & Chief Executive Officer and Siya Vansia, Chief Brand & Innovation Officer are also members of the ITC due to their roles in overseeing entity-wide management.


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, members of the ITC, along with other lines of business heads, report to the management Enterprise Risk Management Committee (the "ERMC"), which in turn reports to the Board Audit and Risk Committee quarterly. The ERMC consists of the Company's Chief Risk Officer, Chairman & CEO, President, Chief Financial Officer, Treasurer, Chief Compliance Officer, Chief Technology Officer, Chief Strategic Operations Officer and Chief Credit Officer. In addition, the Company's Chief Technology Officer attends Company Board of Directors meetings and provides an information technology ("IT") report at each meeting.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. The Company's internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework. The results are reported to the ITC. The Company's IT and compliance staff also review potential cybersecurity threats associated with the Company's third-party vendors, including performing a review of and obtaining a System of Organization Controls report from all vendors rated as "high risk" by the Company's internal vendor management program. The Company also has an internal Incident Response Plan and Team, which is charged with overseeing the Company's response to any cybersecurity incident. The team performs a table-top exercise at least annually to prepare to respond in the event of any actual cybersecurity incident. In addition to these internal resources, the Company uses a third-party vendor to undertake annual penetration and vulnerability testing, with the results reported to the ITC. Finally, the Company's cybersecurity compliance program is audited by the Bank's outsourced internal auditor.


text: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all appropriate employees.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee also reports material cybersecurity risks to our full board of directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Information Services (VP-IS) who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our VP-IS and dedicated personnel are information system security professionals and information security managers with many years of experience. Management, including the VP-IS and our cybersecurity team, regularly update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: In 2023, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Risks Related to our Business" in this Annual Report on Form 10-k.


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to ensure the security of our information systems and networks and the confidentiality, availability, and integrity of our data.

companyName: GORMAN RUPP CO

ticker: GRC


text: Risk management and strategy The Company continues to build its culture of security and has integrated cybersecurity risk management into our broader enterprise risk management process. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes and operational practices. Our information technology department works closely with our senior management team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: The Company provides training to all employees that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The training assists employees with identifying potential cybersecurity risks and threats and how to protect the Company's resources and information. This training is mandatory for all employees globally on a periodic basis, and it is supplemented by firmwide internal and external service providers testing initiatives, including frequent phishing tests. In addition to the employee training program, the Company has created an information security incident response policy and team. The risks related to cybersecurity, including the effectiveness of our training programs, are monitored on an ongoing basis by our information technology department and external service providers. In addition, to assess the incident response policy, periodically the Company engages a third-party expert to oversee a cybersecurity incident response training exercise and to facilitate group discussions regarding the effectiveness of the Company's cybersecurity incident response strategies and tactics.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Gorman-Rupp engages with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and testing our risk management systems. These external experts leverage their specialized knowledge and insights on cybersecurity to assess and enhance our internal policies and processes through regular audits, threat assessments, and consultation on security enhancements and strategies.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. See Item 1A. Risk Factors – General Risk Factors - Cybersecurity threats.


text: The Board of Directors believes that control and management of risk are primary responsibilities of senior management of the Company. As a general matter, the entire Board of Directors is responsible for oversight of this important senior management function. The Audit Committee is responsible to the Board for the organizational oversight of the Company's comprehensive enterprise risk management plan, including cyber risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Senior management plays a pivotal role in informing the Audit Committee on cybersecurity risks. The information technology department regularly informs the Chief Financial Officer (CFO) of all aspects related to cybersecurity risks and incidents. This ensures that senior management is kept abreast of the cybersecurity posture and potential risks. The senior management team presents updates to the Audit Committee quarterly and, as necessary, to the full Board. These regular reports include detailed updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if applicable.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). The Company uses recognized frameworks from the National Institute of Standards and Technology as guidelines to inform its cybersecurity policies, standards, and practices. We generally approach cybersecurity matters through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: BOYD GAMING CORP

ticker: BYD


text: Risk Management and Strategy Consistent with our overall ERM policies and practices, our cybersecurity program focuses on the following areas:


text: Vigilance: We maintain an extensive presence, with cybersecurity threat operations functioning continuously and uninterrupted with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.


