text: Our Board of Directors plays a significant role in overseeing our cybersecurity risk management efforts. The Board receives periodic updates from the Chief Information Officer ("CIO") on our cybersecurity posture, encompassing reports on potential threats, vulnerabilities, and the efficacy of our risk mitigation measures. These updates are provided based on internal reports from the tools employed and managed by the IT organization and reports generated by a managed security service provider overseen by the Chief Information Security Officer ("CISO"). The Board is committed to ensuring that cybersecurity is a priority for the organization, providing the necessary resources and expertise to address evolving threats effectively.


text: Our management team is actively involved in the assessment and management of cybersecurity risks. We have a CIO overseeing the Company's technology infrastructure and a designated a CISO responsible for cybersecurity program oversight. The CISO possesses over two decades of comprehensive experience in the information technology landscape, augmented by a robust background in program management. With a portfolio enriched by industry certifications and advanced academic degrees, including an MBA, the CISO stands as a seasoned leader within our corporate information security domain. The CISO collaborates with cross-functional teams to implement and uphold our cybersecurity policies and practices. Our executive leadership team is aligned with our cybersecurity objectives and regularly reviews our cybersecurity-related initiatives.

companyName: URBAN ONE, INC.

ticker: UONE

secItem: Item 1C


text: To aide in identifying and assessing material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring and vulnerability assessments to inform our professionals' risk identification and assessment.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: We manage these known risks by using internal security controls designed to align with standards set the International Organization for Standardization ("ISO"). In connection with the identification, assessment and management of material risks and cybersecurity threats, we also conduct the following activities at various intervals during the year: monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply with such laws; undertake regular reviews of our customer facing policies and statements related to cybersecurity;


text: run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team;


text: conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations; and carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident.


text: We regularly engage with auditors to review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: In our risk factors, we describe how potential risks from cybersecurity threats may affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. Board members, including members of the Audit Committee, have expertise and/or operational experience in cybersecurity matters. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives quarterly cybersecurity updates from members of management. These updates include topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks, if any.


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: We face various cybersecurity threats, including denial-of-service attacks, ransomware, phishing, and advanced persistent threats. In addition, as an aerospace and defense company that provides sophisticated defense products and services to the U.S. and foreign governments, we are also subject to cybersecurity risks from organized adversaries, including groups affiliated with various nation states. Our customers, suppliers, subcontractors and vendors also face similar threats. Cybersecurity incidents impacting us or any of these third parties could have a material adverse effect on our operations, financial condition and results of operations. Given the cybersecurity risks we face, we believe it is imperative that we dedicate ample resources to addressing and mitigating our cyber risks.

companyName: AeroVironment Inc

ticker: AVAV


text: Risk Management and Strategy Our cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber risks from the cyber threats we face. Our cybersecurity program is part of our internal risk management processes. We continually improve and revise our cybersecurity practices as new threats and vulnerabilities emerge.


text: Our Chief Information Security Officer ("CISO") and our Director of Global Cybersecurity ("Cybersecurity Director") lead our Detection and Response Team ("DART"), which is responsible for our cybersecurity incident response processes pursuant to our Incident Response Plan and playbooks. The DART consists of members of our IT department responsible for protecting against, detecting, containing, mitigating, and recovering from cybersecurity incidents. The DART evaluates and assigns severity levels to cybersecurity incidents, and based on the severity, escalates and engages incident response teams based on severity, and responds to and mitigates the related risks.


text: Our cybersecurity team proactively hunts for cyber threats and vulnerabilities in our networks and information systems as part of our cyber risk management program, including by monitoring our networks and systems for intrusions and other suspicious activity. The cybersecurity team stays apprised of existing and emerging cybersecurity threats, including by partnering with third parties, such as the U.S. government, law enforcement agencies, customers, and other defense industry participants to share and receive information on emerging threats and expanding our cybersecurity knowledge and global monitoring practices. We also engage third parties to conduct evaluations of our cybersecurity controls, such as penetration testing and controlled cybersecurity framework audits. We also review the cybersecurity practices of our third-party service providers.


text: We have aligned our cybersecurity program to the National Institute of Standards and Technology's ("NIST") published cybersecurity standards and our policies and processes are compliant with NIST Special Publication 800-171 and other applicable publications. Given our status as a defense contractor, we are subject to numerous regulations, including those pursuant to the Defense Federal Acquisition Regulation Supplement, ("DFARS") requiring us to have controls in place to protect U.S. Government controlled unclassified information ("CUI") and to report cybersecurity incidents to the DoD. We will also be subject to the DoD Cybersecurity Maturity Model Certification ("CMMC") requirements, which will require companies like AeroVironment that do business with the DoD to obtain specific third-party certifications relating to specified cybersecurity standards to be eligible for new contract awards. We are in the process of preparing for the CMMC requirements. While we believe we are in a good position to meet the requirements of CMMC, if we fail to achieve certification in advance of contract awards, or we fail to achieve certification at the level required for a particular contract award, we will be unable to bid on such contract awards or follow-on awards for existing work with the DoD, which could adversely impact our results of operations. Additionally, our subcontractors, and certain of our vendors, may also need to comply with CMMC requirements and, potentially obtain CMMC certification. We may be negatively impacted if our subcontractors or vendors are not compliant with CMMC requirements.


text: We require our employees to take cybersecurity-related training regularly that promotes awareness of how to detect, report, and respond to cybersecurity threats. Employees with certain roles and responsibilities are also assigned cyber training for their specific functions. We also maintain an Insider Threat program, headed by our Director of Security, to identify, assess and deal with potential risks from within our company, including cyber risks.


text: Our CISO and our Cybersecurity Director are responsible for the day-to-day management of our cybersecurity program and cybersecurity risks. Our CISO, who has approximately 24 years in various information technology and cybersecurity roles, and our Cybersecurity Director, who has approximately 20 years of experience in various cybersecurity roles, are primarily responsible for our overall cybersecurity risk management program and supervise both internal and external resources to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and incidents.


