text: We maintain an incident response plan (IRP) aligned with National Institute for Standards and Technology Risk Management Framework (NIST RMF) when responding to incidents. The IRP sets out a coordinated approach to investigating, containing documenting and mitigating incidents. Our CISO, with oversight from our Chief Information Officer (CIO), is responsible for executing the relevant cybersecurity incident response plan, which includes response criteria for materiality, applicable requirements for incident disclosure and reporting and escalation procedures to various individuals and departments, including our Audit Committee, Senior Management, Key Stakeholders, General Counsel, Chief Financial Officer and Chief Executive Officer, for risks with a potentially material impact for responding to cybersecurity incidents. In addition to our in-house team and third-party security operations services, we also engage assessors, consultants, auditors and other third parties from time to time to assist with assessing, identifying and managing cybersecurity risks. For example, we leverage third-party security and compliance companies with subject matter expertise in these areas for threat identification and remediation. We continue to work with the U.S. Department of Defense on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks, including through participation in the Department of Defense's collaborative information sharing. We also partner with other work groups to support understanding and deployment of the Cybersecurity Maturity Model Certification (CMMC) to promote readiness in complying with cybersecurity requirements for handling CUI and federal contract requirements.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: RISK MANAGEMENT AND STRATEGY Information security risk includes the risk that cyber incidents and threats could result in a failure or interruption of our business operations. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations. We have implemented processes to identify, assess, and manage material risks from cybersecurity incidents or threats that may directly or indirectly impact our business strategy, results of operations, or financial condition. Please refer to " Item 1A. Risk Factors " for additional information on our operational risk, which includes the risk of failures or interruptions in information systems resulting from cybersecurity threats or incidents.

companyName: Federal Home Loan Bank of Des Moines

secItem: Item 1C


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the audit committee of the board of directors as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant environments. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Senior Director of Information Technology and Chief Financial Officer evaluate material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: The Company's President and Chief Executive Officer, Luca Fabbri, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program and incident reporting, in partnership with other business leaders across the Company. In the event there is a material cybersecurity breach or incident, Mr. Fabbri works in coordination with the Company's General Counsel, Christine Garrison, to assess and respond, including by reporting this incident to the Board and/or applicable regulatory authorities, as necessary or required. Mr. Fabbri has a high level of exposure to cybersecurity oversight through his current and previous work in the technology sector. Mr. Fabbri has served in various roles in information technology and information security for over 30 years, including serving as a consultant with Elk Creek Ventures Inc. from 2003 to 2012, through which he provided consulting services in technology, and serving as co-founder and vice president of engineering of Co3 Systems Inc., an enterprise software company in the cybersecurity space that is now part of IBM, from 2010 to 2011. Mr. Fabbri also co-founded a software company called HomeSphere, for which he served as senior vice president and chief financial officer from 2000 to 2002, and currently serves on the board of directors of Basil Systems Inc., a healthcare software company. Mr. Fabbri, Ms. Garrison and the Company's Chief Financial Officer each hold degrees in their respective fields, and each have over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.

companyName: Farmland Partners Inc.

ticker: FPI


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based, threat-informed approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are evaluated and prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk or threat. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives. The Company's cybersecurity program also includes a Security Operations Center ("SOC") that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity. The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe. The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Further, the Company's cybersecurity program is periodically reviewed by its Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO" and, together with the CIO, the Company's "Cybersecurity Leaders") and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: We depend heavily on various information systems and electronic resources to conduct our business operations. Additionally, a majority of our clients, service providers, and other business partners on whom we rely, including providers of our online banking, mobile banking, and accounting systems, utilize their own electronic information systems. Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals, as well as by malicious actors employing sophisticated and continuously evolving software, tools, and strategies. Given our status as a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious actors. For further details, please refer to the "Risks Related to Information Security and Business Interruption" section of the Risk Factors outlined in Item As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program; Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats; Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time; Managing and maintaining cybersecurity controls utilizing available people, processes and technology; Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers; Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the board of directors (the "Audit Committee"). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Director of IT who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our dedicated personnel are knowledgeable about our products and systems and experienced information systems security professionals and information security managers with many years of experience. Management regularly updates the Audit Committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.

companyName: Acutus Medical, Inc.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: SOLITRON DEVICES INC

