text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For further discussion of the cybersecurity risks and threats we face, please see Item 1A. "Risk Factors".

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Senior Director of IT, and our Chief Financial Officer, and Treasurer, or the CFO.

companyName: Y-mAbs Therapeutics, Inc.

secItem: Item 1C


text: As of the date of this Amendment, the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH

secItem: Item 1.05


text: VF will be seeking reimbursement of costs, expenses and losses stemming from the cyber incident by submitting claims to VF’s cybersecurity insurers. The timing and amount of any such reimbursements is not known at this time.

companyName: V F CORP

ticker: VFC


text: The Registrant is actively conducting a forensic analysis to determine the nature, scope and impact of the incident. At this time, no conclusive evidence has been identified, but the investigation remains ongoing.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading experts, is working with law enforcement and notified certain regulatory authorities.

companyName: First American Financial Corp

ticker: FAF


text: Based on the information available to the Company on the date hereof, the Company has concluded that the Incident is not reasonably likely to have a material impact on the Company’s financial condition or its current or future business or results of operations, except as disclosed herein.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: While the full scope of the impact is not yet known, the incident could have the potential to have a material impact on the Registrant’s financial condition and results of operations. The Registrant is continuing its forensic investigation and analysis to assess the potential impact.


text: Coupang’s operations have not been materially disrupted. Coupang remains subject to various risks due to the Incident, including diversion of management’s attention and potentially material financial losses resulting from the potential loss of revenue and potential higher expenses, including from remediation, regulatory penalties, and litigation.

companyName: Coupang, Inc.

ticker: CPNG


text: As of the date of this report, the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: Lee maintains a comprehensive cybersecurity insurance policy, which covers costs associated with incident response, forensic investigations, business interruption, and regulatory fines, subject to policy limits and deductibles. The Company will provide updated guidance once a full assessment is completed.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: While the investigation is ongoing, as of the date of this filing, the incident has not had a material impact on the Company's operations, and the Company has not determined the incident is reasonably likely to materially impact the Company's financial conditions or results of operations.

companyName: SouthState Bank Corp

ticker: SSB


text: Also as previously disclosed, the Company determined that the threat actor accessed and exfiltrated limited data from the Company’s environment, which includes some personally identifiable information. The Company is continuing the process of providing appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law.

companyName: KEY TRONIC CORP

ticker: KTCC


text: During the disruption, certain networks and transactional services may not be accessible. The Company is providing updates on the incident at https://status.changehealthcare.com/incidents/hqpjz25fn3n7. Please access that site for further information.


text: As of the date of this Report, the incident has not had a material impact on the Company’s operations, and the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: The Company remains subject to various risks due to the cybersecurity incident, including potential litigation, changes in customer behavior, additional regulatory scrutiny, and the subsequent availability of, or increase in cost to the Company of, its insurance policy covering cybersecurity incidents.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: In coordination with legal counsel, the Registrant has notified relevant law enforcement about the matter, and has or will notify relevant federal and state regulatory bodies and agencies, and applicable consumer protection agencies, in accordance with applicable laws.


text: As of the date of this filing, this incident has not had a material impact on AT&T’s operations, and AT&T does not believe that this incident is reasonably likely to materially impact AT&T’s financial condition or results of operations.

companyName: AT&T INC.

ticker: T


text: While the investigation is ongoing, as of the date of this filing, the incident has not had a material impact on the Company’s overall operations, and the Company has not determined the incident is reasonably likely to materially impact the Company's financial conditions or results of operations.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Except as expressly provided above, the Waiver Period is not a waiver of any other right, power, or remedy under the Credit Agreement or Lease Agreement and both agreements remain in full force and effect.


text: In coordination with legal counsel, the Company has notified the relevant law enforcement about the matter, and will notify relevant federal and state regulatory bodies, and applicable consumer protection agencies, as necessary.


text: As of the date of this filing, the Company does not believe the incident is reasonably likely to have a material impact on the Company, including its financial condition or results of operations.


text: The former chief executive officer of Coupang Corp., our Korean subsidiary, resigned on December 10, 2025, and Harold L. Rogers, General Counsel and Chief Administrative Officer of Coupang, Inc., is serving as interim chief executive officer of the Korean subsidiary.


text: To date, the incident has not resulted in any material disruption to the Company’s operations. However, the Company continues to evaluate the scope and potential impacts of the event, including legal, financial, and reputational considerations, as well as any associated remediation costs.

companyName: Zoomcar Holdings, Inc.

ticker: ZCAR


text: On August 14, 2025, BayFirst National Bank (“BayFirst”) was notified of a cybersecurity incident experienced by a third-party provider of marketing services. On October 28, 2025, the third-party provider confirmed that some customer information was exposed by this incident.

companyName: BayFirst Financial Corp.

ticker: BAFN


text: As of the date of this filing, the incident has not had a material impact on the Company’s operations. The Company has not yet determined that the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: MICROSOFT CORP

ticker: MSFT


text: The Company currently expects that a significant portion of its direct costs incurred relating to containing, investigating and remediating the cybersecurity incident will be reimbursed through insurance recoveries.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: AT&T has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access. AT&T will provide notice to its current and former impacted customers.


text: As of the date of this filing, the Company believes it has contained the incident and has restored its core information technology environment and is in the process of restoring normal business operations.

companyName: Frontier Communications Parent, Inc.


text: The scope of the data potentially affected has not yet been fully determined, and the Company’s investigation remains ongoing. The subsidiary is also working closely with its cyber insurance provider to support the investigation, remediation, and potential claims process.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: While the full scope of the financial impact is not yet known, the incident is reasonably likely to have a material impact on the Company’s financial condition or results of operations. The Company is continuing its forensic investigation and analysis to assess the potential impact.