text: Systems Safeguards: We deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.


text: Collaboration: We use collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Training: We provide periodic mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. We additionally publish an internal newsletter on a monthly and ad-hoc basis for enterprise-wide consumption to promote awareness of trends in cybersecurity threats and attack techniques.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.


text: Communication, Coordination and Disclosure: We take a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management, internal audit and other key business functions and engage with our Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the assessment and escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Governance: Our Board regularly interacts with our Chief Information Security Officer and other members of management on cybersecurity risk management.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by the assessments, audits and reviews.


text: Our Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least quarterly each year, the Board discusses the Company's approach to cybersecurity risk management with our Chief Information Security Officer.


text: Our Chief Information Security Officer is the member of our management team that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Information Security Officer has served in various roles in information technology and information security for over 25 years. The Chief Information Security Officer holds an undergraduate degree in Business Administration with a major in Accounting and Finance and a graduate degree in International Management. The Chief Information Security Officer also holds advanced certifications as a Certified Information Systems Security Professional and as a Qualified Technology Executive granted by Digital Directors Network. The Chief Information Security Officer works in coordination with the other members of management, which includes, but is not limited to, the Company's President and Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, Chief Digital Officer, Chief Information Officer, and General Counsel. The Company's Chief Information Officer has served in various roles in information technology and information security for over 29 years. The Chief Information Officer holds an undergraduate degree in Electronic Engineering from DeVry University and graduate degree in Technology Management. The Company's Chief Technology Officer holds an undergraduate degree in computer science and economics from Northwestern and has served in various roles in information technology for over 33 years with Boyd Gaming and numerous other public companies. The Company's Chief Digital Officer has served in various roles in information technology and information security for over 25 years. The Chief Digital Officer holds a degree in political science with a minor in accounting from Belmont University. The Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Our Chief Information Security Officer works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Security Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition. We believe with the cybersecurity and governance program we have in place that we have implemented effective processes and controls to prevent cybersecurity incidents from being reasonably likely to materially affect the Company. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Failure to maintain the integrity of our information technology systems, protect our internal information, or comply with applicable privacy and data security regulations could adversely affect us", for additional discussion about cybersecurity-related risks.


text: Cybersecurity Risk Management Program The Company's cybersecurity risk management program is designed to employ industry best practices, including ongoing enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third-party service providers. This program includes the engagement of consulting firms and other third parties.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: A key component of our cybersecurity risk management program is our incident response policy, which provides for evaluation, response, and reporting procedures in connection with a cybersecurity incident. Under this policy, we have established an incident response team (IRT), a multi-disciplinary management-level team led by the Company's Chief Technology Officer (CTO) and comprised of the Company's Chief Executive Officer (CEO), General Counsel/Compliance Officer, Chief Financial Officer, and EVP, Corporate Strategy. The policy provides that the IRT will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of the IRT. In such event, the policy provides that the IRT will assess whether a cybersecurity incident has the potential to materially impact the Company and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit Committee and/or the Board of Directors.


text: The Company maintains cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity matters. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We do not believe that any risks we have identified to date, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we or the third parties with which we interact, have not identified or experienced, or will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under federal and state data protection and data privacy requirements, foreign data privacy regulations, consumer protection laws, common law theories, and other laws, rules and regulations, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business" included in Part I, Item 1A of this Form 10-K.


text: Cybersecurity Governance The Company's cybersecurity risk management processes are integrated into the Company's overall risk management program. In this regard, our Board of Directors has designated the Audit Committee as being primarily responsible for overseeing risk management at a board level, and has delegated certain specific categories of risk oversight matters to the Audit Committee as well as to the other standing committees of the Board, within their respective areas of responsibilities. Additionally, the Audit Committee makes periodic reports to the Board regarding briefing and reports provided by management and advisors regarding various risk oversight matters as well as the Audit Committee's own analysis and conclusions regarding the adequacy of the Company's risk management program.