ticker: SODI


text: Our business requires us to share data, and have our systems interact, with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors. This interaction and sharing of data creates risks to our systems and makes us vulnerable to third party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies and includes cybersecurity team assessments of third party products and systems proposed to connect to our information systems or access or store our data. A subgroup of our cybersecurity team is dedicated to risk assessment analyses of vendor security practices and protections. We leverage the FAIR (Factor Analysis of Information Risk) model to help quantify the third party's cyber risk. We endeavor to incorporate security measures into contracts with vendors. In addition to protecting our assets and systems, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan, updated annually, that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management. We have a cybersecurity incident response team composed of a smaller, core group of our cybersecurity team. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management as appropriate based on the nature of the incident.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: WTW has a global Information and Cyber Security Incident Response Plan ('ICSIRP' or 'Plan') for identifying and managing cyber and data security threats. The ICSIRP defines the roles and responsibilities of WTW stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. • Technical Safeguards: WTW seeks to continuously improve implemented technical safeguards that are designed to protect WTW's information systems. Standards include controls for access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While WTW seeks to maintain adequate controls, they may not always be effective. See Part I, Item 1A Risk Factors under the heading 'Data and cybersecurity breaches or improper disclosure of confidential company or personal data could result in material financial loss, regulatory actions, reputational harm, and/or legal liability' for more information about WTW's technical controls, management, mitigation, and security practices as well as the risks related thereto. • Education and Awareness: WTW's policy is that all WTW colleagues are required to receive annual, mandatory privacy and information security training. • Third-Party Risk Management: WTW's risk management strategy includes a third-party risk management process that is intended to be aligned to the technology security key controls across the organization. • Threat Intelligence: WTW seeks to obtain threat intelligence on cyber threats to WTW at the strategic, operational and tactical levels.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Each Old Republic operating subsidiary maintains its own security program based on its particular risk, applicable insurance industry requirements, and mandates and guidance from the CISO and enterprise-wide security advisory team. These programs encompass asset protection, threat identification, monitoring, timely response procedures, containment and recovery measures, and internal escalation procedures. An enterprise-wide information technology team consisting of a working group of information technology leaders representing all operating subsidiaries meets regularly for the review and monitoring of and updates to information security business processes due to significant changes in operating environments, statutory or regulatory changes or changing or emerging threats. Operating subsidiaries are required to report certain cyber incidents based on documented severity classification to the enterprise-wide information technology team. This team consists of key information technology personnel, including the CISO and the Chief Information Officer (CIO). They are responsible for overseeing incident response and escalation to the Company's General Counsel and Chief Financial Officer (CFO) when necessary. As part of the Company's overall risk management strategy, the General Counsel, CFO, and CIO, in consultation with the CEO, navigate escalated incidents for law enforcement and other external engagements and assess the impact and materiality of such incidents on the Company's enterprise-wide business.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: Our cybersecurity risk management program includes an incident response ("IR") plan that is designed to facilitate our response to cybersecurity incidents, including an escalation process for cybersecurity incidents that may have a moderate or higher business impact to notify our executive officers, other members of our senior management team and other internal stakeholders. The IR plan provides our executive officers and other members of our senior management team with the information needed to assess whether a cybersecurity incident materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition, and the need for public disclosure. We aim to test the IR plan at least annually to assess its operational effectiveness. We strive to conduct an annual "tabletop" exercise during which we simulate cybersecurity incidents to help us prepare for and respond to a cybersecurity incident and to identify areas for potential improvement. These exercises are conducted in close coordination with members of our internal cybersecurity risk management team, our retained cybersecurity incident response consultants, outside cybersecurity counsel and internal technical, operations and insurance risk management, internal audit and legal personnel, as well as certain executive officers and members of the senior management team.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: The Audit Committee of Kroger's Board of Directors is charged with oversight of data privacy and cybersecurity risks. Kroger's CIO and CISO provide quarterly updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full Board at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the Board on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CIO and CISO discuss and present strategies to address geopolitical threats that may affect operations as well as technological changes, such as AI and quantum computing. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. An independent third party also regularly reports to the Audit Committee and the full Board on cybersecurity, and outside counsel advises the Board on best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.

companyName: KROGER CO

ticker: KR


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, third-party cybersecurity software providers. Additionally, we use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, including the performance of audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to interruptions to our operations such as our clinical trials; regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" risk factor.

companyName: Tracon Pharmaceuticals, Inc.


text: The Company uses a Disaster Recovery Plan (the "Plan"), along with incident response policies, to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Company and with our Board of Directors, notify law enforcement, regulatory bodies, and other government agencies, and notify customers and employees. The Plan provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team ("CMT"). The CMT facilitates coordination across key stakeholders of the Company. The Company's CIO and key members of management are members of the CMT. The Company provides the CIO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Company's data for the benefit of our customers, employees and shareholders. We regularly engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Company's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives. The CIO and other members of the information technology team receive ongoing training related to developing threats, proactive solutions and industry best practices in order to effectively protect the Company and its stakeholders.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures, processes, standards, and policies designed to manage and mitigate such risks and potential material impacts to our Information Assets. The various risk management and reduction measures we implement for certain areas of our environment and systems include: maintaining policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; conducting internal and external audits designed to assess our exposure to certain cybersecurity threats, compliance with internal risk mitigation procedures, and effectiveness of relevant controls; conducting background checks on certain of our and our third parties' personnel; adopting network security controls in certain environments and systems; segregating certain data; adopting physical and electronic access controls and; asset management procedures monitoring certain systems; implementing a vendor risk management program; training staff on security; conducting red/blue team exercises; maintaining cyber insurance; maintaining a dedicated information security staff; and using a third-party managed security operations center. We seek to prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as exposure of customer data, interruption of services, ransomware, intrusion of networks, and data exfiltration or exposure.

companyName: Grindr Inc.