text: Our Cybersecurity Director leads our internal Cybersecurity Council, which meets monthly to help implement management's cybersecurity strategy and to monitor and manage our cybersecurity threats and risks. Our Cybersecurity Council consists of the Cybersecurity Director, CISO, Chief Financial Officer, General Counsel and Chief Compliance Officer, Chief Technology Officer, Vice President of Internal Audit, Vice President of Global Supply Chain, Director of Security, and Sr. Manager of Contracts Operations and Compliance. The CISO and/or Cybersecurity Director report cybersecurity incidents to members of the company's senior management, including the Cybersecurity Council, and/or the Board of Directors based on the severity and type of the incident to ensure that proper external reporting is completed thoroughly and timely. Pursuant to its charter, the Cybersecurity Committee of our board of directors is responsible for reviewing, discussing, and making recommendations to the full board of directors regarding cybersecurity matters. Our CISO and Cybersecurity Director provide presentations to the Cybersecurity Committee on our cybersecurity program at each of the committee's regularly scheduled quarterly meetings. These briefings include assessments of the cyber risk and threats landscape, updates on incidents, policies and procedures, and our investments and plans in cybersecurity risk mitigation and governance. The Cybersecurity Committee also meets with members of the Cybersecurity Council to discuss various aspects of our cybersecurity program in between regular meetings. All members of the board of directors are invited to attend all meetings of the Cybersecurity Committee and the committee regularly briefs the entire board of directors regarding their oversight of our cybersecurity program.


text: Cybersecurity Threats We have experienced cybersecurity incidents in the past and will experience cybersecurity incidents in the future. Prior cybersecurity incidents have not materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition, however, there is no guarantee that a future cybersecurity incident would not have a material adverse effect on such items. While we believe our cybersecurity program is designed to mitigate cybersecurity risks, we cannot eliminate all risks from cybersecurity threats. See Item 1A. Risk Factors for more information on our cybersecurity risks.


text: Risk Management and Strategy Assessing, Identifying and Managing Material Risks Our cybersecurity program is focused on assessing, identifying, and managing risks arising out of our use of information technology including the risk of cybersecurity incidents and threats. Our program is informed by recognized frameworks (such as the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework) and leverages external and internal expertise. Our program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, regular awareness exercises, and employee outreach activities including cybersecurity tech talks, on-site digital signage, intranet resources, CEO cybersecurity champion recognition at quarterly town hall meetings, and other targeted communications. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our internal cybersecurity team.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Integration with Enterprise Risk Management The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with our Senior Vice President & Chief Information Officer serving on our ERM Committee and our Vice President of ERM serving as the strategic crisis management coordinator under our cybersecurity incident response plan. We have developed processes for managing cybersecurity incidents including clear allocation of responsibilities and defined incident classifications, escalation requirements based on materiality, and prioritization parameters. Our cybersecurity incident response plan is integrated into our ERM Committee risk mitigation action plan process, our Senior Leadership Team (SLT) strategic crisis management action plan process, and our Disclosure Committee protocol for cybersecurity incidents. We also maintain business continuity and disaster recovery plans to prepare for potential information technology disruptions.


text: Cybersecurity Program Components Our cybersecurity program structure consists of our cybersecurity operations center; identity and access management; governance, risk, and compliance; architecture; and operational technology. Aspects of our program include:


text: Activities to assess vulnerabilities including penetration testing, red teaming, tabletop exercises, and phishing and social engineering drills Engagement with law enforcement and U.S. government agencies, directly and through memberships in various cybersecurity intelligence and risk sharing organizations to help us stay informed about evolving threats Utilization of third-party experts to test, validate, and strengthen our plans, practices, and policies Technology team collaboration sessions to share information across different teams, geographic areas, and areas of responsibilities Assessing and managing cybersecurity risks arising out of the use of third-party technology and services, including pre-contract diligence, imposition of contractual obligations, and performance monitoring Learnings from these activities are used to inform our training, guide our incident response preparedness and enhance our plans and processes. We have also participated in discussions with third-party service providers who have experienced cybersecurity incidents to inform our cybersecurity program.


text: Investment in Cybersecurity Program The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in terms of investing in our employees through talent recruitment, retention, training and development, investing in external resources including procuring and deploying the correct tools to monitor, evaluate, and address threats, investing employee resources to maintain effective processes, and investing in strategic relationships to monitor evolving risks including third-party service provider vulnerabilities. While our third-party services providers have experienced cybersecurity incidents and we have experienced threats to our data and systems, to date, we are not aware that we have experienced a breach that had a material impact on our operations or business, however, cybersecurity risks that may materially impact the Company are discussed in more detail in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity and Information Technology Risks," which should be read in conjunction with the foregoing information.


text: Our management is responsible for identifying, assessing, and managing our exposure to cybersecurity risk. Management identifies and assesses risks through its cross functional ERM committee that is responsible for: Facilitating risk conversations with cross-functional leaders and teams


text: Partnering with risk owners to develop risk management action plans focused on mitigating the drivers of the enterprise risks Identifying key metrics to objectively assess the risk to the Company applying both a short-term and long-term perspective Informing our strategic planning based on risks assessments after consideration of action plans and residual risk Developing a risk-aware culture throughout the organization Our Board of Directors and its Audit / Finance Committee play an active part in overseeing cybersecurity risks relevant to the Company. The Board and its Audit / Finance Committee routinely receive reports from our management and external advisors on critical risk areas.


text: The Company maintains a dedicated internal cybersecurity team that is supported by internal and external software, third-party experts, and threat intelligence resources. Members of our cybersecurity team provide cybersecurity reports to our Board, SLT, and cross-functional leaders and teams. The internal cybersecurity team is responsible for implementing our cybersecurity strategy including policies, standards, architecture, and processes including our processes for identifying cybersecurity risks and threats and recommending mitigating actions to strengthen cybersecurity resilience. In addition, our internal cybersecurity team is responsible for managing detection, mitigation, and remediation of all cybersecurity incidents.


text: Conagra's Cybersecurity Team is led by our Chief Information Security Officer (CISO). Our CISO, a certified information security professional, has over 25 years of cybersecurity leadership experience across multiple industries and holds a Doctor of Science (DSc) degree in Cybersecurity. The CISO reports to our Chief Information Officer (CIO), who has been with Conagra for more than 20 years serving in various leadership roles in information technology, finance, and business services. We believe our CIO possesses a firm understanding of the Company's cybersecurity landscape, risks, and knowledge of the capabilities of our cybersecurity and information systems personnel.


text: Additionally, members of our internal cybersecurity team have experience in cybersecurity risk management, threat monitoring, threat emulation, penetration testing, cyber incident response management, and data protection. Team members have both individual responsibilities and a team focus, and manage both internal and third-party cybersecurity risk mitigation, covering areas such as network, endpoint device, and e-mail security as well as operations and threat management, monitoring, and response. Our CISO, CIO and CFO are responsible for determining that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the SLT and Board of Directors.


