text: These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity. The Board and/or our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, the management will report to the Board and/or Audit Committee on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks. In addition to such reports and updates, the management will provide updates to our Board and/or our Audit Committee as to changes to our cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.


text: While prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: TLGY ACQUISITION CORP

ticker: TLGYF

secItem: Item 1C


text: Risk Management and Strategy Information systems and other technologies, including those related to the Corporation's information and operational technology systems, and its technical and environmental data, are an important part of the Corporation's business activities. We must comply with certain elevated contractual requirements, including those related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the United States Department of Defense ("DOD"). We continue to implement cybersecurity processes designed to align with DOD requirements, instructions and guidance and work with the DOD as needed to assess cybersecurity risk and on policies and practices aimed at mitigating these risks. Accordingly, the Company maintains processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Such processes include the use of traffic monitoring tools, as well as training users to detect, report, and prevent unusual behavior. We also employ monitoring mechanisms to help us detect and respond to cybersecurity threats. We conduct regular assessments and testing of the effectiveness of these controls, including security audits, incident response planning, and regulatory compliance assessments. We seek to foster cybersecurity awareness and responsibility throughout the organization by regularly providing our employees with training on cybersecurity practices.


text: We use user access controls to limit unauthorized access to sensitive information and critical systems. In addition, we use multi-factor authentication for remote access, use of privileged accounts and access to critical systems. Encryption methods are used to protect sensitive data. This includes the encryption of customer data, financial information, and other confidential data. The implementation and management of these cybersecurity processes are integrated with the Company's overall operational risk management processes, which seeks to limit our exposure to unnecessary risks across our operations.


text: We maintain an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Pursuant to the incident response plan, the identifying party is required to notify the Company's CFO and Board of Directors of certain cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The incident response plan also includes procedures for: Gathering information about the cybersecurity incident. Consulting with cybersecurity consultants and other parties to assess the cybersecurity incident.


text: Evaluating the materiality of the cybersecurity incident, determining whether there are disclosure obligations under applicable securities laws, and external reporting, as required.


text: We engage third party service providers including consultants and auditors in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks.


text: Impacts from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have been subject to certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. For additional information about the risks to our business associated with a breach or compromise to our information technology systems, see section Item 1A, Risk Factors – System security vulnerabilities, data breaches, and cyber-attacks could compromise proprietary or otherwise sensitive information or disrupt operations, which could adversely affect Perpetua Resources' business, reputation, operations, and stock price.


text: Our IT Systems Administrator is responsible for assessing and managing our risks from cybersecurity threats and oversees our cybersecurity program. The IT Systems Administrator reports directly to our Chief Financial Officer (CFO). Our IT Systems Administrator holds an associate degree in computer application and support and has served in various roles in information systems administration for over eight years, including roles involving managing information technology and systems and implementing cybersecurity programs.


text: Our full Board and our Audit Committee oversee risks from cybersecurity threats and our cybersecurity practices and policies. Accordingly, our CFO periodically updates the Board and Audit Committee on cybersecurity matters, including cybersecurity risks. Additionally, our Board and Audit Committee, as well as senior management, receive reports on an as-needed basis regarding our cybersecurity posture, cybersecurity incidents, and remediation efforts.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Nabors Energy Transition Corp. II


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and, as noted in Item 1A. Risk Factors of this Annual Report on Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for the Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition.

companyName: Pegasus Digital Mobility Acquisition Corp.


text: As a blank check company, we have no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Due to our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Report. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Spring Valley Acquisition Corp. II

ticker: SVIIF


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying, evaluating suitable acquisition transaction candidates and completing the merger with our target acquisition companies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: VSEE HEALTH, INC.

ticker: VSEE


text: Risk Management and Strategy Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas. The cybersecurity risk management program includes: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment;


text: A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training;


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and, A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees the implementation of the cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from the Company's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. The Company's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.


text: We are a blank check company whose business purpose is to effect a merger, capital stock exchange, asset acquisition, stock purchase, reorganization or similar business combination with one or more businesses or assets. We have no significant operations. Therefore, while management monitors our exposure to cybersecurity risk, we have not adopted specific processes for assessing and managing such risk. The audit committee is generally responsible to discuss with management any significant risks or exposures, and as necessary report such risks or exposures to our board of directors. We have not encountered any cybersecurity incidents since our initial public offering. However, sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure could lead to corruption or misappropriation of proprietary information and sensitive or confidential data. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. See Item 1A. Risk Factors, "Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss" of this Annual Report for a discussion of cybersecurity-related risks.

companyName: CONX Corp.


text: Risk management and strategy Cybersecurity and information privacy are important parts of our overall approach to risk management. We have documented cybersecurity policies and procedures to identify, assess and manage risks from cybersecurity threats. We believe our cybersecurity policies and procedures are reasonably designed to materially protect the security of both our data and the data in our custody. To protect our information systems, we employ various security tools supporting protection, detection and response capabilities, including anti-malware and security applications, and periodic risk analyses. We maintain a cybersecurity incident response plan to help ensure a timely, consistent response to actual or attempted cybersecurity incidents impacting the Company.

companyName: Greenbrook TMS Inc.


text: We may engage third parties from time to time, including consultants and auditors to conduct assessments of information systems. We have policies and processes in place to govern third-party access and the risks associated with such access.


text: Our systems face cybersecurity risks, and we have in the past experienced threats to and breaches of our data and systems. However, to date, these incidents have not had a material impact on our business, results of operations or financial conditions. There can be no assurance that we will not experience any material cybersecurity threats or incidents in the future. See Item 1A "Risk Factors—A material disruption in or security breach affecting our information technology systems could significantly affect our business and lead to reduced sales, growth prospects and reputational damage".


text: Cybersecurity at our Company is led by our Chief Information Security Officer (" CISO ") and our Compliance and Privacy Officer and overseen by our Board. One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our CISO and our Compliance and Privacy Officer provide periodic reports to the Board regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing and activities of third parties. The current CISO has over twenty years of experience in information technology and security, and his background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles.