ticker: GRND


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: has primary responsibility for the development and oversight of Alternus's cybersecurity team and the development and maintenance of the company's related cybersecurity policies and procedures. The CIO has over 20 years' experience working in the information and operational technology field. The company's cybersecurity team continuously assesses the evolving cyber threat landscape based on their expertise and that of our third-party partners. They then work with all parts of Alternus to protect against, detect, identify, respond to, and recover from the risks that cybersecurity threats present. The cybersecurity team views and responds to cybersecurity risks in a holistic manner, applying a comprehensive multilayered strategy to prevent, detect, and mitigate them. They have identified Alternus's critical cyber assets and taken appropriate steps to protect them. External expertise is regularly engaged to assess Alternus's cybersecurity program and help the cybersecurity team to strengthen the organization's monitoring, alerting, prevention, mitigation, and recovery capabilities. Third party cyber vulnerability assessments, maturity assessments, and partnerships are used to assess and refine all elements of our cybersecurity program. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of Alternus's applications are required to document user access reviews regularly. We request a System and Organizational Controls (SOC) 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our Board has delegated the primary responsibility for oversight and review of the Company's cybersecurity program to the Audit Committee. The Audit Committee actively participates in discussions regarding cybersecurity risk exposures and steps taken by management of Cohen & Steers to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Cohen & Steers and align Cohen & Steers' risk exposure with our strategic and business objectives. At least annually, the Audit Committee reviews with the Advisor and Cohen & Steers' CTO the Cohen & Steers' cybersecurity program, including the robustness and efficacy of Cohen & Steers' overall cybersecurity program, steps taken to enhance defenses and security measures in place and its established plans to identify, detect and respond to threats Cohen & Steers may encounter. The Audit Committee also annually reviews and discusses with the Advisor cyber insurance coverage. In addition, as necessary, our Board (or the Audit Committee) receives reports and communications from the Advisor regarding material risks and specific developments that may cover topics such as: the Advisor's computerized information system controls; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices including with respect to peers and third parties.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: This Current Report on Form 8-K contains forward-looking statements made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, such as the Company’s expectations or beliefs regarding future events, actions or performance related to the Incident, including the results of the Company’s ongoing investigation of the Incident, the impact of the Incident on the Company and its financial condition and results of operations, and the timing and results of the recovery efforts from the Incident. Forward-looking statements typically are identified by use of terms such as “anticipate,” “believe,” “expect,” “project,” “may,” “will,” “should,” “could,” “likely” and similar words. Except as required by law, the Company undertakes no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise. The Company’s actual results could differ materially from those contained in forward-looking statements due to a number of factors, including the completion of the Company’s investigation into the Incident, the ultimate results from the Company’s investigation, the timing of the restoration of full access following the Incident, possible changes in customer sentiment due to the Incident and other risks and factors described by the statements under “Risk Factors” in the Company’s most recent Annual Report on Form 10-K and in its subsequent filings with the United States Securities and Exchange Commission.

companyName: DATA I/O CORP

ticker: DAIO

secItem: Item 1.05


text: On July 25, 2024, the Company determined that the cybersecurity incident has likely had a material impact on the Company’s business operations. The incident consisted of the third party’s unauthorized access to a portion of the Company’s internal information systems and the exfiltration of certain files, including files potentially containing sensitive personal information. The Company is still investigating the extent of any personal or otherwise sensitive information contained in the files acquired by the unauthorized third party, including if any personal information of customers was impacted. The Company intends to provide required notifications to affected and potentially affected parties and to applicable regulatory agencies. As part of its process to contain, assess and remediate the incident, the Company took measures, including shutting down certain of its systems, to isolate its operations from the Internet, which resulted in disruption to the Company’s business operations, despite the implementation of workarounds for certain offline operations, and limitation of access to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems. Although the Company has substantially restored its information systems and data that were impacted by the cybersecurity incident and has resumed normal business operations, it continues to assess operational impacts and evaluate additional measures to strengthen its surveillance of cybersecurity threats and to prevent unauthorized cybersecurity incidents on or conducted through its information systems and to strengthen its information backup protocols.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: On August 25, 2025, Wytec International, Inc. (the “Company”) became aware of a cybersecurity incident in which a bad actor published a defaced website at the Company’s web address, wytecintl.com. After the Company restored the website from back-ups, the bad actor was able to deface the website again. To date the Company has received no contact from the bad actor, nor is it aware of any reason for this attack. On August 25, 2025, the Company took the website down, placing a temporary page on the site, while the Company continues to review the entire web platform, so that the site may return as soon as security has been confirmed. The Company anticipates these measures will lead to the full restoration and functionality of the Company’s website. Moving forward, the Company plans on taking appropriate steps, including implementing additional cybersecurity measures, to prevent further attacks. As a result of this incident, in addition to losses arising from the website being inoperable, the Company was forced to cancel a seminar scheduled for September 2, 2025. The financial losses from this incident are difficult to quantify at this point, but will likely be significant. The Company is working with forensic specialists and has reported the matter to the Federal Bureau of Investigations. The Company will provide updated guidance regarding how it will further address this incident once its full assessment is complete.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: On December 24, 2025 (PST) and December 28, 2025 (PST), Coupang Corp., a wholly-owned Korean subsidiary (“Coupang Corp.”) of Coupang, Inc. (“Coupang, Inc.,” “our,” or “we”) (Coupang Corp., together with Coupang, Inc. and its subsidiaries and affiliates, “Coupang,”), issued updates (collectively, the “Updates”) on the cybersecurity incident (the “Incident”) disclosed in the Current Report on Form 8-K filed by Coupang, Inc. with the U.S. Securities and Exchange Commission (the “SEC”) on December 16, 2025. The Updates provided, in part, that the perpetrator of the Incident has been identified, is cooperating with Coupang and investigators, and has turned over all devices used in the Incident. Further, the investigation to date indicates that while approximately 33 million accounts were accessed, the perpetrator only saved limited data from approximately 3,000 customer accounts, and such customer data has been deleted without having been shared with a third party. In addition, Coupang Corp. announced a customer compensation program to issue approximately 1.685 trillion won (approximately $1.2 billion) worth of vouchers, starting January 15, 2026, to customers who were notified of the Incident at the end of November 2025 that may be applied towards future Coupang purchases. These vouchers will be reflected as reductions to the selling price and revenue recognized on each corresponding transaction.