text: Our cybersecurity incident response plan provides that our ERM, strategic crises management coordinator is informed about significant cybersecurity incidents for escalation to our internal Incident Disclosure Committee, SLT, and Board, as appropriate in accordance with our strategic crisis management action plan. Our cybersecurity incident response team is responsible for maintaining our cybersecurity incident response plan, which is periodically tested through our tabletop exercises. We have involved outside experts, our strategic crises management coordinator, members of our SLT, and members of our Incident Disclosure Committee in our tabletop exercises and preparedness drills to strengthen these response plans.


text: Additionally, our Corporate Cybersecurity Steering Committee, chaired by the CISO and whose members include our Senior Vice President, Corporate Controller (our principal accounting officer), as well as other members of the information technology, finance, supply chain, security and facilities, research and development, product, human resources, and legal teams, meets regularly to provide a forum for senior leaders and key stakeholders to strengthen their understanding and strategize on managing cybersecurity challenges at the Company.


text: Board of Directors and its Audit/Finance Committee Our Board and its Audit/Finance Committee exercises oversight over our enterprise risk management including our cybersecurity program. The Audit/Finance Committee receives updates from our CIO or CISO at each of its regularly scheduled meetings regarding matters related to information technology and cybersecurity including the state of the Company's cybersecurity programs, emerging cybersecurity developments and threats, and the Company's strategy to mitigate cybersecurity risks. Additionally, our full Board receives reports on our cybersecurity program at least annually which includes a review of our cybersecurity incident response plans which are described above.


text: Cyber Risk Management Strategy Adtalem recognizes the importance of safeguarding sensitive information pertaining to our students, employees, institutions, and operations. Our Cyber Risk Management Framework is designed to fortify our defenses against potential cyber threats and to protect the integrity, confidentiality, and availability of critical data.

companyName: Covista Inc.

ticker: CVSA


text: Program Highlights Our program is anchored by our Enterprise Information Security Framework ("EISF"), which adheres to the guidelines set forth by the National Institute of Standards and Technology ("NIST") 800-53 Framework. To enhance comprehensiveness, our policies also harmonize with other leading frameworks such as the ISO 27001 Standard, Family Educational Rights and Privacy Act of 1974 ("FERPA"), Payment Card Industry Data Security Standard ("PCI DSS"), Gramm-Leach-Bliley Act ("GLBA"), California Consumer Privacy Act ("CCPA"), General Data Protection Regulation ("GDPR"), and other pertinent local, state, national, and international regulations governing data privacy and information security.


text: Our Chief Information Security Officer ("CISO") manages Adtalem's enterprise-wide cybersecurity program and reports to Adtalem's Chief Financial Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Adtalem since 2018. The CISO has over twenty years of information technology and cybersecurity experience, including executive leadership roles at Fortune 500 organizations within regulated sectors including financial services and healthcare. The CISO leads a team of experienced subject matter experts with focus on strategy formulation, architecture design, incident response, colleague training, risk management, and governance functions. This team includes diverse industry backgrounds spanning Financial Services, Healthcare, and Government.


text: The CISO team is supported by a Security Operations team reporting into the Information Technology ("IT") function. This IT team provides engineering and technical expertise. The team is further supported by a 24x7 Security Operations Center ("SOC"). Adtalem has a Cyber Incident Response Plan ("Response Plan") that delineates the requirements of notification, classification, analysis, and communication of cybersecurity incidents based on the identified severity level. The Response Plan includes initial steps to convene a response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and possible disclosure requirements, and consider involving law enforcement. The Response Plan also provides for a lessons learned review to identify improvements that could be made. Adtalem's Legal and Compliance teams also provide incident response support to the CISO and manage cybersecurity-related legal and compliance issues. Processes are in place to escalate cybersecurity incidents promptly so that decisions regarding public disclosure and regulatory reporting can be made by management in a timely manner.


text: An integral component of Adtalem's Response Plan is our Privacy Incident Response Plan (the "Privacy Response Plan") which addresses privacy of our students' records, including under the Family Education Rights and Privacy Act of 1974. The Privacy Response Plan requires annual training for our employees on how to recognize and report potential privacy incidents.


text: We regularly conduct Cyber Incident Response Plan (the "Incident Response Plan") tabletop exercises, including simulations of malware and ransomware attacks. Our IT environment and cybersecurity-related controls are reviewed by our internal audit function and external third parties. We sponsor third-party assessments, including cyber risk reviews and penetration testing, to evaluate our cybersecurity program independently.


text: Adtalem subjects its systems to penetration testing to identify potential exposures, ensuring that our infrastructure maintains an acceptable level of cyber risk. In addition, Adtalem leverages third-party experts to enhance its cybersecurity program and Incident Response Plan. Our organization has not identified or discovered any cybersecurity threats over the past three fiscal years that have materially impacted or are reasonably likely to materially impact our business strategy, operations, or financial condition. Expenses related to cybersecurity incidents have been immaterial.


text: Our year-round cybersecurity awareness program mandates training for all system users, covering essential topics such as safeguarding sensitive information, identifying phishing attempts, securing mobile devices, and understanding the risks associated with artificial intelligence ("AI") platforms. Recognizing the importance of third-party risk, our strategic sourcing protocols mandate detailed cybersecurity assessments for potential third-party suppliers. New engagements with third parties are contingent upon affirmative evaluations or adherence to risk mitigation/acceptance protocols. Contracts with third parties include provisions for breach notification, investigation, root cause analysis, and remediation.


text: We maintain a cybersecurity insurance policy covering costs that we may incur in connection with incidents. Our policy limits are commensurate with the size and the nature of our operations. However, Adtalem may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: Cybersecurity is acknowledged as an important enterprise risk at Adtalem. Our Audit and Finance Committee ("AFC"), comprised entirely of independent directors, is responsible for oversight of risks from cybersecurity threats. The Chair of our AFC has received a CERT certificate in Cybersecurity Oversight from Carnegie Mellon University in partnership with the National Association of Corporate Directors. Our CISO briefs the AFC on cybersecurity matters, including the evolving threat landscape and Adtalem's threat mitigation efforts, four times a year. At each quarterly meeting, the Chair of our AFC also briefs the full Board on cybersecurity matters discussed at AFC meetings. Cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of our annual enterprise risk management ("ERM") assessment. In February 2024, our full Board reviewed and discussed best practices for cybersecurity and cybersecurity disclosures with an external third party. The subsequent Board discussion included a focus on the cyber threat landscape, responses to cyberattacks, risks posed by third-party vendors, and best practices to address cyber risks.