text: As part of its board-level risk oversight responsibilities, the Audit Committee provides oversight of the Company's privacy, data, cyber security, and information security risk exposures. Further, at a management level, the Company's cybersecurity risk management program is led by our CTO, who reports to the Company's CEO. Our CTO was appointed as the Company's senior vice president and chief technology officer in July 2017. Our CTO has expertise in cybersecurity risk management through his more than 20 years of experience in healthcare technology, including his service with us as well as his service as chief technology officer at other organizations prior to joining the Company in 2017. On a quarterly basis, the Company's CTO reports to the Audit Committee regarding the Company's cybersecurity program. The CTO also reports to the Audit Committee on a quarterly basis regarding remediation activities, if any, along with related security metrics, in connection with any areas where cybersecurity threats have been identified.


text: The information technology systems we rely upon to effectively manage our business data, communications, supply chain, order entry and fulfillment, and other business processes are subject to risk from security breaches and other significant disruptions. Such breaches and disruptions may occur through breaches by our personnel or by intrusions over the Internet, malware, computer viruses, attachments to e-mails or by persons with whom we have commercial relationships. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Item 1A. Risk Factors— We are subject to cyber security risks and may incur increasing costs in an effort to minimize those risks".

companyName: Freshpet, Inc.

ticker: FRPT


text: Our information security organization, led by our Chief Information Officer (our "CIO") who reports to our Chief Financial Officer (our "CFO"), is comprised of both I.T. security leadership and dedicated Cybersecurity staff. The information security organization has extensive technology security and program management experience including cybersecurity professional certifications such as Certified Information Systems Security Professional ("CISSP"), advanced degrees in Information Assurance, and numerous years' experience assessing and managing cybersecurity risk within the Department of Defense and other public companies. Our CIO has over 25 years of technology experience, including leading information governance, I.T. security, and cybersecurity teams and initiatives across both publicly traded companies and global organizations.


text: Our policies, practices, and standards for addressing material risks associated with cybersecurity are integrated into our overall risk management and are based on industry standards including the National Institute of Standards and Technology ("NIST") which aligns the prevention techniques, identification, protection, detection, response, and recovery related to an incident. These controls are tested by our information security organization and by independent third parties. We actively engage with industry groups for awareness of best practices and our third-party provides for industry benchmarking of critical areas within our cybersecurity posture.


text: Our organization-wide information security program focuses on implementing effective and efficient controls, technologies, and other processes to help protect, identify, assess, manage and mitigate material cybersecurity threats and incidents. These processes include, among other things, regular testing of these controls through table-top exercises, penetration and vulnerability testing, auditing of our information security by an independent third-party auditor, ongoing security awareness training for employees and other educational programs, and continuous monitoring of our cybersecurity posture. We also employ numerous tools including, but not limited to, segregated layers of controls for access to our systems and security tools that help identify, isolate, remediate, and recover from identified vulnerabilities and security incidents in a timely manner. Our cybersecurity posture is managed by both our information security organization and through partnerships with industry recognized cybersecurity firms.


text: We have also created, and tested through incident response drills, the Freshpet Incident Response Plan and Playbook, which together set forth policy-level directives as well as specific guidelines for implementation, that describe our process for responding in the event of certain defined cyber incidents. These protocols (i) define the roles and responsibilities of participants, relationships to other Company policies and procedures, and reporting requirements needed during an incident, (ii) provide a framework by which our Incident Response Team (IRT) shall determine the scope and risk of an incident, respond appropriately to that incident, and inform the Board and others depending upon the nature and severity of the incident, and (iii) reduce the likelihood of a similar incident from reoccurring following identification of such an incident.