companyName: Coupang, Inc.

ticker: CPNG


text: On May 11, 2025, Coinbase, Inc., a subsidiary of Coinbase Global, Inc. (“Coinbase” or the “Company”), received an email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation, including materials relating to customer-service and account-management systems. The communication demanded money in exchange for not publicly disclosing the information. The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities. These instances of such personnel accessing data without business need were independently detected by the Company’s security monitoring in the previous months. Upon discovery, the Company had immediately terminated the personnel involved and also implemented heightened fraud-monitoring protections and warned customers whose information was potentially accessed in order to prevent misuse of any compromised information. Since receipt of the email, the Company has assessed the email to be credible, and has concluded that these prior instances of improper data access were part of a single campaign (the “Incident”) that succeeded in taking data from internal systems. The Company has not paid the threat actor’s demand and is cooperating with law enforcement in the investigation of this Incident.

companyName: Coinbase Global, Inc.

ticker: COIN


text: On May 1, 2024, Brandywine Realty Trust (the “Company”) detected what was determined to be a cybersecurity incident, whereby a third party gained unauthorized access to portions of its information technology (“IT”) environment. Upon detecting the unauthorized occurrences, the Company promptly initiated its previously established response protocols and began taking steps to contain, assess and remediate the incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, shutting down some systems and notifying law enforcement. The cybersecurity incident consisted of unauthorized access and deployment of encryption by a third party to a portion of the Company’s internal corporate IT systems. The incident caused disruptions to, and limitation of access to, portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems. Based on the information reviewed to date, the Company believes the unauthorized activity has been contained and is working diligently to bring the impacted portions of its IT systems back online. Although the Company ascertained that certain files were exfiltrated, it is still investigating the extent of any sensitive information contained within the accessed IT systems, including any personal information. The Company is evaluating what, if any, regulatory and legal notifications are required as a result of this incident and will issue such notifications based on its findings.

companyName: BRANDYWINE OPERATING PARTNERSHIP, L.P.


text: a smaller reporting company with limited cash resources, we do not currently maintain formal cybersecurity policies, processes, procedures, or training programs. We do not have personnel specifically dedicated to cybersecurity risk management. We are aware of the importance of cybersecurity protections and intend to develop a more robust cybersecurity framework if financial and operational conditions permit.

companyName: Adapti, Inc.

ticker: ADTI


text: We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above. Audit results and the risk assessments are reviewed by our Chief Financial and Administrative Officer, the principal of the MSSP, and our Vice President of Risk Management. Any exceptions are addressed with a remediation plan and implemented with appropriate resources. Audit results, risk assessments and remediation plans are discussed with the Audit Committee of the board of directors, who has responsibility for cybersecurity risk oversight, each quarter until all points are fully resolved.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors."

companyName: Vivani Medical, Inc.

ticker: VANI


text: Cybersecurity Governance As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer, is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our Chief Execuctive Officer, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.

companyName: CORVEL CORP

ticker: CRVL


text: Risk Management and Strategy AFG recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats as defined by the Securities and Exchange Commission. Like all businesses, AFG is a target for "cyber-attacks," "ransomware," "phishing," "hacking" and similar illegal or unauthorized intrusions into computer systems and networks. Such events can result in significant disruptions to information technology systems, the theft of information and financial assets and reputational harm. AFG could also incur significant expenses associated with investigating and remediating any such event.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: After receiving notice of a cybersecurity threat, such threats are investigated to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire ISC is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct legal and forensic investigations and work with other third parties who might be engaged to assist in any response and associated publicity.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Management's Role in Managing Risk Senior management is responsible for creating and recommending for approval to the Board of Directors risk appetite metrics related to cybersecurity, reflecting the aggregate levels and types of risk the Company is willing to accept in connection with the operation of our business and pursuit of our business objectives.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Risk Management and Strategy The Company is subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition, and liquidity. See also our discussion in the Risk Factors in Item 1A of this report. As a component of our Company-wide enterprise risk management framework, we implemented a cybersecurity program whose objective is to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of the electronic information systems that we own. We regularly perform internal security assessments, engage third-party consultants to conduct external security assessments, and participate in, conduct, and/or administer exercises, drills, and recovery tests as part of this program. We also maintain training programs and policies and procedures designed to safeguard employee handling and use of data, internet usage, controlled access measures, and physical protections. We consult with industry groups, monitor threat intelligence reports, and communicate with various government agencies in an effort to stay up-to-date on changes in the cybersecurity threat landscape. This program, in addition to addressing our own information systems, is also designed to oversee, identify, and reduce the potential impact of a security incident at a third-party service provider or that otherwise impacts third-party technology and systems we use.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Our cybersecurity program includes safeguards that are designed to protect the Company's information systems from cybersecurity threats. Such safeguards include firewalls, automated intrusion detection systems, anti-malware functionality and access controls, which are evaluated and improved through periodic vulnerability assessments and ongoing cybersecurity threat intelligence. We have established and maintain an incident response plan that addresses the Company's response to and recovery from a cybersecurity incident. The incident response plan is tested and evaluated on an annual basis.