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the National Institute of Standards and Technology Special Publication (SP) 800-53. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and SP 800-53 as a framework to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Stride, Inc.

ticker: LRN


text: Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, including incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We operate in markets that are dependent on Information Technology (IT) systems and technological change. Failure to maintain and support customer facing services, systems, and platforms, including addressing quality issues and execution on time of new products and enhancements, could negatively impact our revenues and reputation" and "Risk Factors – The failure to prevent a cybersecurity incident affecting our systems could result in the disruption of our services and the disclosure or misappropriation of sensitive information, which could harm our reputation, decrease demand for our services and products, expose us to liability, penalties, and remedial costs, or otherwise adversely affect our financial performance".


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee on any incidents it considers to be significant or potentially significant.


text: Our management team, including our Chief Information Security Officer (CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 20 years of experience managing the security and compliance organization for global companies, providing online and cloud-based services to more than a majority of the Fortune 500 and the United States Government.


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: CytoDyn Inc.

ticker: CYDY


text: Cybersecurity Governance and Oversight Bio-Techne's cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"), with day-to-day management and administration of our cybersecurity program performed by the IT Security Operations team. The CISO reports to the Chief Information Officer ("CIO"), and the CIO reports to the Chief Executive Officer. The CISO is supported by the Incident Response Team ("IRT"), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions. The IRT supports the CISO and CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation. In addition to leadership and support within management, we also work with security service providers to monitor for vulnerabilities and threats, and which are reported to the Security Operations team. All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises with a focus on roles and functions with access to sensitive company and financial information. We also conduct periodic tabletop exercises for key personnel involved in cybersecurity risk management, including the IRT.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Our Board of Directors ("Board") holds overall oversight responsibility for the Company's strategy and risk management, including in relation to cybersecurity risks. The Board exercises its oversight function through the Audit Committee, which oversees the management of risk exposure across various areas, including data security risks, in accordance with its charter. In addition, the Audit Committee is specifically responsible for the review and approval of any cybersecurity incident disclosure, as set forth in the Committee's charter. In the event of a potentially significant cybersecurity incident, the Audit Committee's charter requires that management promptly communicate and consult with the Audit Committee.


text: Bio-Techne's General Counsel updates the Audit Committee multiple times per year regarding Bio-Techne's cybersecurity programs, including regularly-tracked metrics on incident response, internal security testing, and measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Audit Committee regularly updates the full Board on these matters. In addition, the CISO and/or CIO provides the full Board with a thorough review of the Company's cybersecurity program, including current status, industry risks and exposure, and future strategy.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect Bio-Techne, including our business strategy, results of operations or financial condition. However, please see Item 1A. Risk Factors – "A significant disruption in, or breach of security of, our information technology systems or data, or violation of data privacy laws, could result in damage to our reputation, data integrity and/or subject us to costs, fines, or lawsuits under data privacy or other laws or contractual requirements."


text: Cybersecurity Risk Management and Strategy Bio-Techne's cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our and our customers' data that complies with legal requirements [and industry best practice] while supporting our and our customers' business needs. Our cybersecurity program follows industry standards and best practice for preventing, detecting, remediating, and mitigating potential cybersecurity threats, including regular processes to identify, evaluate and manage potential risks.


text: Our IT Security Operations team administers and monitors the prevention, detection, mitigation, and remediation of potential cybersecurity risks. This team leverages both Bio-Techne's internal IT resources, including its personnel, as well as managed security service providers and other third-party security software and technology services, as well as through other means. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity, including risks arising from our use of third party providers software and service providers. In addition to our evolving processes and systems, we foster a culture of cybersecurity education, training, and testing. Every year, employees in sensitive job categories must take and pass rigorous information security and protection training.


text: We partner with experienced external consultants to assess our cybersecurity program, and to perform penetration testing as well as other testing programs designed to identify vulnerabilities and areas for fortification. Also, as part of our cybersecurity risk management program we maintain cyber insurance, with coverage amounts and terms that are typical and appropriate for a company of our size and type. This insurance may not be sufficient to cover us against all types of claims related to security breaches, cyberattacks and other related breaches.


text: Risk Management and Strategy As a leading global diversified animal health and mineral nutrition company, we are increasingly reliant on information technology systems and infrastructure to conduct critical operations and generally operate our business, which includes using information technology systems to process, transmit and store electronic information, including customer, employee and company data. The use of information technology systems makes us vulnerable to breaches of data security and cybersecurity attacks. For information on the potential risks related to cybersecurity, see "Item 1A. Risk Factors — Risk Factors Relating to Our Business — We may be subject to information technology system failures, network disruptions and breaches in data security."

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Although the aggregate impact on our operations and financial condition has not been material to date, the Company has been the target of cybersecurity attacks and expects them to continue as such attacks are becoming more sophisticated and frequent, and the techniques used in such attacks change rapidly. Any such future incidents could have a material impact on our business.


text: Our information security team, headed by our Director of IT Cyber Security and Compliance, who reports to our Chief Information Officer ("CIO"), monitors our technology systems to prevent, detect, mitigate and remediate any cybersecurity incidents. Our enterprise-wide cybersecurity program is aligned with the U.S. National Institute of Standards Technology Cybersecurity Framework and the Israel National Cyber Directorate, and we are members of the New Jersey Cybersecurity and Communications Integration Cell. This collaboration enables us to increase our cybersecurity knowledge, threat awareness, and awareness of cyber incidents within the industry. It also helps us take proactive measures to prevent incidents by defining attack group identifiers and implementing learning and improvement processes.


text: We use tools and techniques to continually assess, monitor, manage, and mitigate security risks to our technology systems. Our processes extend to third-party service providers, who have access to data on our systems. We engage a third party to perform an independent assessment of our cybersecurity penetration test and risk assessment program at least once every two years.


text: Security Operations Center (SOC) and Managed Detection and Response (MDR) services to ensure continuous monitoring and response to potential threats.


text: A cyber training and awareness process based on an annual work plan, which includes monthly training, bi-weekly simulations, an interactive magazine sent once a month to all users and a cyber incident simulation for the infrastructure team. The contents are based on relevant market trends.