text: Our CIO and other members of the information security organization routinely engage with our CFO regarding cyber risk management activities and provide updates and data, as needed, to other members of our executive team to facilitate decisions regarding security matters. No less than twice per year, and more frequently as appropriate, our CFO and CIO also provide updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee of our Board of Directors, and provide other information as needed to facilitate the committee's oversight of our cybersecurity risk.


text: Risk Management and Strategy Bancorp has established an Information Security (IS) program, which is overseen by the Director of Information Security and the Information Security Officer. Both of these roles report to the Chief Risk Officer. The IS program is structured upon and informed by the Center for Internet Security Risk Assessment Method (CIS RAM), which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The primary objectives of the IS program are to protect the confidentiality, integrity and availability of our information assets, comply with applicable laws, regulations, contractual obligations and manage significant risks arising from cybersecurity threats. These processes are integrated into the institution's overall risk management system, ensuring a unified approach to risk mitigation.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: The IS program includes several key processes and functions such as access control monitoring, threat detection, vulnerability management, understanding the implications of technological changes, managing third-party relationships, and mandating employee awareness and education among other components. These activities aim to prevent avoidable errors, raise awareness, identify potential vulnerabilities, protect systems, detect security incidents and recover from any incidents that occur. These processes are continually updated and enhanced to keep pace with the evolving cybersecurity landscape.


text: The first line of defense is operational management, which is responsible for implementing and maintaining the IS program, as well as identifying and mitigating cybersecurity risks on a day-to-day basis.


text: The second line of defense consists of the risk management and compliance functions, which provide oversight, guidance, and support to the first line of defense, as well as monitoring and reporting on the institution's cybersecurity posture and performance.


text: The third line of defense is the internal audit function, which provides independent assurance of the effectiveness and adequacy of the IS program, as well as compliance with relevant policies, standards and regulations.


text: When necessary, the institution engages external assessors, consultants, and auditors with expertise in cybersecurity to evaluate and enhance its systems, policies and procedures. These external parties provide valuable insights into emerging threats and best practices, enhancing Bancorp's ability to adapt and respond effectively. Bancorp also undergoes reoccurring regulatory examinations, and any issues that are identified are actively tracked and monitored for remediation. In addition to external entities, Bancorp has internal oversight mechanisms to identify cybersecurity risks, including those associated with its use of third-party service providers and related downstream service providers. This includes thorough due diligence during vendor selection, ongoing monitoring, setting clear contractual obligations to uphold cybersecurity standards and other interventions necessary to address risk such as those addressed in Part I Item 1A " Risk Factors. "


text: In the event of a security incident, Bancorp has developed an Incident Response Plan (IRP) to guide necessary actions. The IRP is a well-established document that is updated at least annually. It provides guidance before, during and after a confirmed or suspected security incident, outlining how to minimize the duration and damage of an incident, identifying a response team and streamlining actions to reduce recovery time.


text: While Bancorp has not experienced any cybersecurity incidents that have materially affected its operations, it acknowledges the potential impact such risks could have on business strategy, financial condition and operational resilience. The institution remains vigilant, continuously evaluating and enhancing its cybersecurity measures to preemptively address any potential risks that could impact its operations or financial condition in the future. This approach aligns with the institution's commitment to maintaining the trust and security of its stakeholders in an increasingly digital world.


text: Bancorp's Credit and Risk Committee, which includes board of director representation, maintains a robust oversight framework for evaluating and managing risks associated with cybersecurity threats. The committee convened six times during the year ended December 31, 2023 in order carry out its oversight responsibilities, engaging directly in discussions about cybersecurity risks to ensure they are comprehensively addressed within the institution's risk management framework. This included, but was not limited to, vulnerability trends, identified or potential third-party risks, risks precipitated by technological changes, confirmed or potential security incidents, policy and procedure changes, the organization's risk appetite, the FFIEC's Cybersecurity Assessment Tool, conclusions from the risk assessment, audit and regulatory reports, routine quarterly and annual reporting, as well as other notable key risk indicators.