companyName: Phreesia, Inc.

ticker: PHR


text: We have established procedures for evaluating, recognizing, and managing significant risks stemming from potential unauthorized events occurring on or through our electronic information systems. These procedures comprise an important part of our overall enterprise risk management systemand are aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. Internally we have an Internet, Email and Computer Use Policy and all of our employees have been trained on the policy and related tools. Additionally, we employ processes to manage and identify risks arising from cybersecurity threats linked to supplier and customer relationships and our utilization of third-party technology and systems.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: We provide recurring mandatory information security training (which includes cybersecurity training) to our associates based on access, risk, roles, and behaviors.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: In order to oversee and identify risks from cybersecurity threats associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.

companyName: CORPAY, INC.

ticker: CPAY


text: Management's Roles and Responsibilities Operational responsibility for cybersecurity falls to the management, led by the IT department. The management team is tasked with executing our cybersecurity strategy, focusing on risk assessment, incident prevention, and response. This includes conducting vulnerability assessments, ensuring continuous monitoring, and staying updated on cybersecurity trends and threats. The Software Engineer, with extensive experience in information security, works in close coordination with other key management roles to ensure a unified approach to cybersecurity across our company.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: The CISO and VP of Information Security have more than 25- and 30-years' experience, respectively, working directly in the cybersecurity industry, performing and coordinating red-teaming and blue-teaming exercises, conducting research and developing cybersecurity tools and products, as well as presenting at various international conferences.

companyName: Satellogic Inc.

ticker: SATL


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.

companyName: Sweetgreen, Inc.

ticker: SG


text: Our board-level Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Risk Committee is engaged, as needed, in accordance with our Cybersecurity Incident Response Plan.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: JetBlue places great importance on safety including cybersecurity, to protect against various threats. The Company's cybersecurity strategy prioritizes detection, analysis and response to cyber threats, effective management of cyber risks, and resilience against cyber incidents. Safety is the Company's #1 value, and the strength of our safety is supported by exercising vigilance in security, including cybersecurity.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: The Information Security and Information Technology teams support the business through early engagement in the Project Management Office routines and the Vendor Management Office's requirements, to ensure that new products, projects, and third-party vendors are onboarded with appropriate oversight.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Ault Disruptive Technologies Corp


text: In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the our chief executive officer for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting, including controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.

companyName: TaoWeave, Inc.

ticker: TWAV


text: We have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: Our CISO oversees our cybersecurity risk management in partnership with our Vice President of Information Technology, Chief Financial Officer, General Counsel, Chief Compliance and Privacy Officer and other members of management. These members of management monitor and are informed of the prevention, mitigation, detection and remediation of cybersecurity incident through their management of, and participation in, the cybersecurity risk management and strategy processes described above.

companyName: NEVRO CORP


text: In addition, we provide regular security awareness education and training for all employees and consultants, conduct internal "phishing" testing and training for "clickers," require mandatory security training for all new hires and publish periodic cybersecurity newsletters to highlight any emerging or urgent security threats. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Meetings of our board of directors include discussions and presentations from management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management on our enterprise risk profile on an annual basis. The board of directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.

companyName: Lipocine Inc.

ticker: LPCN


text: Our overall cybersecurity risk management objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards, threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Although the Company has confidence in the security measures and processes it deploys to protect its environment from cybersecurity threats, neither the Company nor the third parties it relies on may be able to fully, continuously, and effectively implement security controls as intended. As stated above, we utilize a risk-based approach and judgment to determine which security controls to implement, and it is possible we may not implement appropriate controls if we fail to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, but not fully eliminate, risks. The full impact of security events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of the Company's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Cybersecurity Governance" below, the Board's oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with the Company's risk management function, the Company's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: The Company has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: The Company deploys a range of people, process and technical controls that are designed to protect the Company's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises; ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, and restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which the Company does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by the Company's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: BlackRock Finance, Inc.


text: Our Board of Directors is tasked with overseeing data privacy and cybersecurity risks. They regularly review the Company's cybersecurity program with management, evaluating the adequacy of controls and security for our information technology systems. Additionally, they assess the Company's response plan in case of a security breach affecting these systems. Annually, the Board of Directors receives updates on potential cybersecurity incidents, data privacy, and compliance programs, engaging in active discussions with management on cybersecurity risks.

companyName: Vanguard Green Investment Ltd

ticker: VGES


text: Risk Mitigation Measures The information security team implements and maintains a multi-layered defense approach to safeguard the Company's information technology infrastructure in accordance with industry best practices and updates the Company's systems and software to address identified vulnerabilities. The Company has also developed an incident response and disaster recovery plan to respond to cybersecurity incidents.