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: We intend to implement a formal cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to address potential cyber incidents swiftly and effectively.


text: In designing and evaluating our cybersecurity program, we intend to adopt the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 will be for guidance purposes to frame our risk identification, assessment and management processes and will not equate to compliance with any specific technical standards or requirements.


text: The key components of our future cybersecurity program are expected to include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;


text: a third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents;


text: engagement with external service providers to evaluate, enhance, or support our security measures; and an incident response plan outlining specific procedures for managing cybersecurity incidents;


text: Cybersecurity Governance The governance of cybersecurity risks is a critical function of our Board which has a key role in the oversight of cybersecurity and related technology risks. The Board is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.


text: The Board will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts.


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Chief Financial Officer and Chief Executive Officer. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach will include regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.


text: Operations in Emerging Markets The Company has its material properties and operating subsidiaries in Botswana. It is possible that operating in Botswana may expose the Company to a certain degree of political, economic and other risks and uncertainties. In conducting its operations in Botswana, the Company has, among other things: (i) engaged and maintained experienced management and technical teams located in Botswana and/or with extensive experience in operating properties in Africa; (ii) certain members of the board and management routinely visit the Company's Botswana properties; (iii) retained advisors and technical experts in Botswana including its local counsel, Bookbinder Business Law (" Bookbinder "); and (iv) generally maintained robust internal control over its foreign subsidiaries, all of which are more particularly described below.


text: Subsidiaries and Operations in Botswana The Company's principal business activity in Botswana is the re-development of the Selebi Mines and the Selkirk Mine (together, the " Botswana Assets ").


text: The establishment and development of PNGPL and PNRPL, each of which is a Botswanan entity, adds an additional regulatory framework within which the Company operates and is supplementary to the regulatory framework existing in Canada. The Company holds its interest in the Selebi Assets and the Selkirk Assets indirectly through its 100% owned subsidiaries, PNRPL and PNGPL respectively.


text: The Company's operating entities in Botswana are governed in accordance with applicable local laws and entity-wide governance principles. The directors and management of the Company's operating entities in Botswana are generally comprised of a majority of senior management employees and where required by local laws, local residents, who are generally longstanding local management level employees, or local corporate counsel. In addition, certain members of the Company's management have experience conducting business in Botswana, as detailed below, where the Company has maintained operations since 2021. Operating in Botswana requires greater internal controls and adherence to a regulatory framework which creates challenges in relation to decision-making, communication, and compliance. The Company has experienced management and has retained legal advisors and consultants to help facilitate adherence to regulatory requirements in order to meet this challenge.


text: We face many cybersecurity threats including ransomware, denial-of-service attacks, business email compromise, and persistent threats from state-affiliated groups. We have experienced cyber-attacks in the past and may experience cybersecurity incidents in the future. While prior incidents have not materially affected our business, results of operations or financial condition, there is no guarantee that a future cyber threat or cyber incident would not affect our business strategy, results of operations or financial condition. See Item 1A. Risk Factors for more information on our cybersecurity risks.

companyName: AAR CORP

ticker: AIR


text: Risk Management and Strategy We maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. Our cybersecurity strategy and risk management processes use the National Institute of Standards and Technology governance requirements and cybersecurity framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our approach to cybersecurity risk management includes multiple complementary elements to mitigate our cybersecurity risks. We utilize multi-layered defenses to help prevent attacks including the use of data analytics to help detect anomalies and search for cyber threats. We have comprehensive cyber threat detection and response capabilities with applied threat intelligence, and continuous monitoring to complement other technology, processes and threat detection techniques we have in place. We subscribe to third-party managed security services that continuously monitor our systems and networks to assist with early cybersecurity threat detection and protection.


text: We work with government, customer, industry and/or supplier partners to gather and develop policies and standards and share information to address cyber threats. We conduct information security assessments of partners before sharing or allowing the hosting of data in computing environments managed by third parties. We require our employees to complete phishing and other awareness training to help identify, avoid and mitigate cybersecurity threats.


text: While our primary focus is on prevention and detection of cybersecurity threats, we have response and recovery plans in effect, as well as service agreements with outside experts should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The detailed plan defines the roles and responsibilities of all parties included in our cybersecurity incident response team which incorporates our IT team, senior management, and other functional areas.


text: We also have controls and procedures for reporting material cybersecurity incidents, including review of significant cybersecurity incidents by a cross-functional team to determine whether further escalation is necessary. We also periodically conduct practice exercises with management to familiarize the management team with our cyber incident response capabilities and processes. We also conduct internal and third-party assessments or penetration tests to validate our cybersecurity controls and improve our security posture. We also maintain cybersecurity liability insurance coverage.


text: To facilitate the prevention, detection and timely response to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for managing our information security strategy, policies, standards, and processes. The CISO reports directly to our Chief Digital & Technology Officer ("CDTO"), who reports directly to our Chairman, President and Chief Executive Officer. Our CDTO and CISO have extensive experience and expertise in developing, implementing, and operating security policies and procedures covering our network and critical data. The CDTO and CISO regularly review cybersecurity matters with members of our senior management. These discussions include the latest cybersecurity risks and threats, the status of our cybersecurity incident response plan, and our overall process relating to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our Board of Directors, through its Audit Committee, is responsible for overseeing our cybersecurity risk management. On a regular basis, the Board of Directors or Audit Committee receive and review reports from the CDTO and CISO relating to the status of cybersecurity planning and protections, the overall state of our cybersecurity program, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks.


text: The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2024 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: ECA Marcellus Trust I

ticker: ECTM


text: Risk Management Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity risk management program is embedded in its three lines of defense model.


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cybersecurity threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. In addition, BNY Mellon maintains a preparedness program designed to reinforce cybersecurity risk management practices and compliance with BNY Mellon's policies and procedures. The preparedness program includes mandatory training for all employees, contractors and consultants, enhanced training for those in roles presenting higher risk, calibrated phishing email simulations, distribution of information security awareness materials and cybersecurity event simulation exercises. In addition, BNY Mellon leverages both internal and external assessments and engages with third-party assessors, consultants and auditors to evaluate and test its cybersecurity controls and provide guidance on potential improvements, including design and operating effectiveness. BNY Mellon has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.


text: BNY Mellon's Technology Risk Committee is the most senior governance committee primarily focused on cybersecurity and technology risk issues and is a part of the second line of defense risk function. It is responsible for, among other things, overseeing and reviewing emerging cybersecurity risks, significant cybersecurity incidents and remediation plans. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is chaired by the interim Chief Technology Risk Officer. Members include key leaders from the first line of defense, including the CISO.


text: BNY Mellon's CIO, CISO and interim Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO joined BNY Mellon in September 2024 from a large multinational company, where she was responsible for overseeing information technology and cybersecurity operations. BNY Mellon's interim Chief Technology Risk Officer joined BNY Mellon in November 2024 and has previous experience as Global Head of Cyber, Technology and Information Security Risk Management at a global systemically important financial institution and over a decade of experience serving the U.S. intelligence community in a variety of cybersecurity-related positions.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks arising from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic assessments to identify such cybersecurity threats.

companyName: CHINA AUTOMOTIVE SYSTEMS INC/2


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. Our IT leadership reports to our Chief Executive Officer (CEO) periodically and on an as-needed basis to manage our risk assessment and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.


text: We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the financial year ended December 31, 2024.


text: We rely on the cybersecurity strategy and policies implemented by HMC Capital, the ultimate parent of our Sponsor. HMC Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. HMC Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. HMC Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: HMC Capital's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or our Advisor. HMC Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us or our Advisor, is integrated into HMC Capital's risk management program. In addition, HMC Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.


text: HMC Capital's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness training, including for all of the employees of our Sponsor and its affiliates. Our Sponsor undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Sponsor's and our critical third-party vendors and other partners. Our Sponsor also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: Senior management and personnel of our Sponsor and our Advisor, which includes our Advisor's personnel, work to conceive, implement, and monitor the effectiveness of a program designed to protect our information systems from cybersecurity threats and to promptly respond to any security incidents.


text: In the event of a cybersecurity incident impacting us or our Advisor, our Sponsor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of our Sponsor, including coordinating with the relevant members of our Advisor. The incident response plan includes notification to the applicable members of cybersecurity leadership, and, as appropriate, escalation to the full HMC Capital risk management team and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee of our board of directors and to our full board of directors, if appropriate.


text: Oversight of Cybersecurity Risks Our board of directors and audit committee have primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the HMC Capital cybersecurity team periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on HMC Capital's cybersecurity program as it impacts us, the external threat environment, and HMC Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and HMC Capital's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Material Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material cyber incident and the expenses we have incurred from information security incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors- Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: RISK MANAGEMENT AND STRATEGY Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have implemented enterprise cybersecurity risk mitigation and governance processes, detailed in our Information Security Protection Program (Security Plan). Our strategy is guided by the Security Plan's principles, which involve monitoring threats and vulnerabilities, assessing and monitoring related controls, and supporting the Chief Information Security Officer (CISO). Our cybersecurity policies, standards, processes, and practices are integrated into our overall risk management system to enhance our ability to protect our operations and information. This includes annual cybersecurity reporting to the board of directors by senior leadership.

companyName: EGAIN Corp

ticker: EGAN


text: We engage third-party providers to conduct evaluations of our security controls, through penetration testing, independent audits or consulting on best practices. These evaluations include testing both the design and operational effectiveness of our security controls.


text: Our Security Plan Our Security Plan, developed in collaboration with third-party consultants, aligns with the National Institute of Standards and Technology (NIST) and ISO 27001. This program encompasses security and privacy, risk-based controls, and integrates lessons learned from past cybersecurity incidents. Under the Security Plan, cyber risks, including threats and incidents, are continuously assessed, treated, and monitored. We incorporate insights from incident response and risk mitigation into our cyber risk management strategy to enhance overall cybersecurity. The Security Plan is led by specific management positions selected for their expertise, as detailed below.


text: Following best practices in cyber risk management, we have worked with recognized third-party experts to align the foundational processes, metrics, monitoring, and reporting of the Security Plan with common frameworks such as NIST.


text: Third-Party Cyber Risk Management Our Third-Party Cyber Risk Management Plan ensures that due diligence is carried out on third parties prior to and during engagement. Prior to engagement, third parties are assessed using a questionnaire that covers all areas of security including cyber risk and external documentation is requested such as SOC2 T2, penetration testing, and ISO 27001 certification and scope. We include security and privacy clauses within our third party contracts where applicable, which cover the implementation of security controls and self reporting. During engagement, third parties are regularly reviewed, at least annually, to ensure that cyber risks are evaluated and assessed on a continual basis.


text: Cyber Incident Response Plan Our Cyber Incident Response Plan outlines the processes for detecting, identifying, prioritizing, and analyzing information security events. Depending on the incident's scope, business impact, and potential material risk, our CISO, legal counsel, and business stakeholders are engaged. This cross-functional team assesses the appropriate response and mitigation pathway. Once security events are identified through our enterprise detection and monitoring ecosystem, the Incident Response Plan establishes a prioritization and decision workflow to determine the scope, business impact, and potential material risk, implemented in collaboration with the CISO, legal counsel, and business stakeholders.


text: Additionally, we have implemented an information security training program for employees, which includes security awareness training on cybersecurity risks, simulated phishing emails, and regular communication about cybersecurity risks.


text: While we occasionally experience cybersecurity threats and incidents, we are not aware of any material risks from these threats, including from past incidents, that have materially affected or are likely to materially affect our business strategy, financial condition, results of operations, or cash flows. However, there is no assurance that future cybersecurity threats will not have a material impact. For more information on our cybersecurity-related risks, please see "Item 1A. Risk Factors."


text: Protecting our customers' data is a top priority for our board of directors and management team. Our risk management team, integrated into our CIS function, is led by our CISO. This team brings together extensive experience in information security, governance, and compliance, covering areas such as engineering, architecture, cybersecurity, and privacy. They are responsible for defining the program, overseeing cybersecurity governance, and gathering insights to assess, identify, and manage cybersecurity threats, their severity, and mitigations.


text: Our CISO, who reports to the Chief Financial Officer, leads the company's technology and digital capabilities, including the overall cybersecurity strategy. Our CISO has over 25 years experience working in the commercial sector within the IT and security environments, across a variety of business verticals. Prior to this was in the Armed Forces working in an IT, telecommunications and security capacity. A member of (ISC)2 and CISSP certified, the CISO understands the security and protection requirements needed for areas such as data protection, PCI/DSS, HIPAA, FedRAMP.


text: The Audit Committee of our board of directors is charged with oversight of data privacy and cybersecurity risks. Our CISO provide annual updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full board of directors at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the board of directors on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CISO discusses and presents strategies to address technological changes, such as AI. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. Outside counsel advises the board of directors on best practices for cybersecurity oversight by the board of directors, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including those associated with the use of third-party services and service providers. This framework includes steps for assessing a cybersecurity threat's severity and source, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and threat mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. To prevent and detect material cybersecurity incidents, our framework further includes, among other things, ongoing security awareness training for employees, regular cybersecurity risk and vulnerability assessments, and mechanisms to detect and monitor unusual network activity. We recognize the complex and evolving nature of cybersecurity threats and engage with various third-party service providers, including cybersecurity assessors and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size. Additionally, we maintain industry-standard cybersecurity insurance to provide further protection against cybersecurity risk.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM


text: Our Board is ultimately responsible for overseeing our risk management, including cybersecurity risk management. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Financial Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to our independent Audit Committee and ultimately to our Board. There were no such cybersecurity incidents or threats that have materially impacted our business or operations. Management presents an assessment of our cybersecurity processes, procedures, and testing results to the Audit Committee at least annually.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats nor provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see discussion captioned "Our business could be negatively affected by security threats. A cyber-attack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation, and/or financial loss." in Item 1A. Risk Factors.


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Rezolute, Inc.

ticker: RZLT


text: We have engaged external parties, including risk management consultants and computer security firms, to enhance our cybersecurity oversight. In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.


text: Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we did not have any cybersecurity incidents in fiscal year 2025.


text: We are committed to protecting the confidentiality and integrity of our data, as well as the data of our customers. The mission of our cybersecurity program is to protect the assets used to generate revenue and serve customers while complying with industry frameworks and best practices. Our cybersecurity program consists of cyber defense, governance and compliance, and risk management. Each area has tools, controls, and processes aligned with the National Institute of Standards and Technology Cyber Security Framework.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Managing cybersecurity risk and maintaining secure, reliable, and functional systems are among our highest priorities. Therefore, we have implemented tools, procedures, processes, and management mechanisms to help us achieve a robust cybersecurity environment, and a reliable cybersecurity posture.


text: We maintain an information security program comprised of policies and controls designed to reduce our cybersecurity attack surface and to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.


text: Risk Management and Strategy Our cyber defense practices prioritize protection against cyber threats. We have operationalized tools and processes designed to educate, assess, identify, address, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems. We routinely perform cybersecurity assessments, including with the assistance of external third parties, to identify, assess, and prioritize potential risks that could affect our information and data assets and infrastructure. Once identified, the mitigation of these risks is given our highest priority.


text: In addition, we use a threat intelligence platform to routinely monitor risks specific to both our organization and third parties. Risks we identify are assessed based on severity and are addressed as appropriate through both tactical and strategic plans. Our governance and compliance practice focuses on cybersecurity and data privacy policy taxonomy and policy compliance.


text: We have implemented a number of measures to enhance the security and resiliency of our information and data systems. These measures include, but are not limited to: (i) user access control management; (ii) intrusion detection and prevention systems; (iii) information security continuity measures, including redundant systems and information backups; (iv) system segmentation; (v) encryption of critical information and data; (vi) event logging; (vii) implementation of an application patching and update cadence; and (viii) incident response planning and least privilege access methodology.


text: Cybersecurity Governance Our board of directors delegates to the Audit Committee the oversight of our programs, policies, and procedures related to cybersecurity, information asset security, and data privacy and protection. Broad oversight is maintained by our full Board, which receives a report from the Audit Committee at least annually.


text: Our CTO oversees our cybersecurity matters and reports to both the Audit Committee and the Board at least once a year, or more frequently as needed. The Audit Committee reviews and discusses with Company management key processes and risk indicators, progress on plans to address key risks, and any material changes in threat landscapes or risk posture which could negatively affect our business.


text: Training and Awareness Our Company's employees are a critical part of our defense against potential cybersecurity incident exposure. All of our associates and contractors have a responsibility and a role to play by complying with our cybersecurity operational practices and reporting any potential cybersecurity incidents or exposures to our cybersecurity team.


text: To ensure that associates can play their part in protecting our networks and data from cybersecurity incident exposure, all of our associates receive cybersecurity training in the form of online modules on an annual basis, routine simulations to assess risk, and retraining where necessary.


text: Material Cybersecurity Risks, Threats & Incidents We are not aware of any cyber events that have had a material effect on our business. However, we cannot ensure that we will not experience any such event in the future. Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. In addition, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, results of operations and financial condition. See Item 1A. Risk Factors for further details on risks related to potential breaches of our information technology systems.


text: We are committed to securing and strengthening our information systems against cybersecurity threats and protecting the privacy and security of our customer, employee, and company data. However, as outlined in "Item 1A. Risk Factors — Risks Related to IT Systems, Cybersecurity and Data Privacy" of this Annual Report on Form 10-K, we are acutely aware that cybersecurity threats are a persistent concern in today's digital world. Despite our investments in securing our information systems, we understand that cybersecurity incidents can still occur, potentially causing material harm to our brand, business, operations, and financial condition. In light of this, we have developed a cybersecurity risk management program to identify, assess, monitor and manage cybersecurity risk.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our Board of Directors oversees cybersecurity risk as part of its risk management function and has delegated oversight of cybersecurity risk to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management and outside consultants regarding our information systems and procedures and overseeing our cybersecurity risk management processes.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks and is updated on any cybersecurity incidents as necessary. The Audit Committee reports on cybersecurity matters to the full Board on a regular basis. Additionally, the full Board regularly receives presentations from management and third-parties on cybersecurity topics as part of the Board's ongoing education on issues that affect public companies.


text: As a critical component of our cybersecurity risk management program, we have strategically integrated cybersecurity risk management into our broader enterprise risk management function to cultivate a company-wide culture of cybersecurity risk management. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). We use the NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. Additionally, given that we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards (PCI DSS) as part of our cybersecurity risk management program.


text: We place a high priority on cybersecurity within our organization. This includes regular cybersecurity training for employees, focusing on relevant risks to their job duties (e.g., social engineering, ransomware, denial of service, and other risks). As part of our cybersecurity risk management program, we conduct internal tests to identify potential vulnerabilities. Additionally, we organize annual tabletop exercises led by third-party consultants to enhance our readiness for different scenarios, assess our core information systems and cybersecurity practices, improve decision-making and prioritization, and promote monitoring and reporting across business functions.


text: We regularly engage third parties to perform cybersecurity audits to identify opportunities and enhancements to strengthen our policies and practices. We also annually engage an independent third party to perform internal and external penetration testing of our systems.


text: As part of our overall cybersecurity risk management program, the Company maintains cyber insurance coverage, and we periodically meet with our insurer to discuss emerging trends in cybersecurity. While we believe our cyber insurance coverage provides commercially reasonable levels of coverage, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: With respect to third-party service providers, our cybersecurity risk management program includes conducting due diligence of relevant service providers' information security programs prior to onboarding, reassessing vendors using a risk-based approach, and performing off-boarding activities as relevant. We also customarily require our financially significant third-party service providers and those third parties with access to sensitive data to promptly notify us of any actual or suspected breach impacting our data or operations. Additionally, we perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers.


text: We continuously monitor cybersecurity risks and adjust our cybersecurity risk management program and practices as needed. As part of our program, we occasionally identify risks or threats to our systems, including ransomware and attempts to obtain team member credentials through both phishing attacks or social engineering. While these risks and threats require active and ongoing efforts to mitigate, we have not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our operations, business strategy, or financial condition.


text: Our Chief Information Officer ("CIO") is directly responsible for the implementation of our cybersecurity risk management program, and our Senior Director of Information Security reports directly to the CIO. Our CIO is additionally primarily responsible for our overall information security, strategy, policy, security engineering, architecture, operations and cybersecurity threat detection and the management of cybersecurity risk. Our CIO has over 30 years of experience in the fields of finance, technology and cybersecurity, including relevant prior senior leadership positions held with Marriott International, where he served as Global Chief Information Officer. The CIO meets with our Chief Executive Officer ("CEO") on a weekly basis and regularly reports to our senior management, as well as directly to our Board of Directors and the Audit Committee, regarding our cybersecurity risk and risk management.


text: As a part of our cybersecurity risk management program, our cybersecurity team meets regularly to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. In the event of a cybersecurity incident, we have a Cyber Incident Response Plan ("CIRP") that governs our immediate response, including detection, escalation, assessment, management, and remediation. As part of the CIRP response, the cybersecurity team will coordinate with external advisors and other senior management as needed. The cybersecurity team routinely tests the CIRP across the organization to validate the procedures for appropriately escalating potentially material cybersecurity risks and incidents.


text: In the event of a cybersecurity incident, senior management, including our General Counsel, CIO, and Chief Financial Officer ("CFO"), are tasked with assessing the incident. This assessment involves evaluating relevant quantitative and qualitative factors as well as considering SEC guidance. Depending on the assessment results, the cybersecurity event may be escalated to involve our CEO, Board of Directors, and law enforcement. Additionally, the Board of Directors in consultation with senior management will decide, based on the assessment, whether the cybersecurity incident requires disclosure in a filing with the SEC.


text: Board of Directors Oversight Our board of directors, as a whole and through its committees, holds oversight responsibility for our risk management processes, including risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risk. The audit committee is comprised of board members with diverse expertise including risk management and technology, which we believe enables the board to oversee cybersecurity risks.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: Management's Role Our management is responsible for day-to-day administration and management of our cybersecurity program and for informing the audit committee of cybersecurity risks. We may also work with external security service providers to support our security monitoring and threat detection capabilities. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our information technology team overseen by the Executive Chairman. With over twenty-five years of technology development experience in the financial services industry, our Executive Chairman is familiar with our technology infrastructure and risk profile. Our information technology team tests our infrastructure for known cybersecurity risks and leads our employee training program on matters related to cybersecurity. The Executive Chairman and information technology team seek to implement and oversee processes for monitoring our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. If a potential breach is identified, it is raised to the attention of senior management to help mitigate any further vulnerabilities.


text: Cybersecurity Risk Management and Strategy The goal of our cybersecurity program is to establish processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, if needed, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct security testing and have established a vulnerability detection process, supported by security testing, that is designed to address the treatment of identified security risks based on severity. Our risk assessments include, but are not limited to: Interfaces Storage security Applications Hardware security Remote access security IT architecture Information flow Risks from Cybersecurity Threats Some potential cybersecurity threats include, but are not limited to:


text: Human errors or sabotage: Company employees or a third-party having access to the system could cause errors or allow for sabotage that may cause company losses. Our procedures seek to identify the risks that can be caused by human error or intent and includes processes to mitigate with a particular focus on training employees to avoid human errors.


text: Data leaks: Data leaks could result in a breach of our privacy policies for customers sensitive data, resulting in potential regulatory violations or commercial litigation. Our processes aim to restrict access and monitor for leaks of internal and/or external data.


text: Unauthorized access: Unauthorized access could be due to password theft, malware attacks, employee involvement, or hackers. Preventing unauthorized access is a top priority within our cybersecurity protocols.


text: Natural or man-made disasters: Data can be threatened by natural or human disasters. Lightning strikes, fire, floods, hurricanes, bombings, etc. Without proper data backup, all company data could be compromised in one incident. Backups, co-location of servers and data is regularly monitored and adjusted as needed with a goal of insulating the Company from this type of risk.


text: Failed system: Our cybersecurity policies contemplate enterprise system failures due to cyber-attacks, network connections, hardware challenges, bottleneck problems and other issues. We seek to mitigate these potential vulnerabilities through monitoring and redundancy.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see " Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, services, and data " in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company has cybersecurity risk management processes in place intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. Our cybersecurity risk management is integrated into the Company's enterprise risk management strategy. Our information technology security team works in partnership with internal auditors and external consultants in the identification, evaluation, and management of cybersecurity risks. We also have processes in place designed to evaluate potential risks associated with third-party service providers. Our cybersecurity program is aligned with the National Institute of Standards and Technology Cybersecurity Framework and includes an incident response plan. Additionally, we have business continuity and disaster recovery plans in place to prepare for any potential disruptions. With respect to our employees, we provide training for personnel regarding cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: FERRELLGAS PARTNERS FINANCE CORP


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information on cybersecurity-related risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our executive management team, including our Chief Executive Officer and Chief Financial Officer, works with our information technology security team to assess and manage our overall risk exposure. The Audit Committee of our Board of Directors oversees those efforts and receives reports from the executive management team periodically, as appropriate.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats and have implemented various processes and safeguards to aid in such efforts. Our program encompasses people, processes, and technologies to safeguard our systems, data, and business from cybersecurity threats. Our program prioritizes threat mitigation and risk management, while focusing on maintaining the integrity and resilience of our systems.

companyName: AUTOZONE INC

ticker: AZO


text: Our program is informed by industry standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), the American National Standards Institute encryption standards and the Payment Card Industry Data Security Standard, among others. As part of our cybersecurity strategy, we regularly engage independent, outside expertise to assess and benchmark our overall program against these industry standards.


text: AutoZone, with the assistance of our managed security service provider, continuously monitors our threat intelligence and events within our digital environments. We employ a variety of methods designed to test and improve our controls, including vulnerability scanning, penetration testing, and attack simulation testing. We have an incident response plan which sets forth procedures to investigate, respond to, contain, and remediate incidents with the support of a cross-functional team. The incident response plan also outlines a process for escalating and communicating incidents to members of management.


text: During the contract review and vendor engagement process, we assess vendors' adherence to appropriate security practices, requirements, and expectations, including compliance with industry standards and applicable laws and regulations. We also engage a third-party to monitor certain service providers so that we may be alerted of important events that would impact such party's risk profile. We have an Information Security Awareness program which seeks to educate our employees on security risks and best practices through training, internal communications, and security awareness campaigns. We maintain cybersecurity insurance coverage that may protect us from losses in connection with certain cybersecurity incidents.


text: Cybersecurity Risks While we have not experienced a material breach of our information systems or data to date, unauthorized parties have in the past gained access and exfiltrated data. Any future incident could significantly disrupt our operations and key business processes, result in the impairment, loss, unauthorized access of critical or sensitive data, be costly and resource-intensive to remedy; harm our reputation and relationship with customers, AutoZoners, vendors and other stakeholders; and have a material adverse impact on our business and operating results. See "Information Technology, Cybersecurity and Data Privacy Risks" in Item 1.A., Risk Factors for additional information related to cybersecurity risks.


text: The cybersecurity risk management program is integrated into our broader enterprise risk management framework, which allows our senior management team, with oversight from our Board, to develop a more holistic view of our risk exposure and prioritize and manage such risks accordingly.


text: AutoZone's Chief Information Security Officer ( CISO) reports directly to our Chief Information Officer and Senior Vice President of Information Technology. Our CISO has over 25 years' experience in IT, with over 20 years in dedicated Information Security leadership roles. He has experience across a broad range of industries and holds credentials including the Certified Information Systems Security Professional and the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: The Audit Committee is responsible for overseeing the Company's enterprise risk management program, including cybersecurity risks. At its quarterly committee meetings, the Audit Committee reviews and discusses cybersecurity matters directly with our CISO, including relevant cybersecurity risks, changes to AutoZone's threat landscape, risk mitigation strategies, cybersecurity program assessments and results, and cybersecurity roadmap and progress.


text: Risk Management and Strategy In the ordinary course of our business, the Company is subject to cybersecurity threats and risks which it manages as an important component of its overall enterprise risk management strategy. To identify, assess, and manage cybersecurity threats and risks to our business, the Company has made significant investments in its processes, control environment, and technology solutions to help prevent and mitigate the impact of any such threats and risks. These processes include the use of sophisticated third-party software for continuous monitoring, the use of expert outside consultants, ongoing training and educational programs, regular and periodic updates on new cybersecurity threats and risks, incident response procedures, and the implementation of other cybersecurity best practices wherever possible. These processes also cover risks from cybersecurity threats associated with our use of information technology systems of third-parties upon which we rely.

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: The day-to-day management of the Company's cybersecurity framework is managed by the Company's information technology team while operational oversight of its design and function are managed by the Company's management team including, but not limited to, its Chief Operating Officer (COO), Chief Financial Officer (CFO), Vice President Implementation and Launch, and Director of Information Technology, all of whom have substantial experience managing enterprise risk, including cybersecurity risks. Our management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our incident response procedures.


text: The Company's Board of Directors, working in conjunction with its Audit and Corporate Governance Committees, oversees the Company's overall enterprise risk management program, including the evaluation of cybersecurity related risks. Our Board receives periodic updates from the Company's management team regarding technology matters including its cybersecurity framework, and the notification of any material cybersecurity events and/or risks.


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not impact the Company's business in a material manner. At the effective date of this report filing, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on risks related to the Company's information technology systems, including cybersecurity threats that may materially affect the Company's business, see the risk factors included under Item 1A of this Annual Report on Form 10-K ("We Rely Heavily on Information Technology Systems to Operate Our Business and Any Disruptions to or Data Breach of These Technology Systems or if These Systems were Made Unavailable for Use, May Have a Material Adverse Effect on Our Business").


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy and processes are designed to identify, assess, and manage risks to the confidentiality, integrity, and availability of our information technology environment, systems, and information. The cybersecurity risk management process is managed centrally and is led by our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer. Our cybersecurity program takes a risk-based approach and is integrated with our global enterprise risk management program. Our cybersecurity risk strategy is aligned with cyber/information security frameworks and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: TE Connectivity plc

ticker: TEL


text: Our cybersecurity program includes the following risk management practices: a formal cybersecurity risk assessment is performed annually in collaboration with our enterprise risk management function, resulting in updates to plans and actions that are incorporated into improvement projects;


text: our cybersecurity program maturity is benchmarked annually against global industry standards and norms. The result serves as a guide to identifying evolving risks, prioritizing improvements, and enhancing the program;


text: cybersecurity threats are evaluated throughout the year by our around-the-clock security operations center, utilizing a variety of third-party subscription and threat intelligence data sources, and data collected via internal monitoring and scanning processes;


text: annual security awareness trainings are required to be completed by employees, and monthly phishing campaigns and additional function-specific cybersecurity trainings are also conducted; security and risk metrics are reviewed monthly and reported to leadership regularly; external penetration tests are conducted annually by independent third parties and appropriate actions are taken to strengthen controls;


text: a cybersecurity incident response plan and governance charter are maintained by the cybersecurity incident response team. The cybersecurity incident response plan and supporting playbooks are utilized during table-top exercises and trainings. Participants may include information technology, business, corporate function, and external resources depending on the table-top scenario; and third-party supplier security reviews are conducted based on risk. Reviews may include the assessment of security architecture, connections between our systems and the third party, data security controls, and user access controls.


text: To date, we do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, the sophistication of cybersecurity threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity incidents and protect our systems and information may not successfully protect against future cybersecurity incidents, which could materially affect our business strategy, results of operations, or financial condition. For additional information on certain risks associated with cybersecurity, refer to the risk factors related to cybersecurity and information technology systems in "Part I, Item 1A. Risk Factors."


text: Cybersecurity Program Governance Our cybersecurity program is governed by the information security committee ("ISC"), composed of our leaders from information technology, enterprise risk, legal, compliance, strategy, human resources, finance, internal audit, and various business units. On a quarterly basis, the CISO reports to the ISC on topics such as risk mitigation project status, audit results, security metrics, cyber incidents investigated and impact, if any, and significant changes that contribute toward protecting the enterprise from cybersecurity threats.


text: Our CISO has over 20 years of experience in information security leadership roles and over 9 years as our CISO. He holds many industry certifications, including Certified Information Systems Security Professional ("CISSP"), and is an active member in professional organizations. Also, certain members of our board of directors have completed cybersecurity program trainings, or have relevant industry experience.


text: Cybersecurity incidents are evaluated by a cross-functional team based on defined criteria and regularly communicated to leadership pursuant to criteria set forth in our incident response plan and related processes. We have engaged cybersecurity and information technology third-party consultants to assist in cybersecurity incident response including forensics and technical analysis.


text: The cybersecurity committee of our board of directors has oversight responsibility for cybersecurity risks. The CISO provides updates at least twice a year to the cybersecurity committee regarding matters related to information technology and cybersecurity risks including the state of our cybersecurity programs, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risk. Additionally, the full board of directors receives updates on cybersecurity risks twice a year as part of the enterprise risk management meetings.


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: PURE CYCLE CORP

ticker: PCYO


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had a material cybersecurity incidents in fiscal 2025 or 2026 through the date of filing of this Form 10-K.


text: Cybersecurity Risk Management and Strategy Our cybersecurity policies and processes are fully integrated into our Risk Management procedures and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is reinforced with our employees through education and periodic testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. Management also periodically briefs the Board of Directors on our strategy and roadmap in alignment with the NIST Cybersecurity Framework and we plan to continue providing the Board with regular updates regarding cybersecurity risks, threat landscape and overall program progress.

companyName: EACO CORP

ticker: EACO


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business, including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Part I, Item 1A. " Risk Factors," of this Annual Report.


text: Education and Awareness We provide required security awareness education and training to our employees and contractors with system access that focuses on various aspects of the cybersecurity world. Users of our internal systems are required to complete an annual cybersecurity awareness training and are tested for awareness on a regular basis. We also provide tailored training courses to functional technology employees and employees who process personal or sensitive information.


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors 24/7 to monitor and respond to security threats. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, our cybersecurity program is led by the Director of Information Technology (" Director of IT "), who reports to the President and COO. Our Director of IT has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint and attends training in cybersecurity and risk mitigation.


text: We provide our Board of Directors with a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the President also will report to the Board of Directors on various metrics on threat management, incident response and recovery planning, along with industry benchmarks.


text: We are a smaller reporting company. While management monitors our exposure to cybersecurity risk, as a whole, CONX Corp. has not adopted specific processes for assessing and managing such risk. The audit committee is responsible to discuss with management any significant risks or exposures, and as necessary report such risks or exposures to our board of directors. While to date we have not encountered any cybersecurity incidents, any sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure could lead to corruption or misappropriation of proprietary information and sensitive or confidential data.

companyName: CONX Corp.


text: RED Technologies has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of RED Technologies' critical systems and information. RED Technologies' cybersecurity risk management program includes a cybersecurity incident response plan. RED Technologies designs and assesses its program based on ISO 27002 standards. This does not imply that RED Technologies meets any particular technical standards, specifications, or requirements, only that it uses the ISO 27002 as a guide to help it identify, assess, and manage cybersecurity risks relevant to its business. RED Technologies uses established processes designed to identify, assess, and manage third-party service provider risks when third parties handle, possess, process, and store RED Technologies' material information. RED Technologies' cybersecurity risk management program includes (i) a policy designed to help identify material cybersecurity risks to its critical systems, information, products, services, and its broader enterprise information technology environment and (ii) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. RED Technologies has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect RED Technologies, including its operations, business strategy, results of operations, or financial condition. However, there can be no assurance that RED Technologies' cybersecurity prevention and mitigation efforts will always be successful, and it is possible that cybersecurity threats could have a material adverse effect on our business, operations, or financial condition in the future.


text: As a smaller reporting company with cybersecurity processes centered on RED Technologies, we may not be sufficiently protected against such occurrences. See Item 1A. Risk Factors, " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss " of this Annual Report for a discussion of cybersecurity-related risks.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology (NIST) Cybersecurity framework and the Cybersecurity Maturity Model Certification (CMMC) program to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. In the event of an incident, we intend to follow our detailed incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with NIST and CMMC standards and industry best practices.


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors."


text: Cybersecurity Governance Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Senior Director of IT who has over 25 years of experience as an IT professional engaged in network cybersecurity. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.


text: Annual risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. Management regularly provides data protection and cybersecurity reports to the Audit Committee and the Board of Directors, which includes updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company in which cybersecurity is a critical component. Our Chief Information Officer and Information Security Officer are primarily responsible for the cybersecurity program. The Chief Information Officer reports directly to the CEO and the Information Security Officer reports directly to the Chief Risk Officer to maintain independence. Our Information Security Officer provides periodic reports to the Board Audit Committee, the Enterprise Risk Management Committee, Operational Risk Committee and Information Security Committee regarding the Cybersecurity/Information Security Program.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: We engage in regular monitoring and assessments of our technology infrastructure utilizing our internal staff and third-party specialist. Our independent auditors periodically review our processes, systems and controls related to our information security program to ensure they are operating effectively.


text: Measures Taken to Mitigate Cybersecurity Risks To mitigate the risk of cyber threats, we have implemented a comprehensive set of technical, organizational, and procedural safeguards that are designed utilizing the Cybersecurity Framework of the National Institute and Standards and Technology (U.S. Department of Commerce), industry standards and regulatory guidance that include the following:


text: Governance and Oversight: A dedicated Information Security Committee oversees our cybersecurity strategy, with executive leadership providing strategic direction. The Information Security Committee reports up to our Operational Risk Committee comprised of Executive Management and subsequently reports up to the Board Audit Committee.


text: Data Protection: We utilize advanced encryption and access controls to protect sensitive data both in transit and at rest. Regular audits are conducted to identify and address any vulnerabilities in our data storage and transmission practices.