text: In cybersecurity or privacy incidents, the probable frequency and magnitude of loss are evaluated by the triage team. The incidents are categorized as either high- or low-level severity and communicated to the CIO and Chief Executive Officer and the Senior Vice President, General Counsel and Corporate Secretary ("Legal Counsel"), at which time a determination is made on any additional communication requirements. Our Board of Directors is notified of high-level severity incidents. Our approach to incidents generally includes a process of investigation, learning, and subsequent improvement. In addition, we believe cyber insurance is a key mechanism for supporting and managing critical cyber incidents. Aligning the policy involves a thorough review of our protection layers and processes.


text: Our information technology systems are managed by our CIO. He has over 45 years of experience in digital systems and technology in the animal health, bio-tech pharmaceutical, pharmaceutical and oil and gas industries. He has held multiple leadership roles driving business value for investments in digital solutions. He also spent six years as a leader within internal auditing, providing experience and wisdom in business-driven risk management.


text: The CIO provides periodic reports to the Board of Directors and the executive management team, including our Legal Counsel. These reports include updates on our cybersecurity risks and threats, assessments of our information security program, and any changes in the threat landscape. Our information technology systems are regularly evaluated by internal and external consultants with the results of the review reported to the executive management team and the Board of Directors.


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including those associated with the use of third-party services and service providers. This framework includes steps for assessing a cybersecurity threat's severity and source, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and threat mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. To prevent and detect material cybersecurity incidents, our framework further includes, among other things, ongoing security awareness training for employees, regular cybersecurity risk and vulnerability assessments, and mechanisms to detect and monitor unusual network activity. We recognize the complex and evolving nature of cybersecurity threats and engage with various third-party service providers, including cybersecurity assessors and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM


text: RISK MANAGEMENT AND STRATEGY Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have implemented enterprise cybersecurity risk mitigation and governance processes, detailed in our Information Security Protection Program ("Security Plan"). Our strategy is guided by the Security Plan's principles, which involve monitoring threats and vulnerabilities, assessing and monitoring related controls, and supporting the Chief Information Security Officer (CISO). Our cybersecurity policies, standards, processes, and practices are integrated into our overall risk management system to enhance our ability to protect our operations and information. This includes annual cybersecurity reporting to the board of directors by senior leadership.

companyName: EGAIN Corp

ticker: EGAN


text: Third-Party Cyber Risk Management Our Third Party Cyber Risk Management Plan ensures that due diligence is carried out on third parties prior to and during engagement. Prior to engagement, third parties are assessed using a questionnaire that covers all areas of security including cyber risk and external documentation is requested such as SOC2 T2, penetration testing, and ISO 27001 certification and scope. We include security and privacy clauses within our third party contracts where applicable, which cover the implementation of security controls and self reporting. During engagement, third parties are regularly reviewed, at least annually, to ensure that cyber risks are evaluated and assessed on a continual basis.


text: Cyber Incident Response Plan Our Incident Response Plan outlines the processes for detecting, identifying, prioritizing, and analyzing information security events. Depending on the incident's scope, business impact, and potential material risk, our CISO, legal counsel, and business stakeholders are engaged. This cross-functional team assesses the appropriate response and mitigation pathway. Once security events are identified through our enterprise detection and monitoring ecosystem, the Incident Response Plan establishes a prioritization and decision workflow to determine the scope, business impact, and potential material risk, implemented in collaboration with the CISO, legal counsel, and business stakeholders.


text: Cybersecurity and Risk Management As a financial institution, we are confronted with a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners. Maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and maintaining customer confidence in our financial services.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security ("IS") Officer leads our cybersecurity program, reporting directly to the Chief Risk Officer ("CRO") and provides reports and updates to the information Technology ("IT") Committee, and the Board of Directors monthly or more frequently as required.


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Information Technology Officer.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The Incident Response Team ('IRT") members include senior management and other relevant personnel with defined roles and responsibilities. The IRP addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. The IRT is notified of all incidents, and incidents are elevated to the Board of Directors when warranted.


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness. We have regular and ongoing security education and training for employees and recovery and resilience tests. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessments results are shared with the IT Committee and Board of Directors.


text: Our information assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our IS and IT teams meet to ensure that risks are timely identified, patches and vulnerability requirements are monitored, and the necessary changes are implemented.


text: Our IT governance ensures alignment between the Company's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Company's risk appetite.


text: Oversight and Identification of Risks Associated with Third Parties Third party risk management is a component of our vendor management program. New vendors are reviewed prior to onboarding to ensure proper oversight and identify potential risks. Ongoing monitoring of emerging risks related to third-party services providers is performed periodically according to the vendor's risk rating. Vendor reviews include risk reviews for financial, reputation, information security, cybersecurity and business resiliency risk. These reviews are reported to the IT Committee and Board of Dirctors for approval..


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements and guidance regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the timely recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If a financial institution fails to observe the regulatory guidance, they could be subject to various regulatory sanctions, including financial penalties.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations to store and transmit sensitive data. We employ a layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our cybersecurity program is managed by the Information Security Officer who leads our IS team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Officer provides periodic reports to the IT Committee and Board of Directors. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.


text: Our Information Security Officer has more than 40 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security, information technology, and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from Missouri State University with focus on Business Administration Systems coursework.


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2024.

companyName: Rezolute, Inc.

ticker: RZLT


text: Managing cybersecurity risk and maintaining secure, reliable, and functional systems are among our highest priorities. Therefore, we have implemented tools, procedures, processes, and management mechanisms to help us achieve a robust cybersecurity environment, and a reliable cybersecurity posture We maintain an information security program comprised of policies and controls designed to reduce our cybersecurity attack surface and to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Material Cybersecurity Risks, Threats & Incidents We are not aware of any cyber event that has had a material effect on our business. However, we cannot ensure that we will not experience any such event in the future. Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. In addition, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, results of operations and financial condition. See Item 1A. Risk Factors for further details on risks related to potential breaches of our information technology systems.


text: Risk Management and Strategy The Company maintains an information security program and governance framework that is designed to identify, assess, manage, mitigate, and respond to cybersecurity risks associated with its information systems and information assets. Additionally, we maintain a similar risk-based approach to our third-party vendor management program including identifying and overseeing cybersecurity risks they present.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: The Company's Information Security Steering Committee ("ISSC"), further described below under "Governance", oversees information and cybersecurity risk management for the Company. The ISSC assists the board of directors in fulfilling its oversight responsibilities concerning the role of information security and cybersecurity in executing the Company's business strategy and complying with regulatory requirements. The ISSC is responsible for managing and enforcing the Company's information security program, development of cybersecurity policies, strategies, and plans, monitoring control statuses and program gaps, facilitating program assessments which include risk assessments and business impact analysis, and evaluating risk mitigation strategies to address cybersecurity threats. The Company's cybersecurity framework includes an assessment of critical systems, physical security, and information resources both within and outside the Company that exposes it to cybersecurity threats. The ISSC employs policies, systems, and safeguards to manage those cybersecurity risks. The Company continues to expand investment in information technology and cybersecurity infrastructure, including enhanced threat monitoring and detection services.