companyName: IMAX CORP

ticker: IMAX


text: As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect our systems and information may not successfully protect against all cyber incidents. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further action, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors–If we or our service providers do not maintain the security of information relating to our customers, employees and vendors and our music, security information breaches through cyber security attacks or otherwise could damage our reputation with customers, employees, vendors and artists, and we could incur substantial additional costs, become subject to litigation and our results of operations and financial condition could be adversely affected."

companyName: Reservoir Media, Inc.

ticker: RSVR


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Arrow's Board of Directors, Chief Information Officer, Director of IT and our enterprise risk management group all have a role in the cybersecurity risk management program.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Governance, Risk Management, and Strategy. As part of our overall risk management process, we have established a cybersecurity program and dedicated teams to manage and assess material risks from cybersecurity threats, direct the policies and procedures in place to protect our information systems, and respond to cybersecurity incidents if they occur. These teams and committees, which additionally monitor the prevention, detection, and remediation of cybersecurity incidents, include the following: • Our Cybersecurity Executive Council, which is comprised of executive leadership, including our Chief Executive Officer, General Counsel, Chief Information Security Officer, and senior leaders from our segments and key operating companies. The Cybersecurity Executive Council is responsible for reviewing policies and procedures related to cybersecurity and our cybersecurity program. Such policies and procedures, as well as our cybersecurity program generally, are discussed with the Board. • Our Cybersecurity Compliance Committee, which is made up of key cybersecurity and information technology personnel at the segment and operating company levels, receives regular updates and training with respect to cybersecurity in order to advise and assist management, including the Cybersecurity Executive Council, in implementing information systems security and incident response at our operating companies.

companyName: EMCOR Group, Inc.

ticker: EME


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Financial Officer, and the Vice President of Operational Engineering. Those members of management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes members of management reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine and prioritize the security controls and measures utilized. In addition, security controls and measures, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: Peapack Private's Chief Information Officer, Chief Technology Officer, and Information Security Officer are accountable for managing and ensuring compliance with the Bank's information security program. Included in the responsibilities of this management team is the oversight and the administration of the cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Risks from Cybersecurity Threats Even though, to date, cybersecurity risks have not materially affected our business or our results of operations, we face numerous and evolving cybersecurity threats. There can be no assurance that we, or the third parties with which we interact, will not face a cybersecurity incident in the future that will materially affect us. For more information about the cybersecurity risks we face, see the risk factor entitled "We rely significantly on information technology to operate our business, including our supply chain and retail operations, and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business" in Item 1A. Risk Factors.

companyName: NIKE, Inc.

ticker: NKE


text: Additionally, prior to engaging any vendor that will store sensitive Company information, PSCM performs due diligence on the vendor's information security infrastructure and requires that the vendor agree contractually that the Company's information will be encrypted in transit and at rest and that the appropriate user access controls will apply. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Pershing Square SPARC Holdings, Ltd./DE


text: Our Head of Cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. As a result, in addition to the regular updates referenced above, the Audit Committee and the full Board of Directors would also be promptly informed by the CFO and General Counsel of cybersecurity incidents in accordance with our security incident response procedures, as well as provided ongoing updates from lead members of the incident response teams, including the Head of Cybersecurity, regarding any such incidents in accordance with our incident response plan.

companyName: Capri Holdings Ltd

ticker: CPRI


text: Board of Directors The Audit Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. This includes the responsibility for reviewing and discussing with management and the Board of Directors our information technology use and protection, including, but not limited to, data governance, privacy, IT risks, compliance, cybersecurity and significant legislative and regulatory developments that could materially impact us, as well as the evaluation with management of the implementation and effectiveness of our controls to monitor and mitigate these risks and the oversight for any investigations related to specific cybersecurity or technology incidents. To fulfill this responsibility, the Audit Committee receives regular reports about cybersecurity risks from our CISO, and receives updates more often as needed, including in the event of a significant cybersecurity incident in accordance with our Cybersecurity Incident Response Plan. These regular reports periodically include information regarding the implementation and administration of the registrants cybersecurity processes, cybersecurity governance processes, status of projects relating to cybersecurity, cybersecurity matters relating to any particular products or services, summaries of any material cybersecurity threats or incidents and responses thereto, regulatory updates, updates on cybersecurity trends and the results of any assessments performed by internal stakeholders or third-party advisors.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: We also engage third party service providers when necessary to both expand our capabilities and capacity as well as evaluate the effectiveness of our cybersecurity program, including hosting regular table-top exercises meant to evaluate and improve the overall effectiveness of our cybersecurity program.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: The IS Program is monitored each year through various internal and external audits, as well as OCC regulatory exams. Vulnerability and penetration testing are also conducted at least annually by an independent third party to supplement the vulnerability and patching program routinely performed by internal staff. Third-party vendors supplement the Company's internal patching program as necessary. The Company also utilizes a third -party "SOC as a Service" to monitor extended detection and response logs and network traffic.