text: The Company’s investigation of the cybersecurity incident, including the Company’s assessment of the scope of personal information included in the exfiltrated information, remains ongoing. The Company intends to provide required notifications to affected and potentially affected parties and to regulatory agencies.

companyName: BRANDYWINE OPERATING PARTNERSHIP, L.P.


text: As of the date of this filing, the Company believes it has contained the incident. The Company is in the process of restoring access to its systems and resuming normal business operations.

companyName: First American Financial Corp


text: The Company continues to investigate the incident, has engaged cybersecurity experts, and has notified law enforcement authorities. The Company does not believe the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: Krispy Kreme shops globally are open, and consumers are able to place orders in person, but the Company is experiencing certain operational disruptions, including with online ordering in parts of the United States. Daily fresh deliveries to our retail and restaurant partners are uninterrupted.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: The incident has not had a material impact on the Company’s operations, and its information systems have continued to be fully operational. The Company does not believe the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: Cencora, Inc.

ticker: COR


text: Our investigation and forensic analysis to determine whether personally identifiable information was taken by the threat actors remains ongoing. We expect a definitive answer in the next several weeks.

companyName: LEE ENTERPRISES, Inc


text: The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: META MATERIALS INC.


text: Though the incident is still under investigation, the Company believes the perpetrator of the activity accessed certain Company systems, exfiltrated data and encrypted data on certain non-production systems.

ticker: FAF


text: As the investigation of the incident is ongoing, the Company will continue to monitor the timing and materiality of the incident.

companyName: NUCOR CORP

ticker: NUE


text: Based on the investigation and findings, SouthState will mail notification letters to individuals whose personal information may have been involved.

companyName: SouthState Bank Corp


text: The Company is also assessing the impact of the incident and whether it may have a material impact on its financial condition and results of operations, which at this point cannot be determined.


text: Since the filing of the Original Report, the Company has restored the IT systems and data that were impacted by the cyber incident and continues to work through minor operational impacts. The authorities have closed this investigation and were unable to identify the source.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: On March 1, 2025, the Registrant experienced a system outage caused by a cybersecurity incident. Upon discovery, the Registrant activated its incident response team, comprised of internal personnel and external cybersecurity experts retained to assist in addressing the incident.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: On February 3, 2025, Lee Enterprises, Inc. ("Lee" or the "Company") experienced a systems outage caused by a cybersecurity attack. Upon discovery, Lee activated its incident response team, comprised of internal personnel and external cybersecurity experts retained to assist in addressing the incident.

ticker: LEE


text: As previously disclosed in a Current Report on Form 8-K, on August 21, 2024, Halliburton Company (the “Company”) became aware that an unauthorized third party gained access to certain of its systems.

companyName: HALLIBURTON CO

ticker: HAL


text: The incident has temporarily impacted the Registrant’s operations, including shipping and receiving, some manufacturing processes, and various other back office functions, much of which are in the process of being restored. The Registrant has implemented temporary measures to maintain critical functions while systems are being restored.


text: During the disruption, the Company's primary website may be inaccessible or inoperative. The Company has created a special website for communications about the incident at the following URL: www.firstamupdate.com. Please access that site for further information.


text: The Bank immediately activated its response process, and determined that a fourth-party vendor (i.e., a vendor of a Bank vendor) had been compromised, which caused the incident.

companyName: Federal Home Loan Bank of New York


text: The cybersecurity incident involved the threat actor’s access to a portion of the Company’s IT system that contained sensitive personal information. The Company intends to provide notifications to affected and potentially affected parties and applicable regulatory agencies as required by federal and state law.

companyName: ENGLOBAL CORP


text: As of the date of this Amendment, the Company believes that the impacts of the cyber incident consist primarily of costs associated with rebuilding the website on a new server and hosting platform and enhancing security protocols.


text: While the Company expects the incident to have a material impact on the fourth quarter of 2023 results of operations, the Company does not believe the incident will have a material impact on the Company’s overall financial condition or on its ongoing results of operations.


text: The cybersecurity incident limited the Company’s ability to access portions of its business applications that supported aspects of the Company's operations and corporate functions, including financial and operating reporting systems for approximately six weeks.


text: As of the date of this filing, the incident has not had a material impact on the Bank’s operations, and the Bank believes the incident will not materially impact the Bank’s financial condition or results of operations.


text: As of the date of this disclosure, this incident has not had a material impact on the Company’s operations, and the Company is evaluating the impact this incident may reasonably have on its financial condition or results of operations.

companyName: F5, INC.

ticker: FFIV


text: The Company continues to assess whether the incident will have a material impact on the Company’s financial condition or results of operations, which at this point cannot be determined.


text: Targus has notified relevant regulatory authorities and will work with law enforcement with respect to the unauthorized access to information.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: On February 21, 2024, the Federal Home Loan Bank of New York (“Bank”), through its operational controls, detected unknown persons attempting to fraudulently obtain funds from the Bank (the “incident”).


text: On November 29, 2024, Krispy Kreme, Inc. (the “Company”) was notified regarding unauthorized activity on a portion of its information technology systems. The Company immediately began taking steps to investigate, contain, and remediate the incident with the assistance of leading cybersecurity experts.


text: Lee has implemented temporary measures, including manual processing of transactions and alternative distribution channels, to maintain critical business functions while systems are being restored.


text: The progress the Company is making, including interim measures and an expected timeline for restoration of key Change Healthcare systems, is described in a press release which the Company issued on March 7, 2024, a copy of which is attached to the Amendment as Exhibit 99.1.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Cybersecurity Risk Management and Strategy Wendy's is committed to securing our information systems against cybersecurity threats and protecting the privacy and security of our customers', employees', franchisees' and business partners' information. However, as described in "Item 1A. Risk Factors—Risks Related to Technology and Cybersecurity" of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's interconnected digital world and that, despite devoting considerable resources to secure our information systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Based on this recognition and taking into account experience from previous cybersecurity incidents, we have developed a comprehensive cybersecurity risk management strategy designed to identify, assess and manage potential threats to our information systems. Key components of our cybersecurity risk management strategy include the following: • CIS Controls. We design our cybersecurity risk management strategy based on the Center for Internet Security's ("CIS") Critical Security Controls Framework and other industry accepted standards and practices. The CIS is an internationally recognized, non-profit organization dedicated to developing controls, benchmarks and best practices for cybersecurity risk management. We conduct an annual assessment of our progress against the CIS controls to measure our performance against accepted benchmarks and identify ways to enhance our cybersecurity risk management strategy. The results of the assessment are reviewed by our Internal Audit team and shared with senior leadership and the Technology Committee of our Board of Directors. • Regular Risk Assessments. We conduct regular risk assessments to identify and assess material risks to our information systems, including as part of our enterprise risk management ("ERM") program, which is described in more detail under "Cybersecurity Governance" below. These risk assessments involve input from key stakeholders, including those with assigned accountability for managing risk and supporting technical risk subject matter expertise, and consider a variety of factors, including our global business strategy, operations and support, information systems and data assets. • Infrastructure. We design our cybersecurity infrastructure, including firewalls, endpoint security, intrusion detection tools and identity access management systems, to provide a multi-layered approach to protecting our information systems from unauthorized access, use, disclosure, disruption, modification or destruction. • Dedicated Personnel. We have several dedicated teams of cybersecurity specialists, including teams focused on executing internal and external vulnerability and penetration assessments, designing secure systems and applications, monitoring for intrusions and providing incident response. We have made significant investments in technology insourcing and reassumed direct ownership of certain information security related teams and functions. • Training. We have an ongoing cybersecurity training program for designated employees and contractors which addresses, among other things, our cybersecurity risk management processes, overall cybersecurity awareness and industry cybersecurity best practices. This training program includes initial onboarding training, annual refresher training and periodic awareness assessments such as email phishing campaigns to test user awareness and defend against business email compromise.

companyName: Wendy's Co

ticker: WEN


text: We maintain the following processes to assess, identify, and manage risks from cybersecurity threats: • Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure. • Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We leverage and maintain perimeter network defense solutions to discourage network-intrusion attempts. Within our network, we leverage endpoint security and ransomware detection and prevention solutions, and we use continuous monitoring of alerts and activities to identify and respond to any irregularities that could be associated with threats. • Training and Awareness. We conduct awareness training for our employees as part of our efforts to enable them to identify and report cybersecurity threats. We require cybersecurity training during employee and contractor onboarding, and we seek to reinforce the training through phishing tests on at least a quarterly basis as part of our efforts to reduce the potential for successful phishing and social-engineering attacks. • Cybersecurity Tool and Processes and Industry Standards. We refer to industry standards, such as those issued by National Institutes of Standards and Technology ("NIST") and International Organization for standardization ("ISO"), as part of our efforts to maintain best practices across our environment and we use various cybersecurity tools and processes designed to manage cybersecurity threats including network and systems authentication, network and infrastructure architecture security, endpoint security, and operating system patching. • Third-Party Network Security Assessments. We engage a third-party consultant to conduct external penetration testing at least annually. Our cybersecurity processes are adjusted as needed based on the results of these assessments. The assessment results are reported to the Audit Committee and Board, and our external auditor reviews our cybersecurity solutions and posture on at least an annual basis. • Third-Party Risk Management. We conduct information-security assessments before allowing sensitive data to be hosted by third parties. We also ensure SOC-1 or SOC-2 compliance for our third party providers, including our banking, payroll, and stock-plan administration relationships.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: When a cybersecurity incident occurs, whether detected internally or from third-party cybersecurity incidents, we evaluate the incident for criticality across a range of contributing indicators, including service availability, impact to operations, reputational impact, regulatory and legal considerations, data sensitivity and direct financial impact. The potential impact of the incident, individually or in aggregate, is evaluated by the Chief Security Officer, or CSO, continuously across these criteria. We have escalation procedures to notify members of senior and executive management, the Board (or an applicable subset) and regulators in a timely manner based on the criticality of the cybersecurity incident. S&T also has in place incident response and business continuity plans. The Incident Response Program outlines the policies, procedures and technical measures for identifying an incident, assessing its nature and scope, minimizing and containing the impact, investigating the root cause and reporting, as applicable. S&T uses data from incidents to reassess risk, evaluate and implement any additional controls deemed necessary and measure the success of the incident response team. The Incident Response Program also includes staff training, annual updates and testing. The Business Continuity Plan defines the policies, procedures and technical measures to restore systems and critical operations. S&T also maintains business continuity plans for critical systems and applications managed or hosted by third-party vendors.

companyName: S&T BANCORP INC

ticker: STBA


text: Our business is highly dependent on information technology. In the ordinary course of our business, we store sensitive data, including our proprietary business information and that of our business partners, and non-public personally identifiable information of mortgage borrowers, on our networks. The secure maintenance and transmission of this information is critical to our operations. Computer malware, viruses, ransomware and phishing attacks remain widespread and are increasingly sophisticated. We are frequently the target of attempted cyber threats. We continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. Despite these security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations or trading activities or damage to our reputation, all of which could have a material adverse effect on our business, results of operations and financial condition.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: Management's Role Managing Risk We have an internal management team comprising of our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO"), VP, Corporate Controller, Sr. Director, SEC Reporting, and Sr. Director of IT (the " Risk Management Team "), that plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Sr. Director of IT and IT team monitor cybersecurity risks and perform continual risk exercises and assessments. The Risk Management Team meets quarterly to discuss current security breaches and threats, if any, and discuss new controls and results of the cybersecurity risk monitoring, exercises, and assessments. The Risk Management Team provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and the Risk Management Team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, the Board receives updates on any significant developments in the cybersecurity domain, ensuring the Board 's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Bel employs a full-time Cybersecurity Expert who reports directly into our Global Head of IT and Cybersecurity Services. During 2024, the Company worked with third-party cybersecurity specialists to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third-party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: Risk Management and Strategy We have implemented a systematic approach to managing our cybersecurity risks and have adopted a comprehensive set of cybersecurity policies that include best practices based on recognized industry standards and guidelines. These policies provide guidance on roles and responsibilities of key stakeholders and promote awareness. These policies also cover cyber education and training as well as help us to align with applicable laws and regulations to meet our compliance requirements. The primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer (CISO) within our GIS organization, who reports to our Chief Technology Officer. The CISO is also responsible for managing the risk assessment and mitigation process. Our CISO has over 13 years of experience serving in various roles in risk management as well as enterprise and cyber security, including serving as the project lead and founder of the Open Worldwide Application Security Project (OWASP) flagship project Security Shepherd, a web and mobile application security training program, and leading IBM's ethical hacking team. He was also a principal security engineer at Axway prior to joining Synchronoss where he served as product security architect and a director of product security prior to accepting the role as our CISO. Our Chief Technology Officer has over 20 years of experience in the telecommunications industry, including serving as our Chief Architect and Senior Software Engineer, during which he oversaw our GIS program, including the governance, risk and compliance management related thereto. We also engage consultants, and other service providers, to help us implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities as well as responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Main Street and our Adviser maintain, and routinely review and evaluate their and the Company's information technology ("IT") and cybersecurity policies, practices and procedures (the "Cybersecurity Program"), which includes processes for assessing, identifying and managing material risks from cybersecurity threats. The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of Main Street's Crisis Management Plan. The Cybersecurity Program is administered by Main Street's IT Manager, who is managed on a day-to-day basis by Main Street's General Counsel and overseen by Main Street's IT Steering Committee consisting of Main Street's Chief Executive Officer, Main Street's Chief Operating Officer and Main Street's General Counsel. Main Street's General Counsel also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan, with Main Street's Chief Operating Officer and Main Street's IT Manager also included on the crisis response team. Main Street and our Adviser also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of Main Street's IT and cybersecurity systems, to recommend improvements to the Cybersecurity Program and in connection with any cybersecurity incident. Main Street's IT Manager has over 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity systems, policies and procedures. Main Street's General Counsel has served in his oversight function as General Counsel for over 16 years and previously as Main Street's Chief Compliance Officer for over 12 years, during which time he has gained expertise in assessing and managing risk applicable to the Company. Similarly, each of Main Street's Chief Executive Officer and our Main Street's Chief Operating Officer have served in various executive management roles at the Company and, in the case of our Main Street's Chief Operating Officer, other publicly traded organizations, involving extensive oversight and management of risks, including cybersecurity related risks, for over 20 years.

companyName: MSC INCOME FUND, INC.

ticker: MSIF


text: Risk Management and Strategy The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by its Audit Committee, which interacts with the Company's ERM function, the Company's Senior Vice President and Chief Information Officer ("CIO"), the Global Head of IT Security, who reports directly to the CIO, and other relevant members of management. • Collaborative Approach: We have implemented a cross-functional approach to identifying, mitigating, and managing cybersecurity risks, threats, and incidents through a broad range of controls and supporting processes. • Technical Safeguards: We deploy various technical safeguards that are designed to protect the Company's information systems and information from identified cybersecurity threats. • Incident Response and Recovery Planning: We have established, and maintain, an incident response plan that addresses the Company's planned responses to a potential or actual cybersecurity incident. This plan is periodically reviewed, tested, and evaluated. • Third-Party Risk Management: We take a risk-based approach to identifying the cybersecurity risks presented by third-party service providers and encourage our service providers to reduce cybersecurity risks using commercially available safeguards. • Education and Awareness: We provide training for our employees regarding cybersecurity threats as a means to build awareness and equip them with effective tools to identify and address cybersecurity threats, as well as to communicate the Company's evolving information security policies and practices.

companyName: GATX CORP

ticker: GATX


text: Our Board includes members with skills and experience in cybersecurity, technology, and innovation. The Board ultimately oversees cybersecurity risks and evaluates such risks as part of our ERM program. As part of our ERM processes, we utilize a formal corporate risk and governance structure that sets out the roles, responsibilities, and expectations of the various parties involved throughout our company in risk mitigation and management. The Risk Committee of the Board is responsible for approving and periodically reviewing and assessing the effectiveness of our ERM policies and procedures. The Risk Committee also assists the Board in its oversight of risks related to cybersecurity by regularly engaging with management and/or third-party consultants to assess the cyber threat landscape; evaluate our information security program; review the results of penetration testing; and analyze the design, effectiveness, and ongoing enhancement of our capabilities to monitor, prevent, and respond to cyber threats and events. The Risk Committee generally meets with management and/or third-party consultants regarding cybersecurity matters on a quarterly basis. Any material developments are reported by the Risk Committee to the Board. Further, any cybersecurity incidents deemed to have a high impact on our business are also generally reported to the Board, regardless of materiality.

companyName: Regional Management Corp.

ticker: RM


text: We believe that Oracle is a target for computer hackers, cyber threats and other bad actors because our products and services store, retrieve, process and manage large amounts of data, including sensitive data. We and our vendors are regularly subject to attempts by third parties to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures and gain unauthorized access to our or our customers', partners' and suppliers' software, hardware and cloud offerings, networks and systems. During fiscal 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, if a cyberattack or other security incident results in unauthorized access to or modification or exfiltration of our customers' or suppliers' data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we could incur significant expenses and suffer substantial damage to our brand and reputation. Refer to "Data Privacy, Cybersecurity and Intellectual Property Risks" in Risk Factors included in Item 1A within this Annual Report for additional discussion of the challenges we encounter with respect to cybersecurity risks.

companyName: ORACLE CORP

ticker: ORCL


text: To mitigate identified cyber-related risks to our organization, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes that includes: • Security Controls: We have implemented industry-standard security controls aligned with the NIST CSF framework such as identity and access control, multi-factor authentication, encryption, and data protection measures. • Security Awareness: We conduct regular cybersecurity awareness training to educate employees about potential threats and best practices for safeguarding company assets and data. In addition, we conduct periodic phishing tests to enhance our security awareness program. • Third-Party Oversight: We evaluate third-party partners' cybersecurity practices through due diligence assessments and contractual obligations. Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. • Continuous Monitoring: We have partnered with a third-party Managed Security Services Provider to provide event logging, monitoring for detection of cybersecurity events, and assistance with investigations into possible cyber-related events, as well as assessment and consultation on security enhancements. • Business Resiliency: We have developed emergency response, business continuity, and disaster recovery plans to respond to a widespread disruption to business operations. • Continuous Improvement: Any previous cybersecurity incidents, whether material or not, have resulted in improvements in the company's cybersecurity program, policies, or technical controls, where applicable.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: Cybersecurity Governance As described above, we have engaged a third-party IT and cybersecurity firm to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Members of this dedicated third-party IT and cybersecurity team include a virtual chief information security officer (vCISO) who is responsible for the overall development and implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer, and director of information security. Our management, including our Chief Executive Officer, oversees the work of our third-party IT and cybersecurity team and regularly communicates with members of the team. Through the policies and controls described above, including our incident response policy, representatives of the third-party IT and cybersecurity team as well as members of our management, including our Chief Executive Officer, are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents. The representatives of our third-party IT and cybersecurity team who lead our cybersecurity risk management and risk assessment process have collectively over 30 years of prior work experience in various roles managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans. The members of the cybersecurity team hold degrees in computer engineering and cybersecurity as well as advanced cybersecurity certifications, including a Certified Information Systems Security Professional (CISSP) certification, a Certified Information Systems Auditor (CISA) credential and a Certified Information Security Manager (CISM) certification. Other members of our third-party cybersecurity team have also obtained various professional certifications and advanced training in the areas of information security and cybersecurity.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements, including those established by the Federal Reserve, FDIC, RI Division of Banking and Connecticut Department of Banking. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: The Company relies on technology infrastructure and information systems, including the Internet and cloud services, to process, transmit and store electronic and financial information, manage a variety of business processes and activities, and comply with regulatory, legal and tax requirements. The Company also depends on its information technology infrastructure to capture knowledge of its business including its vessel operation systems, which contain information about vessel positioning and scheduling; monitor its vessel maintenance and engine systems; coordinate its business across its bases of operation including cargo delivery and equipment tracking; and communicate within its organization and with customers, suppliers, partners and other third parties. The Company's ability to service customers and operate vessels is dependent on the continued operation of these systems. While the Company takes various precautions and has enhanced controls around its systems, like other technology systems, they are susceptible to damage, disruptions or shutdowns, hardware or software failures, power outages, computer viruses, telecommunication failures, user errors, catastrophic events, or cyber-attacks including malware, other malicious software, phishing email attacks, attempts to gain unauthorized access to its data, the unauthorized release, corruption or loss of its data, loss or damage to its data delivery systems, ransomware, and other electronic security breaches. Over time, these attacks have become increasingly sophisticated and, in some cases, have been conducted or sponsored by "nation state" operators. The Company expects that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. Many threat actors are well funded.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes using the cybersecurity risk framework published by the National Institute of Standards and Technology ("NIST") designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President, Operations and our Vice President, Information Technology ("IT"), and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Specific measures include regular penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments. We conduct due diligence on and audits of key technology vendors, contract research organizations (CROs), and other third-party contractors and suppliers. Additionally, we conduct periodic employee training that covers cyber and information security, among other topics. We also regularly consult with outside advisors and experts. Their assistance helps us assess, identify, and manage cybersecurity risks, anticipate future threats and trends, and understand their potential impact on our risk environment.

companyName: Spyre Therapeutics, Inc.

ticker: SYRE


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Escalation: We have implemented a cross-functional approach to assessing, identifying and managing cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits. • Incident Response and Recovery Planning: We have established and maintain an incident response plan and a business continuity and disaster recovery plan designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: Zymeworks Inc.

ticker: ZYME


text: Management's Role in Managing Risk. As noted above, we have a designated Chief Information Officer who is charged with implementing and overseeing our comprehensive written Information Security Program. With over 25 years of experience in the field of information technology and cybersecurity, our Chief Information Officer brings a wealth of expertise to his role and maintains both Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA) certifications and additional personnel on our information security team have cybersecurity experience and certifications. Our Chief Information Officer's background includes extensive experience as an enterprise chief information officer and is well-recognized within our industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Chief Information Officer reviews with senior management, at least quarterly, the status of our Information Security Program, identified threats to our data security, and cyber incidents relevant to our operations and reviews these matters with our Board and/or Audit Committee at least annually, or more frequently when appropriate. Further, at least quarterly, our senior leadership team, including our Chief Financial Officer, General Counsel, Chief Information Officer, Executive Vice President of Financial Services, and Global Risk Management, prepares a comprehensive summary of certain key risks facing the Company (the "Risk Report"). The Risk Report includes feedback from multiple constituencies within the Company, incorporating and evaluating heightened risk areas identified by senior management, functional area teams within the organization, and management at the regional and local dealership levels. In addition to various enterprise-wide risks identified throughout this management-led process, the Risk Report highlights cybersecurity risks, tasking the Chief Information Officer or his designees with the responsibility to monitor such risks and, as appropriate, implement risk mitigation strategies. The Risk Report also clarifies that both the Board and the Audit Committee retain oversight of such risks. The Risk Report is shared and discussed at least quarterly with the Audit Committee and periodically, with the full Board, with certain specified risks and mitigation efforts reported to the Board or designated standing committees on a more frequent basis, as appropriate.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: The threats to network and data security are increasingly diverse and sophisticated. Despite our efforts and processes to prevent breaches, our devices, as well as our servers, computer systems, and those of third parties that we use in our operations are vulnerable to cybersecurity risks, including cyber-attacks such as viruses and worms, phishing attacks, denial-of-service attacks, physical or electronic break-ins, employee theft or misuse, and similar disruptions from unauthorized tampering with our servers and computer systems or those of third parties that we use in our operations, which could lead to interruptions, delays, loss of critical data, unauthorized access to user data, and loss of consumer confidence. In addition, we may be the target of email scams that attempt to acquire personal information or company assets. Despite our efforts to create security barriers to such threats, we may not be able to entirely mitigate these risks. Any cyber-attack that attempts to obtain our or our users' data and assets, disrupt our service, or otherwise access our systems, or those of third parties we use, if successful, could adversely affect our business, operating results, and financial condition, be expensive to remedy, and damage our reputation. In addition, any such breaches may result in negative publicity, adversely affect our brand, decrease demand for our products and services, and adversely affect our operating results and financial condition.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: • Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks using the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Framework as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan. • Insurance. We maintain an information security risk insurance policy. • Enterprise Risk Assessment. The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants. The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis. • Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications. • Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring: Our approach to cybersecurity involves multiple layers of defense, incorporating detection capabilities, analytics, and real-time monitoring. We utilize data insights to identify potential anomalies, monitor evolving threats, and identify emerging risks. Safeguards are regularly evaluated and refined based on vulnerability assessments, threat intelligence, and insights gained from monitoring activities. • Information Sharing and Collaboration: We share and receive threat intelligence with industry peers, government agencies, Information Sharing and Analysis Centers ("ISACs"), trade organizations, and cybersecurity forums. These collaborations provide a means for information exchange to improve threat detection and vulnerability mitigation. • Third-Party Risk Assessments: We engage independent firms to assist with multiple phases of our cybersecurity program. This work includes testing, audits, and consulting to validate and strengthen our cybersecurity posture, and the design and operational effectiveness of our controls. • Companywide Policies and Procedures: Our companywide cybersecurity policies and procedures cover areas such as encryption standards, endpoint security, remote access protocols, multi-factor authentication, and data protection. These policies undergo regular review to address the latest security standards and operational requirements, and to consider best practices and industry trends. • Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in simulated phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform tabletops and other exercises with management and incorporate external resources and advisors as needed. Our cybersecurity team collaborates with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. • Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company's engagement with such provider(s).

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. Any such communications are then subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. We also implement robust network security protections and enterprise hardware for firewalls to safeguard our infrastructure against unauthorized access and cyber threats. Our strategy for 2025 includes leveraging AI and machine learning for enhanced threat detection and response, adopting a Zero Trust architecture, and using quantum-resistant encryption methods for data protection. We also focus on ransomware defense, regular backup and recovery processes, and continuous employee training and awareness programs. Additionally, we ensure compliance with the latest regulations, participate in threat intelligence sharing, and explore emerging technologies like post-quantum cryptography and blockchain security. If our applications fail or our software does not successfully block malicious electronic communications, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance", our board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including our cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and AHL's CISO, with support from the broader Technology team, are responsible for information security strategy, policies and practices. • Collaborative Approach. The Company utilizes a cross-functional approach involving stakeholders across multiple departments, including Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to help mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Apollo Global Management, Inc.

ticker: APO


text: Our information technology systems are equipped to detect directed and non-directed attacks such as viruses and malware that can lead to interruptions and delays in the sale and service of our Delivery Systems and Consumables, general business operations, as well as loss, misuse of data, or theft of intellectual property, confidential information, and personal information (of third parties, employees, providers, and end consumers). However, as of the date of this report, these incidents have not had a material impact on our systems or business operations. Any significant disruption to our business operations or access to our systems could lead to a decline in operational effectiveness, result in a loss of our providers, and adversely affect our business and results of operation. In addition, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. For more information about the cybersecurity risks that we face, see the risk factor entitled, "We are increasingly dependent on information technology, and if we are unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K.

companyName: Beauty Health Co

ticker: SKIN


text: The Company uses an Agility Preparedness Plan ("Agility Plan"), along with incident response policies, to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Company and with our Board of Directors, notify law enforcement, regulatory bodies, and other government agencies, and notify customers and employees. The Agility Plan provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team ("CMT"). The CMT facilitates coordination across key stakeholders of the Company. The Company's CIO and key members of management are members of the CMT. The Company provides the CIO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Company's data for the benefit of our customers, employees and shareholders. We regularly engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Company's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives. The CIO and other members of the information technology team receive ongoing training related to developing threats, proactive solutions and industry best practices in order to effectively protect the Company and its stakeholders.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: • Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In the event that the Company experiences a cybersecurity incident it will take steps to contain, assess and remediate the incident. • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Our Cybersecurity Team Our management is responsible for assessing, managing and mitigating all risks relative to our business, including material risks from cybersecurity threats. Within our management team, assessment, management, and mitigation of cybersecurity threats is primarily overseen by our technology group, which has extensive experience in cybersecurity, technology, and digital grid operations. Our technology group is led by Joel Austin, our senior vice president and chief digital officer, and Malia Hodges, our senior vice president and chief information officer. Mr. Austin has over 35 years of technology operations, utility industry, and leadership experience, including more than 16 years of cybersecurity oversight experience. Ms. Hodges has 26 years of technology operations, utility industry, and leadership experience, including seven years as our chief information officer, with responsibility in that role for management of Oncor's technology function, including cybersecurity. Both Mr. Austin and Ms. Hodges are long-time members of the Edison Electric Institute security and technology policy committee, which focuses on working with federal agencies on cybersecurity risks relevant to the electric industry. Mr. Austin has testified on cybersecurity issues facing the State of Texas and the electric utility industry in front of multiple Texas legislative sub-committees and been asked to discuss cybersecurity risks with members of the U.S. Congress. Mr. Austin and Ms. Hodges also work closely and regularly with PUCT staff and PUCT commissioners on cybersecurity risks and mitigations. We also have a designated chief information security officer who has over 43 years of experience in cybersecurity, a master's degree in cybersecurity and a doctorate degree in cybersecurity/information assurance. Within our technology group, we maintain a dedicated cybersecurity group and 24/7/365 team that responds to and protects against cybersecurity risks. Our collective cybersecurity staff consists of a group of employees and contractors located inside and outside the state of Texas with a wide range of specialized skills and experience, including through service in the U.S. military and federal agencies, cybersecurity-related certifications, membership and advisory and board positions with industry groups and non-profit organizations focused on cybersecurity, and training in the cyber defense tools and methods we deploy, as well as various higher education degrees related to cybersecurity.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Our cybersecurity risk management includes enterprise-wide monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on our services, systems, resources, or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Our cybersecurity monitoring and identification efforts include the use of a third- party managed detect and response security service to monitor and take action as necessary, with the response ranging from automated processes to immediately block and remove undesired risks to cybersecurity team review and action, depending on the nature and severity of the risk. We have a Cybersecurity Incident Response Plan which provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, and includes activating crisis, or business continuity recovery plans, as appropriate. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: Cybersecurity processes have been integrated into the Company's broader framework of risk management. The Company's Board of Directors exercises oversight of cybersecurity risks. T he Board of Directors entrusts the Audit Committee with responsibility for regularly reviewing and assessing cybersecurity risks to ensure a proactive approach to safeguarding the Company's digital assets. The Audit Committee's primary role is to provide an independent and objective assessment of the Company's cybersecurity risk management practices to confirm that they are both effective and aligned with the Company's strategic objectives. The Audit Committee also reports its findings and recommendations to the Board of Directors, helping the Board of Directors to make informed decisions regarding cybersecurity strategy, investments, and risk. Notwithstanding the Company's efforts, the Company is aware that preventative measures cannot prevent all cybersecurity incidents. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."

companyName: SAUL CENTERS, INC.

ticker: BFS


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees and applicable contractors undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess the effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage though it may not be sufficient to cover all costs of a cybersecurity incident.

companyName: Guardant Health, Inc.

ticker: GH


text: CSC's Board of Directors oversees management's processes for risk management, and the Risk Committee of the Board of Directors assists the Board in fulfilling its oversight responsibilities with respect to managing risks, including cybersecurity risks. Integrated within the Company's overall enterprise risk management program, Schwab has an established information security program that knits together complementary tools, controls, and technologies to protect systems, client accounts and data. We continuously monitor the systems and work collaboratively with government agencies, law enforcement, and other financial institutions to address potential threats. We deploy advanced monitoring systems to identify suspicious activity and deter unauthorized access by internal or external actors. We also maintain policies, standards, and procedures, which apply to employees, contractors, and third parties, regarding the standard of care expected with all data, whether the data is internal company information, employee information, or non-public client information. This includes limiting the number of employees who have access to clients' personal information and internal authentication measures enforced to protect against the unauthorized use of employee credentials. All employees who handle sensitive information are trained in privacy and security. Schwab also engages with external firms specializing in discrete areas of cybersecurity to assess the Company's practices, vulnerabilities, and overall cyber risk posture.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: We are cognizant of the evolving risks associated with cybersecurity and recognize a material cybersecurity incident could adversely impact our financial results and condition. We further recognize the importance of maintaining processes to identify, mitigate, and manage those cybersecurity threats. No cybersecurity threats occurred during the year ended December 31, 2024 that have had, or are reasonably likely to have had, a material impact on our business strategy, results of operations, or financial condition. However, if as a result of any future attacks, our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate our business, and our business strategy, results of operations or financial condition could be adversely affected. Such attacks, whether or not successful, could result in significant costs related to, for example, repairing or replacing our IT systems; the loss of critical data; and interruptions or delays in our ability to perform critical functions. In addition, the volume, frequency and sophistication of these threats (including through the use of artificial intelligence) continues to grow and the complexity and scale of the systems to be protected continues to increase.

companyName: FreightCar America, Inc.

ticker: RAIL


text: We are occasionally subject to cybersecurity incidents and we use our IRP to respond to such incidents. Our systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations. We also occasionally experience the misuse or unauthorized disclosure of personal information, other data, confidential information or intellectual property. We occasionally experience account take overs by bad actors using the credentials of customers acquired from the dark web unrelated to any breaches in our systems. These incidents have not had a material impact on us to date, including our business strategy, financial condition, or results of operations. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, financial condition, or results of operations. For more information about the cybersecurity risks we face, see the risk factor titled "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or to otherwise protect our confidential information, could damage our reputation and brand and harm our business, financial condition, and results of operations" under Item 1A "Risk Factors" of this Annual Report on Form 10-K.

companyName: Chewy, Inc.

ticker: CHWY


text: Under the leadership of the Company's Chief Technology Officer, the Company's information technology department is primarily responsible for assessing and managing material risks to the Company's information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the Company's information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the Company's information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.

companyName: SITE Centers Corp.

ticker: SITC


text: Cohen & Steers has implemented and maintained various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to Information Systems and Data, including, but not limited to: • technical and physical safeguards: (i) systems monitoring, including anti-virus/anti-malware software for workstations and servers, reports about correlated events detected from server log reviews, desktop forensics software and suspicious firewall traffic, firewall logs and alerts from users about blocked websites, systems monitoring of Cohen & Steers' websites, network monitoring software alerts and scheduled internal and external vulnerability scans; (ii) Cohen & Steers' asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Cohen & Steers' personnel and from third parties regarding issues and signs of potential incidents; and (vi) access controls and network security controls; and • organizational safeguards: (i) incident response plans that address Cohen & Steers' response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing Cohen & Steers' cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of Cohen & Steers' policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, such as audits, tabletop exercises, threat modeling and vulnerability testing; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has more than 14 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: We have a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure you that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.

companyName: CoreCivic, Inc.

ticker: CXW


text: Effective management of risks related to the confidentiality, integrity, and availability of information is crucial in an environment of increasing cybersecurity threats and requires a structured approach to establish and communicate expectations and required practices. Northern Trust's cybersecurity and technology risk management program provides the overall structure for identifying, assessing and managing the respective risks in a sustainable manner supported by an organizational structure that reflects support from executive management and includes risk committees comprised of members from across the business. The program is supported by the Cyber and Technology Risk Management Policy approved by the Business Risk Committee. The Cyber and Technology Risk Management Policy and Framework are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Cyber Risk Institute (CRI) Profile and provide a comprehensive overview of cybersecurity and technology risk management governance activities pertaining to the confidentiality of information, integrity of systems, data and processes, and the availability of business functions that may be adversely impacted. These governance processes, internal controls, and risk management practices, which are part of our enterprise risk management program and processes, are designed to keep risk at levels appropriate to Northern Trust's overall cyber risk appetite and the inherent risk in the markets in which Northern Trust operates. Northern Trust employees are responsible for promoting cybersecurity best practices as well as adhering to applicable policies and standards to safeguard data and business systems. In cases where Northern Trust relies on third-party vendors to perform services, controls are routinely reviewed for alignment with industry standards and their ability to protect information in accordance with Northern Trust's Third-Party Risk Management Program.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: The Trust does not have computer systems or networks. Pursuant to the terms of the Trust Agreement, the Trust's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on the Trust, USCI and CPER. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. The risk assessment aims to confirm that USCF's policies are being followed and enforced, and to identify risks that may have otherwise been unknown. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and the Trust.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: Management is actively involved in assessing and managing material risks from cybersecurity threats. The following processes are in place: • Responsible Positions/Committees: The Chief Transformation Officer, Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks. The individuals in these roles possess extensive expertise in cybersecurity. Specifically, the Chief Transformation Officer has over 30 years of experience in extensive technology and executive leadership experience across diverse industries, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private. • Monitoring and Response Processes: We have established processes to inform and monitor cybersecurity incidents for prevention, detection, and resolution using a 24/7 third-party SOC Managed Service. The SOC is responsible for providing alerts, updates, and remediation services as needed by monitoring all technology assets for potential signs of compromise and conducting threat hunt exercises. • Reporting to the Board: Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee. This reporting includes updates on the Company's cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: Security risks to both the Company and its customers' data and information are continuously evaluated and monitored. We actively monitor security 24 hours a day and seven days a week through our global Security Operations Center. We have implemented a multi-layered defense-in-depth approach using technologies that meet or exceed industry standards. Additionally, we expect our vendors to adhere to our data privacy and security standards and we evaluate their ability to comply as part of our vendor assessment process. This includes assessing internal and external threats to the security, confidentiality, integrity, and availability of Embecta and third party provider data and systems, as well as other risks to our operations. Embecta utilizes the ISO 27001 and 42001 frameworks, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness against emerging risks including AI. As part of our risk management process, we engage external providers to conduct periodic internal and external penetration testing and security assessments. Additionally, under our third-party risk management program, we assess vendor cybersecurity risks, including those associated with our cloud vendors and other third-parties. We maintain security and privacy policies and procedures that align with industry-standard control frameworks and comply with applicable regulatory requirements, laws, and standards. Enterprise cybersecurity policies undergo an annual review and approval by our Information Security Risk Committee ("ISRC").

companyName: Embecta Corp.

ticker: EMBC


text: Risk Management and Strategy Cyberattacks, computer malware, viruses, social engineering (including phishing and ransomware attacks), and general hacking are becoming more prevalent and more sophisticated in our industry. To mitigate the adverse impact of these threats to our business, we take a comprehensive approach to cybersecurity risk management and make proactively securing our systems and the data customers, employees, partners, and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. See "Risk Factors — Risks Related to Our Intellectual Property and IT Systems" for a more comprehensive description of cybersecurity-related risks. We have devoted significant financial and personnel resources to implement and maintain security measures to mitigate these risks and meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. While in the last fiscal year, we did not identify a cybersecurity threat or incident that resulted in a material adverse impact to our business, results of operations, or financial condition, there can be no guarantee that we will not experience or have not experienced such an incident.

companyName: Jamf Holding Corp.

ticker: JAMF