text: The entire board of directors of Bancorp is actively involved in the oversight of the institution's cybersecurity risks. The Chair of the Credit and Risk Committee regularly reports the committee's activities to the board of directors. In addition, management reports to the board of directors on an as-needed basis concerning high-priority information security-related topics, such as cybersecurity incidents. This ensures that the board of directors is always informed and can provide strategic direction on significant cybersecurity matters.


text: A dedicated committee, the Information Security Steering Group (ISSG), is specifically responsible for overseeing cybersecurity threats and informing the decisions of the Credit and Risk Committee. The ISSG, comprising individuals with diverse expertise in technology, risk management and cybersecurity, meets monthly. They discuss a range of strategic topics, including vulnerability trends, identified or potential third-party risks, risks precipitated by technological changes, confirmed or potential security incidents and other items related to the institution's preparedness measures. The ISSG's purpose is to provide strategic direction for the IS program and to evaluate known risks based on Bancorp's existing controls and risk appetite.


text: Management also plays a crucial role in assessing and managing Bancorp's cybersecurity risks. Specific roles, such as the Information Security Officer (ISO) and Director of Information Security (DIS), are tasked with monitoring, evaluating, and mitigating these risks in coordination with the ISSG. Both the ISO and DIS possess relevant expertise and experience in cybersecurity, enabling them to effectively navigate and respond to emerging threats. The ISO, who holds a Bachelor's degree in Computer Science and a Master's degree in Information Systems Security, along with several relevant industry certifications, has been with Bancorp for three years and has additional experience working in technology outside of the organization. The DIS, who also holds several relevant certifications, has been with Bancorp's Information Security department for 19 years and brings extensive experience with technology.


text: To keep the ISSG and Credit and Risk Committee informed, management ensures consistent and structured reporting mechanisms are in place. They regularly update these governing bodies on the prevention, detection and mitigation of cybersecurity incidents. This reporting includes detailed insights into the institution's cybersecurity posture, ongoing initiatives and any necessary adjustments or enhancements to existing measures.


text: The communication between management, the ISSG, and the Credit and Risk Committee facilitates a holistic understanding of cybersecurity risks, ensuring proactive measures are in place to safeguard Bancorp's operations, preserve its financial stability, and maintain the trust of its stakeholders.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company and its constituents through robust investments and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with executive leadership, the Company's ERM function, and the Company's Vice President of Information Technology.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of senior leadership, which includes the Company's Vice President of Information Technology.


text: The Vice President of Information Technology, in coordination with executive leadership including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Human Resources Officer ("CHRO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Vice President of Information Technology monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: The Vice President of Information Technology has been with the Company for over 25 years in various roles in information technology and information security. The Company's CEO, CFO and CHRO each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of our Advisor and other third-party service providers. Our Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and its operations.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Cybersecurity Program Overview Our Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Our Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: Our Advisor has identified a Cyber Incident Response Team, or Response Team, who is responsible for providing appropriate oversight, strategic direction, and decision making for an event that potentially could cause a material impact to the business. The Response Team includes the Chief Financial Officer, Chief Compliance Officer and General Counsel, and our Vice President of Operations and these individuals are responsible for coordinating the incident response, including any required notification to the Audit Committee or Board of Directors.


text: We rely on our Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We rely on our Advisor's risk management program and processes, which include cyber risk assessments.


text: We depend on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of our Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from our Response Team regarding the overall state of our Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our Response Team, is responsible for assessing and managing material risks from cybersecurity threats. Our management continuously assess, meet and prioritize cybersecurity risks and actions taken to mitigate these risks. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks. We leverage the resources of Monroe Capital, including the Head of Information Technology, who provides resources and expertise to assist us in our cybersecurity program. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of our Advisor.


text: Assessment of Cybersecurity Risk In the past three years, we have not experienced a material cybersecurity breach and the potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including its business strategy, operational results, and financial condition.


text: Risk Management and Strategy We maintain a cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats and to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Our cybersecurity program takes a risk-based approach and was developed to align with ISO 27001, the international standard for information security, and we also assess ourselves against the NIST Cybersecurity framework. In addition, our cybersecurity risk management program aligns with ISO 31000, the international standard for risk management. The foregoing does not imply that we meet any technical standards, specifications or requirements, or that we have been certified on these requirements in any respect, only that we have used these industry standards as guides when designing our cybersecurity and risk management programs.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. For example, cybersecurity threats are subject to our firm-wide Risk Events Policy, which sets forth procedures for the identification, escalation, recording, investigation and approval of handling of such risk events.


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. Major incidents emanating from cybersecurity threats are notified to our Operational Risk team through our enterprise risk management system and escalated in accordance with our incident response plan. In addition, cybersecurity has been designated as a principal risk by the Risk Committee of our Board of Directors (the "Risk Committee"), which requires regular monitoring and reporting.


text: We identify material risks from cybersecurity threats through various sources, including, but not limited to, controls testing, compliance testing of our security standards, penetration testing, threat intelligence, and lessons learned and assessments against control frameworks. These threats are assessed by applying our Risk and Control Self-Assessment ("RCSA"), IT risk, and cybersecurity risk management processes, each of which we review regularly. Based on the RCSA, risks from cybersecurity threats that exceed established risk tolerance thresholds are recorded and incorporated into our reporting to the Risk Committee and senior management as described in more detail below. We also engage third-party assessors, consultants and auditors to assist in the administration, assessment and improvement of our cybersecurity risk management program.


text: To help bring risks from cybersecurity threats within an acceptable range, we address risks through compensating controls or remediation, commensurate with the assessed risk level from such threats. Cybersecurity incidents that are determined to be major are escalated on a timely basis in accordance with our cybersecurity incident response plan.


text: With respect to third-party service providers with access to our information systems, assets or data, our security policies and procedures are designed so that diligence is conducted as appropriate on the cybersecurity controls maintained by such third parties and to ensure that the Company has cybersecurity measures in place with respect to their access to our information systems, assets or data.


text: We have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the business strategy, results of operations or financial condition of the Company. Please refer to the risk factor captioned " We could be subject to losses and reputational harm if we, or our agents, fail to properly safeguard sensitive and confidential information against cyberattacks or other security breaches or if our business processes are not sufficiently resilient. " in Part I, Item 1A. Risk Factors, for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors has established a Risk Committee to assist the Board in its oversight of risk. As part of its responsibilities, the Risk Committee oversees management's implementation of our cybersecurity risk management program.


text: The Risk Committee receives regular reports from our Information Security leadership on our cybersecurity risks, including key status updates, security issues, current and future priorities, independent assurance, threat landscape and audit findings. The Risk Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity oversight. The full Board also receives periodic presentations on cybersecurity topics from our Information Security leadership or other internal security staff or external experts as part of the Board's continuing education program.


text: Our Information Security team, including our Information Security leadership, has primary responsibility for assessing and managing material risks to the Company from cybersecurity threats, including our overall cybersecurity risk management program and supervision of our internal cybersecurity personnel and our external cybersecurity consultants.


text: Our Information Security team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including receiving regular briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Information Security leadership regularly briefs our Global Chief Operating Officer on cybersecurity issues, the scope of which is similar to the information presented by the Information Security leadership to the Risk Committee as described above. Major risks from cybersecurity threats determined following application of an RCSA are escalated by our Information Security leadership to the Risk Committee, Global Chief Operating Officer, Chief Technology Officer and other senior management.


text: Our Vice President of Strategic Initiatives and Chief Financial Officer oversee our cybersecurity risk management program described in "Risk Management and Strategy" below. While the Board of Directors has overall responsibility for risk oversight, it is supported in this regard by the Audit Committee, including with respect to cybersecurity matters. The Audit Committee assists the Board of Directors in monitoring cybersecurity risk by receiving as needed updates from and engaging in discussions with the Vice President of Strategic Initiatives and the Chief Financial Officer, that cover, among other things, our cybersecurity risk management program, response readiness and training efforts. The Audit Committee updates the full Board of Directors on cybersecurity matters as appropriate.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: Risk Management and Strategy Our business is dependent upon our computer systems, devices and networks to collect, process and store the data necessary to conduct almost all aspects of our business. We maintain a cybersecurity risk management program, which includes internal and external human resources, processes, controls and technology designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats.


text: To safeguard our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner at a network and user end point level. These include, but are not limited to, internal reporting, monitoring and detection tools. We engage various third-party vendors to provide these security services, including providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. In addition, we engage a third-party vendor to perform penetration testing at least annually and our IT team also performs simulations and response readiness tests on an annual basis. Our incident response plan sets forth our response protocol to coordinate the activities that we take to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage.


text: We have adopted an IT Policies and Procedures Policy that requires all employees to acknowledge on an annual basis their responsibilities in abiding with company policies regarding safeguard our network environment. In addition, all employees receive cybersecurity training upon hire with at least annual training on best practices, social engineering threats and cybersecurity risks.


text: We continuously monitor our computer systems, devices and networks, and work to improve our safeguards against regular and continually evolving cyber and other security threats. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident in the future that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For further information about the cybersecurity risks we face, see "Item 1A. Risk Factors – System disruptions or failures, cybersecurity risks, and compromises of data, or the failure to comply with related laws and regulations, could harm our business."


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology audit, information technology security, governance, and risk and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, and monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third-parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity incidents to identify and mitigate risks to us from third-party incidents. We also carry business interruption insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on us. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by cybersecurity strategies we have put in place. Despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, mitigate, and remediate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. For more information about the cybersecurity risks we face, see the risk factor entitled "We depend on the proper functioning and availability of our management information and communication systems and other information technology assets (including the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third-parties, or an inability to effectively upgrade such systems and assets could cause a significant disruption to our business and have a materially adverse effect on our results of operations" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Compliance, and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: In the normal course of business, we collect and store sensitive information, including proprietary and confidential business information, intellectual property, information regarding clinical and non-clinical trials, sensitive third-party information and employee information.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: We have processes designed to protect our information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks. Our cybersecurity strategy includes the use of managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform periodical penetration testing and other logical, physical and technical controls designed to deter, prevent, mitigate and respond to cybersecurity threats. Further, our information systems include continuous alert plans, and we provide periodical cybersecurity reminders to our employees to emphasizes the importance of adherence to our security policies.


text: We conduct organizational risk assessment, which help management in identifying data assets and recognizing and assessing potential threats, and investigating potential vulnerabilities. We are in the process of reviewing and implementing incremental information technology strategies to mitigate cybersecurity risks and their possible impacts. Risk assessments enable management to make risk management decisions and assign resources to mitigate risk. We also periodicly engage third parties to assess the effectiveness of our cybersecurity practices.


text: As of the date of this Annual Report, we do not believe that any past cybersecurity incidents that have been detected have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. We do not carry a separate cybersecurity commercial insurance policy covering the potential financial losses that may occur in the event we experience a cybersecurity incident.


text: See "Risk Factors - Risks Related to Our Business and Operations" for additional information about the risks to our business associated with cybersecurity or a breach or compromise to our information security systems.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to board committees.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: We rely on a series of processes to identify threats, hazards, and other risks to our assets. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. Our processes and practices are reviewed by audits, regulators, and independent reviews of information security and cybersecurity practices and processes carried out by professional services organizations retained by us against industry requirements, such as the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool. These frameworks also provide guidance that we leverage for overseeing and identifying cybersecurity threats associated with the use of third-party service providers. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis.


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology and Information Security teams meet weekly across several disciplines to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.


text: The Information Security and Information Technology teams support the business through early engagement in the Project Management Office routines and the Vendor Management Office's requirements, to ensure that new products, projects, and third-party vendors are onboarded with appropriate oversight.


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.


text: State regulators have also been increasingly active in implementing cybersecurity standards and regulations. Recently, several states, notably including California where our banking business is concentrated, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states (including California) have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California where most of our clients are located.