companyName: Investar Holding Corp

ticker: ISTR


text: We undertake vulnerability, attack, and penetration testing via a third-party audit. As part of our general control practices, we perform a review of service organizational controls reports for in-scope vendors to ensure adherence to generally accepted cybersecurity practices. Any reported weaknesses and associated responses are captured and evaluated for impact, and subsequently provided to our leadership for review and response.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: We recognize the importance of protecting both our information and operations from threats that could disrupt our business, put our assets at risk or compromise our customer and employee data. Our cybersecurity program is implemented and maintained using information security tools, policies and a dedicated team responsible for monitoring our networks, providing training to our employees, analyzing the evolution of new threats and strategies for mitigating such threats and seeking to continually harden our cybersecurity posture. The program is periodically exercised, reviewed, updated, and vetted through third-party audits, assessments, and tests with the goal of validating its effectiveness in reducing risk, as well as evaluating its compliance with legal and regulatory requirements. We assess, identify and manage our material risks from cybersecurity threats by employing the following: • Identification of critical systems – we seek to identify which operational or information technology, if compromised or exploited, would result in operational disruption or data compromise. We aim to protect the entire environment at an enterprise level where practical, combined with additional layered, risk-based controls designed to safeguard against cybersecurity threats. This strategic, defense-in-depth, and risk-based approach to cybersecurity provides a methodology designed to identify, protect, detect, respond, and recover from cybersecurity incidents. • Network segmentation – we use a combination of firewalls and routers to provide network segmentation seeking to provide us with network zone protection. • Access controls – we leverage several security capabilities to attempt to enforce access, authorization and authentication to relevant systems, technology, and controls. A least-privilege methodology is applied for localized client workstations, servers, and applications. Security capabilities for access control include physical, administrative, and technical controls that combine to provide a defense-in-depth approach designed to protect our cyber assets from unauthorized use. • Continuous monitoring, detection, and auditing – we employ various technologies, tactics, and procedures aimed to continuously monitor, baseline, and detect threats, and audit our network and systems. In addition, we use a combination of technology tools with outside managed security service providers designed to capture, analyze and respond to security anomalies. • Patch management – we use a network vulnerability scanning tool that continually scans, and reports identified vulnerabilities in servers and workstations in certain networks. Vulnerability scanner reports are used to drive patching and remediation efforts and are also used as a tool to evaluate the effectiveness of efforts to seek to ensure patches are applied timely. Application and infrastructure subject matter experts subscribe to various third-party vendor security notifications to receive proactive notifications on, among other things, bugs, security flaws and mitigations, related to operational and information systems.

companyName: Fat Brands, Inc

ticker: FATAQ


text: Risk Management and Strategy At Western Digital, our management team is charged with managing risk and bringing to our Board of Directors' attention all material risk exposures to our company. Our enterprise risk management ("ERM") process is designed to facilitate the identification, assessment, management, reporting and monitoring of material risks our company may face over the short-term and long-term and promote regular communication with our Board of Directors and its committees regarding these risks. Through our ERM process, we have determined that the compromise, damage and interruption of our technology infrastructure, information systems or products by cybersecurity incidents are key risks to our company that may have a material negative impact on our business. To help mitigate the potential impact of cybersecurity incidents on our business and protect against cybersecurity threats, we have established organizational structures, procedural measures and response plans that define roles and responsibilities related to cybersecurity risk management.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: ZeroStack Corp.

ticker: ZSTK


text: To assess, identify, and manage the risks of cybersecurity threats to our information system, we maintain a cybersecurity program, including policies and controls, which are regularly reviewed through internal and external assessments. We leverage several industry frameworks for adopting and assessing controls, such as HIPAA, the National Institute of Standards and Technology Cybersecurity Framework, and HITRUST. We have an active HITRUST certification and Service Organization Control ("SOC") 2 Type II security compliance that are issued by external entities.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: The foregoing responsibilities are covered on a day-to-day basis by the SVP/IT Manager and ISO. The ISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 22 years of cybersecurity experience, 18 of which was spent at a CPA firm specializing in banking industry financial and information technology audits.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, anti-malware software, and monitoring software agents that are installed on our devices.

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: We engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks as needed. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends.

companyName: AAON, INC.

ticker: AAON


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: Great Elm Group, Inc.

ticker: GEG


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024. The CCO has been responsible for this oversight function as CCO to the Fund for three years and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.

companyName: Fidelity Private Credit Co LLC


text: Cyber Incident Response: We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols, which is evaluated and tested on a regular basis. The Company has a process for employees to report suspected or confirmed cybersecurity threats or incidents. Generally, if a suspected or confirmed breach is identified, a Cybersecurity Incident Manager from the Global Information Security Team is assigned to evaluate and escalate the issue as needed to the VP Security. The Company's response to cybersecurity incidents (which includes prompt steps to protect our systems and information by containing and mitigating the impact of any incident) is managed by the VP Security, in consultation with the CIO, and when appropriate, with the CFO, COO, CEO and our Chief Legal Officer. These leaders will assess the materiality of a particular incident (alone or in combination with other factors), and the Chief Legal Officer will determine whether any reporting or notification responsibilities have been triggered. The CEO is responsible for informing our Board and the Audit Committee regarding any significant incidents, and coordinates management's recommendations concerning materiality.