text: The ISSC consistently collaborates with third-party service providers to support and maintain a robust information security program. These service providers assist in responding to cybersecurity risks by providing comprehensive threat detection, monitoring and response services. The information security program is designed to provide effective processes, procedures, and internal controls, including monitoring cybersecurity threats through endpoint and network security, email protection, data loss prevention, vulnerability scanning and mitigation, identity and access management, logging and monitoring, and threat hunting. Independent third parties evaluate the Company's cyber readiness and resilience through ongoing testing and audits. We adapt our cybersecurity policies, standards, processes, and practices accordingly based on the insights provided by these reviews.


text: In addition, information security education and training is conducted both at the time of hire and annually thereafter by internal employees and certain third parties. Training is designed to mitigate accidental information security incidents by employees. Phishing simulation testing activities are regularly conducted internally and by third parties to assess employees' competency at identifying potential threats.


text: Vendor due diligence is performed for all third parties with access to the Company's information assets to ensure such parties maintain effective cybersecurity practices in accordance with the Company's vendor management program. The Company performs ongoing monitoring, including the review of cybersecurity practices, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Annual cybersecurity assessments are conducted by the Company's information technology team on its information systems using industry-standard guidelines and tools.


text: The board of directors is responsible for oversight of our information security program and fulfills this responsibility through regular reporting and updates provided by the ISSC, members of management and other third parties contracted to assess and test the effectiveness of the Company's information security and cybersecurity program. On a quarterly and as-needed basis the board of directors receives updates on cybersecurity risks and the actions taken by management to monitor and mitigate those risks, including key risk indicators, test results, reporting of recent threats and how the Company is managing those threats, along with pertinent information to allow the board of directors to evaluate the effectiveness of the information security program. In addition, at least annually, the board of directors receives comprehensive reporting from the virtual Chief Information Security Officer ("vCISO") on the overall effectiveness of the Information Security program.


text: The ISSC is comprised of representatives of management from various departments of the Company and members from an outside third-party information security service provider. The ISSC is led by the vCISO who oversees the implementation, coordination, and maintenance of the information security and cyber risk management program. The vCISO is a contracted third-party vendor and reports directly to the board of directors. This individual holds a Certified Information Systems Security Specialist Professional ("CISSP") certification and has over a decade of experience in community banking, risk management, compliance, and information security.


text: The ISSC includes members of management with specific cybersecurity expertise, including the Senior Vice President ("SVP") – Information Technology. The SVP – Information Technology, is a Certified Community Banker Technology Officer, has 20 years of experience in the information technology field, and is responsible for developing and implementing the Company's information security program.


text: The SVP – Information Technology reports to the board of directors on a quarterly basis regarding the relevant key risk indicators, information technology and information security events, including key risk indicator metrics used by the board of directors to monitor risks, and quarterly technology update which includes details of information technology and cybersecurity, initiatives, projects, training, events, and incidents.


text: The Company has developed a cyber incident response plan to maintain procedures and protocols for responding to incidents. The Cyber Incident Response Team ("CIRT") is comprised of all members of the Company's executive management team, the vCISO and representatives from the technology, operations, accounting, risk management, financial crimes, marketing and retail departments. During an incident response process, the Chief Administrative Officer serves as the incident manager. The Chief Administrative Officer has over 15 years of experience in leadership and management of information technology, cybersecurity, and incident response programs. In this role as incident manager, the Chief Administration Officer, in collaboration with the CIRT and external cybersecurity firms, as necessary, will assess the materiality of the breach following the incident response plan severity scale. This evaluation aims to accurately identify risks and potential operational and business impacts. Materiality determination involves an objective analysis of both quantitative and qualitative factors, including an evaluation of immediate impact on systems and critical infrastructure. The purpose of this cyber incident response plan is to ensure that the Company is prepared to manage operational and/or malicious events which may disrupt critical business processes and/or compromise the confidentiality, integrity, or availability of its data. This cyber incident response plan defines the processes the Company will follow to manage adverse security events. The cyber incident response plan also maintains procedures and protocols to escalate significant cybersecurity matters to the full board of directors and regulators, as deemed necessary. The Company's CIRT performs an annual testing exercise to evaluate its preparation and response plan in the event of an actual cybersecurity event.


text: Although cybersecurity threats, including those stemming from prior incidents, have not materially affected the Company in the previous fiscal year, and there are no known imminent cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations, or financial condition, we cannot guarantee that we will remain unaffected in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Risks Related to Operations" contained in Item 1A. Risk Factors.


text: We place a high priority on cybersecurity within our organization. This includes regular cybersecurity training for employees, focusing on relevant risks to their job duties (e.g. social engineering, ransomware, denial of service, and other risks). As part of our cybersecurity risk management program, we conduct internal tests to identify potential vulnerabilities. Additionally, we organize annual tabletop exercises led by third-party consultants to enhance our readiness for different scenarios, assess our core information systems and cybersecurity practices, improve decision-making and prioritization, and promote monitoring and reporting across business functions.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: We annually engage third parties to perform cybersecurity audits to identify opportunities and enhancements to strengthen our policies and practices. We also annually engage an independent third party to perform internal and external penetration testing of our systems.


text: Our Chief Information Officer ("CIO") is directly responsible for the implementation of our cybersecurity risk management program. Our CIO is additionally primarily responsible for our overall information security, strategy, policy, security engineering, architecture, operations and cybersecurity threat detection and the management of cybersecurity risk. Our CIO has over 30 years of experience in the fields of finance, technology and cybersecurity, including relevant prior senior leadership positions held with Marriott International, where he served as Global Chief Information Officer. The CIO meets with our Chief Executive Officer ("CEO") on a weekly basis and regularly reports to our senior management, as well as directly to our Board of Directors and the Audit Committee, regarding our cybersecurity risk and risk management.


text: In the event of a cybersecurity incident, senior management, including our General Counsel, CIO, and Chief Financial Officer ("CFO"), are tasked with conducting an assessment of the incident. This assessment involves evaluating relevant quantitative and qualitative factors as well as considering SEC guidance. Depending on the assessment results, the cybersecurity event may be escalated to involve our CEO, Board of Directors, and law enforcement. Additionally, the Board of Directors in consultation with senior management will decide, based on the assessment, whether the cybersecurity incident requires disclosure in a filing with the SEC.


text: The Bank has implemented an information security program aimed at protecting our customers, the Bank, and our shareholders. The program addresses risks identified by the Bank, including cybersecurity risks. Protecting confidential customer information and maintaining the availability of banking services are the primary objectives of the information security program.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: The board of directors is ultimately responsible for the oversight of the information security program. The status of the program is reported to the board throughout the year. Internally, the Bank's Chief Information Officer ("CIO") manages the status of the program and reports to the board. The CIO is a Certified Information Systems Security Professional (CISSP) since 2011 and has over 15 years of experience managing cybersecurity risks for financial institutions and healthcare organizations. The Technology Committee reviews and monitors the execution of the program. The Technology Committee consists of key stakeholders throughout the Bank, providing visibility into the risks posed to critical areas.


text: The foundation of the information security program is based on risk management principles. The Bank has established a risk management framework that identifies, assesses, and manages risks, including cybersecurity risks, that could have a material impact on its business, operations, or financial condition. The Bank identifies new risks to the confidentiality, integrity, and availability of its sensitive information and services during the assessment of new processes, services, vendors, or changes in the banking industry. The mitigating controls of identified risks collectively create the information security program.


text: The Bank's cybersecurity strategy involves continuous monitoring of threats, maintaining updated defense mechanisms, and training employees on best practices in cybersecurity. The Bank engages with third-party experts and utilizes advanced cybersecurity tools to enhance defenses against emerging threats. The Bank also performs regular penetration testing, incident response planning, business continuity testing, and system audits to ensure the ongoing strength of its cybersecurity systems. The Bank utilizes a trusted third party to monitor for suspicious activity, including escalation procedures. The Bank also maintains cyber liability insurance that includes activation and escalation procedures should an incident occur.


text: A vendor management program ensures third-party vendors and service providers adhere to the Bank's security, compliance, and operational standards to mitigate risks. This program involves assessing potential risks associated with vendors, such as data breaches, compliance violations, or operational failures, by conducting thorough due diligence and regularly monitoring vendor performance. It includes setting performance expectations, performing ongoing audits, and ensuring vendors implement necessary safeguards to protect the organization's sensitive data and maintain the availability of services. The goal is to ensure that third-party relationships do not introduce unacceptable levels of risk to the organization while maintaining business continuity and regulatory compliance.


text: As of this filing, no material cybersecurity incidents have occurred that would have a significant impact on the Bank's business, operations, or financial results. The Bank continues to monitor for any potential breaches and enhance its security protocols to prevent future incidents. While the Bank does not believe a cybersecurity threat is likely to materially affect the operations or financial condition, there can be no guarantee that the Bank will not experience such an incident in the future.


text: The Bank recognizes that the cybersecurity landscape is constantly evolving and remains committed to adapting its risk management strategies to address new challenges. The Bank continues to invest in its cybersecurity infrastructure and strengthen controls to mitigate risks effectively.


text: Our program is informed by industry standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), the American National Standards Institute encryption standards and the Payment Card Industry Data Security Standard. As part of our cybersecurity strategy, we regularly engage independent, outside expertise to assess and benchmark our overall program against these industry standards.

companyName: AUTOZONE INC

ticker: AZO


text: The cybersecurity risk management program is integrated into our broader enterprise risk management framework, which allows our senior management team, with oversight of our Board, to develop a more holistic view of our risk exposure and prioritize and manage such risks accordingly.


text: AutoZone's Chief Information Security Officer (CISO) reports directly to our Chief Information Officer and Senior Vice President of Information Technology. Our CISO has over 25 years' experience in IT, with almost 20 years in dedicated Information Security leadership roles. He has experience across a broad range of industries and holds credentials including the Certified Information Systems Security Professional and the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: The day-to-day management of the Company's cybersecurity framework is managed by the Company's information technology team while operational oversight of its design and function are managed by the Company's management team including, but not limited to, its Chief Operating Officer (COO), Chief Financial Officer (CFO), Director of Industrial Engineering, and Director of Information Technology, all of whom have substantial experience managing enterprise risk, including cybersecurity risks. Our management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our incident response procedures.

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not impact the Company's business in a material manner. At the effective date of this report filing, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on risks related to the Company's information technology systems, including cybersecurity threats that may materially affect the Company's business, see the risk factors included under Item 1A of this Annual Report on Form 10-K ("We Rely Heavily on Information Technology Systems to Operate Our Business. Any Disruptions to These Technology Systems or if These Systems were Made Unavailable for Use, May Have a Material Adverse Effect on Our Business").


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy and processes are designed to identify, assess, and manage risks to the confidentiality, integrity, and availability of our information technology environment, systems, and information. The cybersecurity risk management process is managed centrally and is led by our global chief information security officer ("CISO") who reports to our global chief information officer. Our cybersecurity program takes a risk-based approach and is integrated with our global enterprise risk management program. Our cybersecurity risk strategy is aligned with cyber/information security frameworks and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: TE Connectivity plc

ticker: TEL


text: our cybersecurity program maturity is benchmarked annually against industry standards and norms. The result serves as a guide to identifying evolving risks, prioritizing improvements, and enhancing the program;


text: cybersecurity threats are evaluated throughout the year by our around-the-clock security operations center, utilizing a variety of third-party subscription and threat intelligence data sources and data collected via internal monitoring and scanning processes;


text: annual security awareness trainings are required to be completed by employees, and monthly phishing campaigns and additional function-specific cybersecurity trainings are also conducted; security and risk metrics are reviewed monthly and reported to leadership quarterly; external penetration tests are conducted annually by independent third parties and appropriate actions are taken to strengthen controls;


text: a cybersecurity incident response charter and plan, and playbooks are maintained by the cybersecurity incident response team. The plan and playbooks are utilized during table-top exercises and trainings. Participants may include information technology, business, corporate function, and external resources depending on the table-top scenario; and third-party supplier security reviews are conducted based on risk. Reviews may include the assessment of security architecture, connections between our systems and the third party, data security controls, and user access controls.


text: To date, we do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect our systems and information may not successfully protect against future cyber incidents, which could materially affect our business strategy, results of operations, or financial condition. For additional information on certain risks associated with cybersecurity, refer to the risk factors related to cybersecurity and information technology systems in "Part I, Item 1A. Risk Factors."


text: Our CISO has over 20 years of experience in information security leadership roles and over 8 years as our CISO. Nearly half of our board of directors have completed cybersecurity program trainings or have cybersecurity and information security industry experience.


text: Cybersecurity incidents are evaluated by a cross-functional management team based on defined quantitative and qualitative criteria and communicated to leadership. We have cybersecurity and information technology third-party consultants to assist in performing forensic and technical analyses and advising leadership as needed.


text: The cybersecurity committee of our board of directors has oversight responsibility for cybersecurity risks. The CISO provides updates at least twice a year to the cybersecurity committee regarding matters related to information technology and cybersecurity risks including the state of our cybersecurity programs, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risk. Additionally, the full board of directors receives updates on our cybersecurity program twice a year as part of the enterprise risk management meetings.


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2024, and thru the date of filing of this Form 10-K.

companyName: PURE CYCLE CORP

ticker: PCYO


text: At the management level, we and John Deere jointly maintain a dedicated global team of cybersecurity professionals (Cybersecurity Team) led and managed by John Deere's Chief Information Security Officer (CISO). The Cybersecurity Team is responsible for overseeing John Deere's and our cybersecurity program, including the assessment and management of risks. The Cybersecurity Team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing, and cyber incident management. John Deere's CISO holds a degree in Management Information Systems and has been with John Deere for over ten years. He has over two decades of extensive experience in information technology and cybersecurity and reports directly to John Deere's Chief Information Officer.

companyName: DEERE JOHN CAPITAL CORP


text: Risk Management and Strategy Our and John Deere's cybersecurity program is designed to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents with the goal of protecting the confidentiality, integrity, and availability of our critical systems and information. We use a risk-based, multi-layered information security strategy to assess, identify, and manage risks from cybersecurity threats. The Cybersecurity Team meets frequently to monitor, assess, and address cybersecurity threats and incidents. We and John Deere also work with third parties to assess the maturity of our cybersecurity program, leveraging the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).


text: Based on the information available as of the date of this Annual Report on Form 10-K, cybersecurity risks, including as a result of any previous cybersecurity incident, have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we have seen an increase in cyberattack volume, frequency, and sophistication in the digital environment.


text: Risk Management and Strategy The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework. The Cybersecurity Program is developed and reviewed by the Company's executive leadership alongside the Company's Audit Committee and carried out and overseen by the senior person in charge of IT at the Company, currently our Chief Compliance Officer ("CCO").

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Audit Committee.


text: Role of the Board of Directors and the Audit Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Risk Management and Strategy The Company contracts with third party service providers for its information technology and cybersecurity risk management functions. The Company's third party cybersecurity provider assesses risks to the Company from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the provider's cybersecurity standards, processes, and practices. To protect the Company's information systems from cybersecurity threats, the Company's third party cybersecurity provider uses various security tools that help the Company identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include but are not limited to, timely reporting of cybersecurity incidents to the Company, performing vulnerability testing, using tools and techniques to test security controls, monitoring emerging trends and regulations related to information security, and implementing appropriate changes, as needed, to the Company's cybersecurity protections.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: During the third party procurement and contracting process, the Company incorporates due diligence procedures and contract provisions that are designed to align with applicable regulations and industry benchmarks.


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "The Company's business and operations would suffer in the event of computer system failures or security breaches " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity measures throughout its operations that are designed to address cybersecurity threats and incidents. The Company has a Cyber Security Policy (the "Policy") that includes guidelines and provisions for security measures to help mitigate the Company's cybersecurity risk. The Policy applies to all Company employees, contractors, volunteers, and anyone who has permanent or temporary access to the company's systems and hardware ("Covered Persons"). In addition to outlining measures Covered Persons are expected to take to help protect the Company's information technology and cybersecurity infrastructure, the Policy includes a process for Company employees who identify a cybersecurity risk to report and escalate such risk to the Executive Director of Administration (the "EDA") for investigation.


text: The Company has implemented a cybersecurity incident response plan that is designed to provide controls and procedures to facilitate timely and accurate reporting of a material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by our third party cybersecurity provider, who would promptly inform the Company's EDA. If a cybersecurity event meets certain criteria, the EDA escalates it to our management team, including our Chief Executive Officer and Chief Financial Officer. The incident response plan also contains procedures for escalating cybersecurity incidents to the Chairman of the Board and the Audit Committee.


text: The EDA is responsible for managing the Company's cybersecurity risks. The current EDA has over 15 years of experience in IT oversight.


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the Company's cybersecurity and information security program and receives quarterly updates from senior management on cybersecurity and information security matters. The EDA or key members of our management team update the Audit Committee periodically on the cybersecurity landscape, including the status of cybersecurity threats and the Company's contracts and initiatives related to cybersecurity.


text: The Company's Manager of Information Technology & Facilities (the "IT Manager") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended September 30, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.


text: Management's Role in Managing Risk The IT Manager plays a pivotal role in informing the board of directors on cybersecurity risks. The IT Manager and members of senior management meet regularly and provide comprehensive briefings to both the board of directors. These briefings encompass a broad range of topics, including: the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies;


text: incident reports and issued identified from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our regularly scheduled board meetings, the IT Manager regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the board, ensures the board's oversight is proactive and responsive. The board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Cyber Risk Management Personnel The IT Manager directly reports to senior management. The IT Manager regularly meets with senior management to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our IT Manager, whose over eleven years of information technology experience in the financial services industry has provided him with in-depth knowledge and experience which are instrumental in developing and executing our cybersecurity strategies.


text: Monitoring Cybersecurity Incidents The IT Manager and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Manager provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, business partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving operational continuity and the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management has been delegated to the Audit, Finance and Risk Committee of the Board (the "Audit Committee"), which interacts with the Company's ERM function, the Company's Global Vice President of Information Technology, the Company's Director of Cyber Security, and other members of management and relevant management committees and councils.


text: Collaborative Approach: The Company has adopted a cross-functional approach toward identifying, prioritizing, and implementing the means to protect information technology systems and its employees from cybersecurity threats. Additionally, the Company has established communications protocols and processes to escalate cybersecurity incidents to engage management as needed to make timely decisions regarding incident response, recovery, and any required disclosures.