companyName: CELESTICA INC

ticker: CLS


text: Our current CISO maintains appropriate security certifications and has over 20 years of experience in an information security role. The CISO manages a group dedicated to the security of the bank. This group is responsible for information technology monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CISO. Our CISO reports directly to our COO and oversees, is assigned the responsibly of and is held accountable for the implementation and monitoring of the Program. Our COO serves on the Risk Committee of the Board, chaired by a board director.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: Berkshire and its Business Groups rely on third-party service providers for a variety of products and services to run their information systems. This dependence exposes us, along with others who use these service providers, to the impact of a cyber-attack on their service providers. On occasion, a cyber-attack at a third party service provider could have a significant financial, operational or reputational impact to Berkshire. Berkshire and its Business Groups continuously monitor the risks associated with its service providers.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: During the third party procurement and contracting process, the Company incorporates due diligence procedures and contract provisions that are designed to align with applicable regulations and industry benchmarks.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of General Counsel, Head of HR & Chief Technical Officer (CTO) meets to make an initial assessment. If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our Chief Executive Officer, Chief Operating Officer, Chief Commercial Officer & Chief Financial Officer.

companyName: Beyond Air, Inc.

ticker: XAIR


text: Our Information Security Department is led by the CIO, who reports to the President and CEO. Our CIO establishes our strategic direction and provides executive support for our information security program, and has significant experience in information systems and information security. Refer to " Item 10. Directors, Executive Officers and Corporate Governance " for more information.

companyName: Federal Home Loan Bank of Des Moines


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity team, other IT domain experts, cybersecurity managing counsel and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Corporate Secretary and Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council. In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks through updates shared during Cybersecurity Council meetings and through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: As necessary, but not less than once per year, the Senior Director of Information Technology makes a presentation on cyber threats and the Company's efforts to mitigate them to the Company's Chief Executive Officer, Chief Financial Officer, and the Audit Committee. In addition, the results of annual internal audits of the effectiveness of internal control over financial reporting, including relevant information systems, are reviewed by the Audit Committee.

companyName: SURMODICS INC

ticker: SRDX


text: Company's executive management considers cybersecurity risk and other information technology risk as part of its risk oversight and has the ultimate responsibility for overseeing our cybersecurity strategy. Furthermore, during the year ended

companyName: Snail, Inc.

ticker: SNAL


text: We perform risk assessments relating to cybersecurity and technology risks at least annually. Our cybersecurity risk management program has been developed based on industry standards, including those published by the National Institute of Standards and Technology ("NIST"). Highlights of the program include: • Corporate policies and procedures that guide our use of information systems, confidentiality and security strategy; • Identifying critical assets and high-risk threats, and implementing technical prevention and detection controls and response and recovery practices; • A third-party risk management process to assist in making risk-informed technology product and services decisions on third parties who provide, manage, store or have access to material data or information, including the completion of security questionnaires and independent assessments of controls, audits and/or contract terms; • Defined data loss prevention standards in place to detect and prevent data loss, including requiring third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices; • Security awareness training for employees to identify cybersecurity concerns and take appropriate actions; and • Evaluating our program's effectiveness by performing regular internal and third-party assessments of our controls, including external penetration testing and consultation on security enhancements.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: Cybersecurity Risk Management and Strategy To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices.

companyName: AWARE INC /MA/

ticker: AWRE


text: The Technology Committee meets no less than quarterly, and its purpose is to (i) assist the Board with the oversight of technology strategy and significant technology initiatives and programs, including those that can position the use of technology to drive strategic advantages and (ii) fulfill oversight responsibilities with respect to technology risk, information management, and security risks (including cyber security, cyber fraud, and physical security risks), and the adequacy of PNC's business recovery, resiliency and contingency plans and test results.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and meets with the IOC, without other members of management present, during each meeting's executive session. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity, risk and compliance team, who are tasked with these responsibilities on a day-to-day basis.


text: date, we have not experienced any cybersecurity attacks. However, any such attack could adversely affect our business. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: Allegro Merger Corp.


text: Our VP of IT and Facilities is responsible for preparing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: While we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: Our Audit Committee provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.

companyName: Generation Bio Co.

ticker: GBIO


text: Education and Awareness: We plan to establish a security and privacy awareness program that runs throughout the year and includes training for all company personnel to enhance employee awareness of how to detect and respond to cybersecurity threats as well as more targeted training for company personnel that have increased responsibility for mitigating certain potential cybersecurity plan to review and update our policies, procedures, processes and practices to address changes in the threat landscape and as a result of lessons learned from suspected, actual or simulated incidents. We also plan to review industry best practices to assist in evaluating responses to new challenges and risks. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Trio Petroleum Corp

ticker: TPET


text: Other processes in place to further manage any additional security risk to the organization include: • identifying, reporting, and correcting information system flaws, security alerts, and advisories; • monitoring inbound and outbound communications for unusual or unauthorized activity; • designing and implementing application systems to include sound backup and recoverability principles, such as periodic data backups in the case of a disaster; • mechanisms designed for the physical protection of IT resources; and • use of all third-party and cloud computing services are reviewed and evaluated for material risks of cybersecurity threats by the IT security department before being formally authorized for use. Use of services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data, controlled unclassified information, or any other data owned or collected by the company.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI