text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of company information, and data entrusted to us by our customers. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical controls designed to protect the security and privacy of confidential, personal, and proprietary information. We conduct regular assessments, measuring our exposure to cyber threats. These assessments form the basis for our cyber risk program. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. Our Chief Information Security Officer ("CISO") is responsible for overseeing and implementing our cybersecurity program and enforcing our cybersecurity policy. We employ internal dedicated security personnel and also have contracted services delivered from a full-service Managed Security Service Provider. Our Chief Technology Officer ("CTO) oversees our day-to-day security operations, and our Chief Information Officer ("CIO") oversees our secure development activities.

companyName: CORVEL CORP

ticker: CRVL


text: Our CISO leads our enterprise information security, privacy, and cybersecurity program, which is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our partners or our customers. We have implemented an industry adopted cybersecurity framework, which is continuously improving. We continuously test and assess our cybersecurity posture, including through third-party risk assessments performed by reputable assessors, consultants, and auditors. Additionally, we perform an annual evaluation of our cybersecurity program.

secItem: Item 1C


text: Cybersecurity Governance As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer, is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our Chief Execuctive Officer, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated governance of cybersecurity and other technology risks to the Audit Committee (the Committee). Our executive management is ultimately responsible for assessing and managing risks from cybersecurity threats we face, and in this regard works closely with the Chief Information Security Officer (CISO) who reports to our Chief Corporate Officer. The Committee oversees management's design and implementation of our cybersecurity risk management program and receives periodic reports, at least semi-annually, from the CISO on cybersecurity risks, the threat landscape, and our cybersecurity planning roadmap. In addition, the CISO updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as other relevant incidents and potential or mitigated threats. The Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, and may request the CISO brief the Board of Directors on the status of cybersecurity and risk management programs, as well as relevant incidents and threats. Board members also receive periodic presentations on key cybersecurity topics from the CISO.

companyName: VIASAT INC

ticker: VSAT


text: Our operational cybersecurity team is led by the CISO. The CISO has 31 years of experience in Information Technology and Security, with extensive experience designing, operating and protecting satellite and terrestrial telecommunications networks. The CISO also leads Viasat's engagement with the private sector and government security communities, which includes facilitating active information sharing with these partners. As part of the acquisition and continuing integration of Inmarsat, the legacy Inmarsat cybersecurity team joined the Viasat Security Engineering organization. The engineering and operational cybersecurity teams of both legacy organizations jointly participate in local and national cybersecurity organizations, teach classes on cybersecurity, maintain numerous relevant certifications, and participate in training relevant to their field of expertise.


text: The cybersecurity risk management program at Viasat is centered around an internally developed set of security principles and requirements, known as the "Foundational Security Principles". The Foundational Security Principles, which we seek to apply across our products and services to promote security resiliency and repeatability, represents a minimum baseline of information security requirements. These principles have a focus on secure-by-design approaches for new products and services, and provide the basis for risk-informed control implementations for legacy networks and systems. Our Foundational Security Principals are designed with reference to the current published version of industry frameworks including, but not limited to, NIST Cybersecurity Framework, International Standards Organization (ISO) 27001, Payment Card Industry (PCI) Data Security Standard (DSS), National Institute of Standards and Technology (NIST) 800-171, and tailored baselines of NIST 800-53. This does not imply that we have implemented each, or any specific, technical standard, specification or configuration embedded in these frameworks but rather that they collectively inform and guide our identification, assessment and management of cybersecurity risks relevant to our businesses. Certain IT environments with higher risk or contractual, regulatory or customer requirements, or those environments where processing or storing sensitive types of information are required, are designed to comply with stricter sets of security requirements or security control frameworks.


text: Integration efforts continue between legacy Viasat and Inmarsat's cybersecurity departments. Viasat is actively merging policies, processes, and operations security practices and operational footprints ensuring we have appropriate security tools and solutions that align with our business objectives and security requirements. The combined Viasat and Inmarsat cybersecurity organizations report to Viasat's CISO and remain focused on the overall Viasat and Inmarsat satellite service network and corporate integration activities.


text: The cybersecurity team also closely collaborates with our physical security team on planning, risk assessment, and incident response where appropriate, as well as developing and delivering a joint annual security training and education program that engages our employees, appropriate partners and third parties in a security training program that incorporates both cybersecurity and physical security elements. Additionally, our annual security training program supports additional focused security training for personnel handling certain sensitive information such as payment card information (PCI), controlled unclassified information (CUI), or personally identifiable information (PII).


text: To better understand Viasat's threat landscape we partner with multiple U.S. government agencies to acquire and share cybersecurity threat intelligence related to threats, vulnerabilities, indicators of compromise, and current, relevant threat information that are expected as a cleared defense contractor and active Defense Industrial Base (DIB) member. Partner entities include the Defense Cyber Crime Center (DC3), Defense Cybersecurity Information Sharing Environment (DCISE), DCMA, National Security Agency Cybersecurity Collaboration Center (NSA CCC), and Defense Counterintelligence and Security Agency (DCSA). Viasat is also an active participant in several Information Sharing and Analysis Centers (ISACs), including the National Defense (ND-ISAC), Aviation (A-ISAC), and Space (Space ISAC).


text: During fiscal year 2025, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our Reputation and Business Could Be Materially Harmed as a Result of Data Breaches, Data Theft, Unauthorized Access or Hacking" in Part I, Item 1A of this report.


text: Governance: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, our Chief Technology Officer, and other members of management.

companyName: Champion Homes, Inc.

ticker: SKY


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. In addition, we regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Audit Committee receives regular presentations and reports from our Chief Technology Officer on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Audit Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the risk assessment process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: The Chief Technology Officer, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.


text: Cybersecurity Risk Management and Strategy As is the case for all companies in our industry or with a significant digital presence, we are periodically subject to cyberattacks and other cyber incidents and, therefore, cybersecurity is an integral component of our overall enterprise information security program. We have adopted a multi-layered framework to secure our networks, systems, devices, products and services while also assessing, identifying, and managing cybersecurity risks. That framework is designed to help protect our information assets, operations, and resources from internal and external cyber threats by understanding and seeking to mitigate risks while ensuring business resiliency from unauthorized access or attack. Our cybersecurity policies, standards, and procedures include security risk assessments for high priority systems, third party compliance assessments for external vendors and suppliers, and incident management and breach response plans which are influenced by, and periodically assessed against, recognized cybersecurity frameworks. Our incident management policy is designed to help prevent, manage, and coordinate our response to, and recovery from, potential and confirmed cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as comply with applicable legal obligations. Informa PLC's chief information security officer ("CISO") and Security team have implemented a similar framework and we collaborate on best practices, improvements, and risk assessments. Some Informa TechTarget systems are currently managed within the Informa PLC environments and overseen by the Informa PLC framework. The teams collaborate regularly and share any relevant findings.

companyName: TechTarget, Inc.

ticker: TTGT


text: We seek to enhance our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. For example, we conduct regular risk assessments at planned intervals for high priority systems and/or applications to identify and analyze threats and vulnerabilities, identify controls, identify risk ratings and likelihood and level of potential impact, and provide recommendations for risk reduction, mitigation, acceptance, and avoidance. As part of our overall risk mitigation strategy, we also maintain cyber liability insurance coverage.


text: Based on an assessment using the previously described enterprise information security program, we do not believe that there are any risks from known cybersecurity threats, including as a result of any prior security incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled " The loss of personal, confidential, and/or proprietary information due to our cybersecurity systems or the systems of our customers, vendors, or partners being breached could cause us to incur significant legal and financial exposure and liability, and materially adversely affect our business, operating results and reputation," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We have a Privacy and Security Executive Taskforce ("Taskforce") consisting of executive-level leaders that meets periodically to, among other things, review global trends in privacy, security, and compliance, identify key projects and resource needs, and review operational privacy and security statistics and metrics. Additionally, our Chief Technology Officer ("CTO") is a member of the Taskforce and manages and oversees a team (the "IT Security Team") that is responsible for leading company-wide cybersecurity efforts. The IT Security Team works with various business units and departments, including legal, product development, and operations, to help set standards, policies, and processes. The IT Security Team also collaborates closely with the CISO of Informa and his team to, among other things, align strategy, assessments, and tooling. Our CTO along with key members of his IT Security Team have worked in the information security field for many years and are actively involved in our cybersecurity efforts. We also periodically perform tests on aspects of the operations of our cybersecurity program and the supporting control framework and report the results of these audits in reports to our Audit Committee.


text: Risk Management & Strategy. AVD has adopted a comprehensive set of controls and processes to encourage a high level of awareness of, and responsiveness to, cybersecurity threats. The foundational document outlining the program is embodied in Registrant's Enterprise Information Security Policy (the "REIS Policy"). The REIS Policy establishes a framework for the continuous monitoring of its computing resources, the maintenance and reporting of audit logs and the assessment of events that could form the basis of a threat. In addition, the REIS Policy sets forth requirements for employee awareness training, user authentication, software usage restrictions and boundary protection, among other things. The policy also establishes an incident response plan, including back-up hosting, alternate processing and system recovery, along with assignment of responsibility and resources for those activities. Within the exhibit of the REIS Policy, management either working alone or, in case of greater complexity, with consultants, will assess an incident or series of incidents for materiality, taking into account the nature of the incident, duration, the nature of data compromised, and the nature of damages (including with respect to reputational, third party, share price, and business interruption) and all within the context of the Company's financial performance during the affected reporting period(s).

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: A VD's Board of Directors maintains oversight of cybersecurity planning, response and reporting as follows. The Lead Director, Scott Baskin, who also serves as Chair of the Risk Committee and member of the Audit Committee, is Cybersecurity Liaison to AVD's management team. The Chair of the CPRSC reports on cybersecurity preparedness, issues and incidents to the Cybersecurity Liaison regularly. Through this reporting structure, the cybersecurity team has direct interaction with the highest level of the Board and with both the Risk and Audit Committees. Cyber risk has been a subject of regular review and discussion at the Risk Committee for several years. With the advent of the CPRSC, the delineation of governance and responsibility has become that much more focused.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner. • Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security includes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party breach response process through our insurer's cyber panel, which includes access to a breach coach and forensic experts under a tripartite agreement to ensure coordinated response and maintain privilege; security playbooks setting forth a tactical guide to respond to cybersecurity events and threats as they occur; and recovery procedures. We have also implemented various technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Canopy Growth Corp

ticker: CGC


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are published in monthly cybersecurity dashboards that are shared with our CFO. Based on the monthly reports, the CFO, with support from the VP of Information Technology, evaluates and provides a summary report to the Audit Committee on an annual basis. We review and train our employees on our cybersecurity policies, standards, processes, and practices annually or more frequently depending on needs identified within the monthly cybersecurity dashboards.


text: The VP of Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: The VP of Information Technology has been with our Company for over six years, previously serving as Director and subsequently Senior Director of Global IT Engineering. Prior to joining our organization, he was the Founder, President, and CEO of RjR Innovations, a recognized North American leader in IT Service Management. Over the course of his 27-year career within the Information Technology industry, he has established himself as a subject matter expert and thought leader, having served as both an ITIL Best Practice Conference and Keynote Speaker at various industry events. Supporting the VP of Information Technology is the Director of Cybersecurity & IT Engineering, a seasoned IT professional with more than 25 years of comprehensive experience spanning infrastructure, cybersecurity, architecture, and operations. He has been with our Company for over five years, during which he has held key roles including Senior Solutions Architect, Global IT Engineering and Network Engineer, Global IT Operations. He has also successfully completed advanced executive programs in cybersecurity leadership, including CISO and CISM certifications.


text: Although our third-party service providers have experienced cybersecurity incidents, which have resulted in minor adverse impacts to our business, we have not experienced material losses or other material consequences related to cybersecurity incidents experienced by us or our third-party service providers. We expect to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the continuously evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party service providers, will not have a material adverse effect on our business, results of operations and financial condition. Further discussion of how TMCC's business, results of operations and financial condition may be materially adversely affected by risk from cybersecurity threats is contained in Item 1A. Risk Factors, Regulatory, Legal and Other Risks, "A security breach or a cyber-attack could adversely affect our business, results of operations and financial condition."

companyName: TOYOTA MOTOR CREDIT CORP


text: We believe cybersecurity is critical to advancing our technological advancements. As a pharmaceutical and biotechnology services company, we face a multitude of cybersecurity threats that include attacks common in most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: Additionally, we must also comply with extensive regulations, including requirements imposed by the FDA related to adequately safeguarding patient information. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management procedures ("CRMP") intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our CRMP consists of procedures designed for Graham Corporation and certain subsidiaries and separate procedures designed specifically for BN. Our CRMP includes cybersecurity incident response plans ("IRPs") for Graham Corporation and BN. The purpose of the IRPs are to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: GRAHAM CORP

ticker: GHM


text: O ur CRMP is integrated into our overall enterprise risk management program. We have designated our Senior IT Manager to oversee the implementation and maintenance of the IRP for Graham Corporation. For BN, we have designated BN's IT Manager to implement and maintain the IRP for BN. Our IT personnel at Graham Corporation and BN have over 50 years of combined experience in the field of cybersecurity and are responsible for the management of our cybersecurity and data privacy programs. Among other information security duties, the Senior IT Manager and IT Manager are responsible for the following for Graham Corporation and BN, respectively: • implementing the IRP; • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; and • periodically reviewing the IRP whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.


text: We are currently in the process of integrating P3 into our CRMP and IRPs processes for BN. We expect such integration to be completed during fiscal 2026.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company follows an incident escalation process that is incorporated into its incident and risk management processes. In the event the Company identifies a cybersecurity incident, its senior management, consisting of the Chief Financial Officer, Chief Information Security Officer (CISO), Chief Administrative Officer, and Executive Vice President of Business Technology and Operations review the facts and circumstances involved in such cybersecurity incident, or series of related cybersecurity incidents.

companyName: NetApp, Inc.

ticker: NTAP


text: The Company partners with third parties to assess the effectiveness of its cybersecurity prevention and response systems and processes, including third-party review of the Company's Information Security Management System for ISO 27001 controls, assessment of the Company's cloud products and managed services according to the American Institute of CPAs (AICPA) Service Organization Control (SOC) Audit Type II, and new product validation as part of the Company's secure development lifecycle. The Company additionally engage s third-party providers in support of endpoint detection and responses, data loss prevention efforts, and incident management efforts.


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of cybersecurity risks and potential related impacts on the Company, refer to the risk factors in Part I, Item 1A. "Risk Factors," including "If a material cybersecurity or other security breach impacts our services, systems, supply chain, or end-user customer systems, or if stored data is improperly accessed, our business could suffer significant harm."


text: NetApp's Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframes. The Company's CISO regularly updates each of the Board of Directors and the Audit Committee at least twice a year. Such updates include a review of cybersecurity risks affecting the Company, related metrics, and any incidents or issues that require attention from the Board of Directors.


text: The CISO provides leadership, strategic direction, and oversight for NetApp's Global Security Risk and Compliance functions and security program. Global Security executives oversee management of risks and track projects progress, remediations, and any issues related to cybersecurity risks.


text: NetApp's CISO is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 30 years of experience in IT and information security, including over 16 years with NetApp in roles of increasing seniority, and is a Certified Information Security Auditor, Certified Information Security Manager with ISACA and a Certified Information Systems Security Professional with ISC2. The CISO stays informed on information security risks through regular meetings on key cybersecurity projects and KPIs. Updates are communicated to the Global Security Steering Committee, which provides quarterly reports to the Board of Directors and to the Audit Committee.


text: Risk Management and Strategy As a publicly traded e-commerce outdoor company, we are acutely aware of the importance of robust cybersecurity measures in safeguarding our information assets, operational integrity, and reputation. Our approach to cybersecurity risk management is integrated into our broader risk management framework and overseen by our Board of Directors.

companyName: Outdoor Holding Co

ticker: POWW


text: We have established comprehensive processes to assess, identify, and manage material risks from cybersecurity threats. These processes include continuous evaluation of potential threats, regular security assessments of third-party service providers, and stringent monitoring procedures to mitigate risks related to data breaches and other security incidents. We periodically engage third-party consultants, legal advisors, and audit firms to evaluate and assess our risk management systems and to assist in the remediation of potential cybersecurity incidents, as necessary.


text: Our Information Security Program (the "Program") is designed to protect personal and proprietary information in compliance with federal and state requirements. The Program aims to: • ensure the security and confidentiality of employee and customer personal information, as well as Company proprietary information; • protect against anticipated threats or hazards to the security or integrity of such information; and • prevent unauthorized access to, use of, or transfer of such information, thereby protecting the Company, its employees, and customers from potential harm or inconvenience.


text: We use a variety of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises, to enhance our cybersecurity posture. Our incident response plan is comprehensive, detailing procedures for preparing for, detecting, responding to, and recovering from cybersecurity incidents. This plan includes processes for triaging, assessing the severity of, escalating, containing, investigating, and remediating cybersecurity incidents, while ensuring compliance with relevant legal obligations. In addition to internal measures, we manage cybersecurity risks associated with third-party suppliers, particularly those with access to our systems or confidential data. We perform due diligence on critical third-party suppliers and monitor identified cybersecurity threats. We require these suppliers to contractually agree to manage their cybersecurity risks according to our standards or to submit to cybersecurity audits conducted by our agents.


text: We regularly engage third-party experts to conduct information security testing, including penetration testing, on our systems and infrastructure. The Program undergoes periodic external assessments aligned with the National Institute of Standards and Technology Cybersecurity Framework and the Payment Card Industry Data Security Standard. This alignment helps us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Board of Directors oversees our cybersecurity risk management. Directors receive reports as requested from management, including senior IT leadership and third parties, on cybersecurity matters. Additionally, the Board of Directors is kept informed about cybersecurity risks as part of our overall enterprise risk management program and through regular business updates.


text: Senior IT leaders and compliance officer are responsible for developing and implementing appropriate cybersecurity programs and ensuring our compliance with applicable laws and regulations. These leaders, equipped with relevant degrees, certifications, and extensive work experience, are informed by their cybersecurity teams about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity incidents.


text: Information regarding cybersecurity risks is communicated through various channels, including direct discussions between key leaders and Company management, and reports to the Board of Directors and its committees. The Board of Directors regularly receives updates from our compliance officer and senior IT leadership on the status of our cybersecurity measures and any significant developments.


text: Our commitment to cybersecurity is a fundamental aspect of our operational strategy, ensuring the protection of our information assets, the continuity of our operations, and the trust of our stakeholders.


text: We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, adversely affect our operations, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of sales." and "A failure of our information technology systems, or an interruption in their operation due to internal or external factors including cyber-attacks, could have a material adverse effect on our business, financial condition or results of operations." in Item 1A "Risk Factors" of this Annual Report.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management ("ERM") approach, which is subject to oversight by our Board.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a cybersecurity program that endeavors to identify risks, protect assets, detect threats, respond to incidents, and recover from damaging events in a prompt and effective manner with the goal of minimizing business disruptions through effective governance of people, processes, and technologies. • External Collaboration: We collaborate with a third-party service provider to identify, assess, and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations, and sensitive information from cybersecurity threats, including compromises of our information systems and our data's confidentiality, integrity, and availability. These include firewalls, disaster recovery capabilities, malware and ransomware prevention, access controls, and encryption. • Education: We provide monthly training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities, and access of the relevant Company personnel. Our policies require all workers to report any actual or suspected cybersecurity events. • Incident Response Planning: We have established and maintain incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which a material incident would be communicated to executive management, our Board, external regulators, and shareholders. • Governance: Our Board's oversight of cybersecurity risk management is led by the Board's audit committee (the "Audit Committee"), which oversees our ERM program. The Audit Committee reviews cybersecurity threats, risks, and mitigation on at least an annual basis, and such reviews include internal and independent assessments of risks, controls, and overall program effectiveness.


text: Our risk assessment efforts have indicated that we are a potential target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors, including nation-states, organized criminal groups, malicious insiders, and activists. The impacts of attacks, abuse, and misuse of the Company's systems and information include, without limitation, loss of assets, operational disruption, and damage to the Company's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through assessments, and other exercises focused on evaluating the sufficiency and effectiveness of our cybersecurity risk management efforts. If a material weakness in our cybersecurity risk management program is identified, it will be reported to the Audit Committee and the Board, as appropriate, and we will make adjustments to our cybersecurity processes and practices as necessary to eliminate or compensate for that weakness.


text: Our CFO is principally responsible for overseeing our cybersecurity risk management program in partnership with other Company management. We believe our business leaders, including our CFO, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats. Our CFO collaborates with other Company business leaders and our third-party service provider to maintain a program designed to manage our exposure to cybersecurity risks and to respond to cybersecurity incidents promptly.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes, and practices that management implements to operationalize our cybersecurity risk management program. The Audit Committee will promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates. The Audit Committee periodically discusses our approach to cybersecurity risk management with our CFO, who oversees the Company's information systems.


text: We believe that Oracle is a target for computer hackers, cyber threats and other bad actors because our products and services store, retrieve, process and manage large amounts of data, including sensitive data. We and our vendors are regularly subject to attempts by third parties to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures and gain unauthorized access to our or our customers', partners' and suppliers' software, hardware and cloud offerings, networks and systems.

companyName: ORACLE CORP

ticker: ORCL


text: If a large scale cyberattack or other major security incident results in unauthorized access to or modification or exfiltration of a significant amount of our customers' or suppliers' data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we could incur significant expenses and suffer substantial damage to our brand and reputation, and this could result in a material impact on our business. Refer to "Data Privacy, Cybersecurity and Intellectual Property Risks" in Risk Factors included in Item 1A within this Annual Report for additional discussion of the challenges we encounter with respect to cybersecurity risks.


text: During fiscal 2025, Oracle experienced cybersecurity incidents that, to date, have not had a material impact on our business, including our business strategy, results of operations or financial condition.


text: Cybersecurity is an important area of focus for our Board. Our information security risk management program is designed to allow our Board to establish a mutual understanding with management of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board of Directors and its committees. As part of its broader risk oversight activities, the Board oversees risks from cybersecurity risks, both directly and through the Finance and Audit Committee of the Board (the F&A Committee). As reflected in its charter, the F&A Committee assists the Board with the management and assessment of privacy and data security risk and is responsible for reviewing and discussing with management privacy and data security risk exposures, including, among other things, the potential impacts of those exposures on our business, financial results, operations and reputation. The F&A Committee also oversees our internal controls over financial reporting, including with respect to financial reporting-related information systems.


text: As an element of its information security risk management oversight activities, the F&A Committee reviews the results of our incident response control tests, external and internal audits and penetration testing and oversees our vendor risk management program. The F&A Committee also receives quarterly updates regarding cybersecurity matters from senior management. In turn, the F&A Committee reports to the full Board on a quarterly basis regarding the F&A Committee's cybersecurity risk oversight activities. We also have Board members with expansive knowledge and expertise in the area of cybersecurity. In addition to these regularly scheduled updates, our Chief Privacy Officer and Senior Vice President, Cloud Security and Head of Global Information Security may also report to the F&A Committee on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats that have been detected by the information security team.


text: Robert Duhart, Senior Vice President, Cloud Security and Head of Global Information Security is responsible for the day-to-day identification, assessment and management of the information security risks we face. Our Senior Vice President, Cloud Security and Head of Global Information Security has extensive experience in managing cybersecurity and has served in various leadership roles in information technology and cybersecurity at several large public companies, the U.S. Department of Defense and the Federal Bureau of Investigation. Most recently, he served as the Chief Information Security Officer, eCommerce and Deputy Chief Information Security Officer at a major retailer. Our Senior Vice President, Cloud Security and Head of Global Information Security earned a master's degree in technology management from George Mason University – Costello College of Business, and a Chief Information Security Officer Executive Certificate from Carnegie Mellon University – Heinz College of Information Systems and Public Policy.


text: Our Senior Vice President, Cloud Security and Head of Global Information Security is supported by team members who have relevant educational and industry experience. These team members provide regular reports to the Senior Vice President, Cloud Security and Head of Global Information Security and work closely with our Chief Privacy Officer and include personnel dedicated to information security, product security, and physical security. Informed by the processes and practices discussed under "Risk Management and Strategy" above, team members escalate cybersecurity threats and incidents to the Senior Vice President, Cloud Security and Head of Global Information Security who assesses the severity of such threats and incidents for inclusion in quarterly update to the F&A Committee where appropriate. In addition to the ordinary-course Board and F&A Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including cybersecurity risks.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are subject to cybersecurity risks, including risks related to customer, employee, vendor, and other company data" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Management plays an important role in assessing and managing our material risks from cybersecurity threats. Our Chief Information Officer – which is the management position responsible for assessing and managing material risks from cybersecurity threats – is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. He has over a decade of experience leading cybersecurity oversight, and leads other members of our information security team, who have professional cybersecurity experience, training, or certifications.


text: We maintain a cyber incident response plan that is designed to provide a framework that will allow us to respond effectively to a cybersecurity incident. A cyber emergency response team, which includes members of our executive leadership team, manages this plan. This team meets periodically to discuss cybersecurity threat trends and related information. Our incident response processes are designed to escalate certain cybersecurity incidents to our cyber emergency response team and include reporting to the Audit Committee for certain cybersecurity incidents.


text: Risk Management and Strategy We have established processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we use or will use, transmit, receive, and maintain. The processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into the overall risk management system through the use of firewalls, antivirus and malware detection, and other security software. The processes include efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. We have engaged consultants to assist us with risk mitigation and monitoring threats from both inside and outside our network, including risks of cybersecurity threats associated with the use of third-party service providers. We maintain full backups on a regular basis to protect against the loss of critical data.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: We have not experienced any material cybersecurity incidents to date that have materially affected, or that are reasonably likely to materially affect our business, strategy, results of operations or financial condition, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including to our results of operations and financial condition. We rely extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks.


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. The Board's Audit Committee routinely evaluates the Company's cybersecurity through communications with management and the Company's information technology department. Systems are in place to perform ongoing testing to defend and mitigate against unwelcome intrusions and attacks.


text: The interim CEO and CFO communicate with the head of the information technology department daily to monitor any potential or perceived threats to our technology infrastructure. A comprehensive and regularly tested Incident Response Plan (IRP) has been established that outlines specific steps for various types of cyber incidents. There are key performance indicators (KPIs) and metrics used to measure the effectiveness of the cybersecurity program, including processes to keep senior management and the Board's Audit Committee informed. The Company also maintains a cybersecurity insurance policy to provide financial protection in the event of a critical breach.


text: We employ information technology specialists and use external consulting firms to supplement our cybersecurity practices. Both the interim CEO and CFO have experience in managing teams of information technology specialists and assessing cybersecurity threats.


text: Our Board and Audit Committee oversee risks from cybersecurity threats. Our Audit Committee reviews cybersecurity risks on a quarterly basis and our Board periodically reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. Our Board relies on management and its use of the third-party consultants for expertise for assessing and managing our risks from cybersecurity threats. In conjunction with management, our Board considers the nature of the work provided by our operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: ORION ENERGY SYSTEMS, INC.

ticker: OESX


text: The Information Technology Department conducts on-going meetings and reviews with the IT Managed Service Provider to ensure the latest threats and vulnerabilities are addressed. This includes patch management. Quarterly external penetration and vulnerability testing is conducted by a third-party IT audit firm. Business continuity/ disaster recovery testing and incident response plan testing is conducted annually by the Board appointed Disaster Recovery Committee. In addition, the company participates in annual disaster recover exercises with its core IT system provider. The Board appointed Technology Committee provides oversight of policies and receives updates including cybersecurity, systems, IT assets and control policies. The COO is a member of the Technology Committee and the Disaster Recovery Committee and information from committee meetings and testing is reported to the Board.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Risk Management and Strategy We are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our Company's information assets and the personal information of our employees, and other stakeholders.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: We recognize that cybersecurity threats are constantly evolving and have the potential to cause significant harm to our Company and our stakeholders. In order to address these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory requirements.


text: Our program includes regular risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs. We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards.


text: There can be no assurance that our cybersecurity program will prevent all incidents. In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats. We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our Company or our stakeholders.


text: During the fiscal year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company personnel. The Company also utilizes an external agency with long term expertise in cybersecurity. The external agency is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The audit committee will receive periodic reports from our management concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We have established a comprehensive, enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. This program is seamlessly integrated into our overall risk management and internal control systems, subject to regular reviews by senior management.

companyName: Cineverse Corp.

ticker: CNVS


text: By conducting regular risk assessments, we believe we effectively manage both internal and external cybersecurity threats. Our cybersecurity strategy is specifically tailored to our organization's size, scope, and business needs, emphasizing the protection of data. Our security infrastructure includes advanced tools and protocols, such as firewall protections, secure user authentication, and up-to-date antivirus and internet security software, which we believe are fundamental components of our operational protocols designed to mitigate vulnerabilities and efficiently address security incidents. We also periodically assess and manage cybersecurity risks associated with our third-party service providers.


text: The ongoing improvement of our cybersecurity measures is overseen by our Senior Vice President of Corporate Systems. We do not employ or engage any third-parties for cybersecurity consulting or monitoring, aside from technical support teams from our application vendors.


text: In the normal course of business, we proactively manage and monitor cybersecurity activities. To date, these efforts have successfully prevented any incidents that could materially affect our business strategy, operational results, or financial condition. We remain vigilant and are not currently aware of any threats that pose a material risk.


text: We believe our detailed incident response procedures enable us to effectively manage and mitigate the impacts of security breaches. Continuous monitoring and post-incident analysis further refine our security strategies, enhancing our protective measures. Our Board and the Audit Committee provide oversight over our cybersecurity efforts and stay regularly informed on cybersecurity matters, including emerging risks and mitigation strategies, to ensure informed governance over our enterprise risk assessments and cybersecurity approach. Cybersecurity matters are discussed regularly with senior management, and any significant cybersecurity events are promptly reported to the Board.


text: For additional information about cybersecurity risks, see Risk Factors, Any significant disruption in or unauthorized access to our computer systems or those of third-parties that we utilize in our operations, including relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, harm to our reputation, disclosure or destruction of data, or theft of intellectual property, including digital content assets, which could adversely impact our business.


text: Risk management and strategy We depend on information systems and technology in substantially all aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. We have a risk-based cybersecurity program, dedicated to protecting our data and information technology systems. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity. With Board of Directors and Audit Committee oversight, we assess and manage the material risks associated with cybersecurity as part of our risk management process.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks, including cybersecurity. The Board of Directors is responsible for regularly reviewing with management our cybersecurity practices and policies. As part of its oversight role, the Board of Directors receives regular reporting about our strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through quarterly updates from the Chief Information Officer ("CIO") who is also our Chief Information Security Officer ("CISO").


text: Our cybersecurity program and related initiatives are managed by the CIO/CISO, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: Our CIO/CISO, who has more than 25 years of experience in technology and information security risk management across a number of organizations, is responsible for overseeing the risks related to cybersecurity. He is responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing senior leadership with regular updates on cybersecurity-related matters.


text: In the event of a suspected incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the CIO/CISO and functional areas (e.g. legal) as appropriate. The CIO/CISO will make any required communications to the Chief Executive Officer (CEO) and other senior leadership, with the CIO/CISO making any required communications to the Board and Audit Committee. Our CEO, Chief Financial Officer, General Counsel and CIO/CISO are responsible for assessing such incidents for materiality, ensuring that any required notification, disclosure or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: The Vice President of IT is responsible for implementing and maintaining the information security program. The Vice President of IT role is currently held by an individual who has over 20 years of experience in enterprise-level IT operations and management, cybersecurity operations and management and IT/Cyber architecture and strategy. The Vice President of IT reports to our CFO, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our CFO meets with the Audit Committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of risk remediation and ongoing implementation of cybersecurity improvements across our organization.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: The Vice President of IT engages with our managed service providers to proactively address emerging threats based on industry reports and respond to any threats and incidents. Our managed service providers also provide continuous support and coverage of our environment. We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats.


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the Audit Committee of our board of directors' oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The relevant members of management regularly update the Audit Committee with respect to cybersecurity risk, also on an ad-hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee periodically reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: We maintain a program designed to assess and manage the cybersecurity-related risk associated with third-party service providers that we rely on as part of providing solutions to our clients. This program incorporates a risk-based approach based on service criticality and type of information. Vendor risk assessments are performed and documented within our vendor management system. As part of the vendor risk assessment, we conduct an information security program evaluation of critical third-party providers before engagement and, based on our assessment of the vendor's risk, contractually require certain third parties we engage to implement security programs commensurate with their risk profile.

companyName: PAYCHEX INC

ticker: PAYX


text: As of May 31, 2025, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the "Risk Factors" section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.


text: Our management is responsible for implementing our security program, which is overseen by our Security Governance Council (the "SGC") that regularly reports to our Chief Executive Officer and Audit Committee. The SGC is chaired by our CISO and is comprised of senior leaders and key personnel throughout the Company to support cross-functional representation. The members of the SGC are comprised of our executives and managers who understand our business operations, including but not limited to individuals from the following departments: Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management. The SGC meets on a quarterly basis with the mission to develop, coordinate, and sustain the organization's enterprise security program; coordinate and respond to security risks and incidents; and develop, implement, and maintain the organization's enterprise security strategy in alignment with, or in support of, business goals and objectives. The recommendations of the SGC are considered when updating the information security policies, procedures, and standards at Paychex.


text: Our CISO reports to our Vice President of Platform and Technology Services, who has over two decades of technology leadership experience and has earned a relevant degree. Our VP of Platform and Technology Services leads the teams responsible for the Company's core technology platforms. Prior to joining Paychex in October 2012, he held senior technology leadership positions at two telecommunications companies.


text: Cybersecurity Risk Management and Strategy The Company is committed to maintaining a robust cybersecurity risk management program designed to identify, assess, and mitigate cybersecurity risks, including those related to data breaches, phishing, ransomware, insider threats, third-party relationships, software vulnerabilities, regulatory compliance, cloud security, artificial intelligence, and end-user computing. We are constantly evolving our cyber defenses to prevent and minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: We maintain and process a range of sensitive information, including Personally Identifiable Information (PII), Protected Health Information (PHI), financial data, intellectual property, and other regulated or proprietary information. Our cybersecurity management program is designed to protect confidentiality, integrity, and availability of information systems and sensitive data. The program is aligned with cybersecurity frameworks and governance standards such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and NIST SP 800-53, and the International Organization of Standardization (ISO) 27001 information security management system framework as a structured approach to identifying, assessing, and mitigating cyber risk. Our cybersecurity management program includes the following elements: Policies and Procedures: Processes are documented to formalize the implementation of the cybersecurity program.


text: Continuous Monitoring: Use of automated tools and third-party services for real-time threat detection, vulnerability scanning, penetration testing, and incident alerting. Security Incident Response Plan: A formal plan that includes containment, eradication, recovery, and communication protocols.


text: Third-Party Risk Management: We assess the cybersecurity posture of third-party suppliers, vendors, and other partners through due diligence, including assessments at the initiation of the relationship and on an ongoing basis appropriate to the cyber risk. Training and Awareness: All Kestra team members, including senior management, receive mandatory cybersecurity training and periodic phishing simulations. Periodic risk assessment: We periodically re-assess the cybersecurity program for continuous improvement and to account for emerging risks.


text: In the event of a cybersecurity incident, our incident response team refers to the Company's Security Incident Response Plan. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed.


text: All Kestra team members participate in quarterly security awareness training, such as phishing tests as well as mandatory annual Security Awareness and HIPAA Covered Entity training to keep pace with industry standards, evolving challenges, and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the Company. With respect to artificial intelligence, the Company has identified the potential exposure of trade secrets and protected health information to open large language models as a risk, accordingly an Artificial Intelligence Acceptable Use Policy has been implemented, and all Kestra team members have been trained on its requirements.


text: As of the date of this Annual Report, the Company has not experienced any material cybersecurity incidents. Cybersecurity risks that are not currently known to the Company, or that are currently deemed immaterial, could materially affect the Company's business, operations, or financial condition in the future.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Business—Security breaches, loss of data, unauthorized uses or disclosures, and other disruptions involving our systems, products or data could compromise sensitive information related to our business or patients, result in operational disruption, or prevent us from accessing critical information, exposing us to liability, and adversely affecting our business, financial condition, results of operation and prospects."


text: The Company's Chief Information Officer (CIO) has primary responsibility for the Company's cybersecurity program and manages the implementation of the cybersecurity risk management strategy, coordinating efforts across technical and operational functions. Our CIO has over 12 years of experience leading information security functions, including over seven years with the Company in roles of increasing seniority. Cybersecurity oversight is coordinated through the Security Council, which meets regularly and consists of cross-functional leaders. The Security Council is advised by the CIO and the Director of Information Security and Compliance on strategic cybersecurity initiatives, emerging threats, and risk posture. The Security Council formulates our cybersecurity policies and determines the priorities of our risk management plan. The information security team, led by the CIO, executes the plan, uses automated tools, follows procedures to monitor and respond to cyber threats, and subscribes to reports and services to stay current on the threat landscape. In addition to full time staff with cybersecurity responsibilities, we engage qualified third-party partners, including assessors, auditors, consultants and other entities to support our cybersecurity processes for security engineering, security monitoring, incident response, security assessments, and independent audits of cybersecurity controls. Third-party partners work under the direction of the CIO or their designee.


text: The Audit Committee of our Board of Directors is responsible for oversight of the Company's programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee receives regular briefings on cybersecurity matters from the CIO, including updates on material risks, cyber incidents, cyber program maturity, and ongoing improvements. The CIO prepares regular updates on Cybersecurity, which are integrated into the Board of Directors' broader oversight of enterprise risk management, and any material cyber risk is treated as part of overall business and risk management strategy.


text: We use third party vendors to perform ongoing security monitoring, reporting and forensic analysis, including annual external penetration testing. Security standards are established and defined with respect to administrator accounts, backups, encryption, passwords, website certifications, antivirus software, endpoint management, firewalls, wi-fi networks, vulnerability scanning, server protection, patching, privacy by design, and data breach reporting. We perform ongoing employee cybersecurity awareness and training activities, which includes frequent phishing testing, and we maintain cyber insurance coverage.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: We conduct annual internal audits to test compliance with our technology policies, security procedures and controls. Our third-party information technology providers, consultants and vendors are vetted by our information security teams to assess cybersecurity risks and mitigation measures, where applicable.


text: We continue to increase our cybersecurity investments and safeguards designed to detect and prevent cybersecurity incidents. Notwithstanding our increased cybersecurity investments and preparedness activities, threat actors and cybersecurity incidents continue to pose a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property, confidential information and personal data. Cybersecurity incidents are investigated and remediated in accordance with our incident response procedures and other policies and procedures. For more information on how a cybersecurity incident may impact the Company, refer to the risk factor titled "Cybersecurity threats, data privacy compliance, and use of artificial intelligence could have a negative impact on our business," in Item 1A of this Form 10-K.


text: While we have experienced cybersecurity incidents that have disrupted our operations in the past, to date, no cybersecurity incidents have had or are materially likely to have, a material impact on RPM.


text: Cybersecurity is overseen by the Audit Committee of the Board of Directors. The Senior Director - Information Security coordinates with and directs cybersecurity initiatives through information technology and cybersecurity personnel throughout RPM.


text: The Senior Director - Information Security has over 15 years' experience in the information technology and cybersecurity field as well as over 15 years' experience in auditing information security, including previous roles in information security architecture, information technology and information security audit and governance. The Senior Director - Information Security has completed a CISO Academy Workshop, where he gained valuable insights to help improve our cybersecurity posture and program while also better aligning it to our overall business strategy and operating model. He received a BA in math and computer science from Ohio Wesleyan University and holds an Information Systems Auditor certification.


text: The Audit Committee regularly receives information and reports from the Senior Director - Information Security and other executives responsible for identifying and assessing the scope, nature and impact of cybersecurity risks, incidents and mitigation efforts. In addition to the Audit Committee, the full Board of Directors receives reports on the status of our cybersecurity risks, incidents and mitigation efforts either from the Audit Committee or from the Senior Director – Information Security and other executives. We utilize a technology-based reporting system to identify and log data-related events.


text: Cybersecurity incidents are assessed for actual or potential impact on the business and any relevant data subjects. Materiality of cybersecurity incidents is assessed and determined by the Cybersecurity Team, which has been assigned this responsibility by our Disclosure Committee. The Cybersecurity Team consists of the Chief Financial Officer, the General Counsel, the Vice President - Commercial Excellence, the Vice President - Global Systems and the Senior Director - Information Security. The Senior Director - Information Security reports regularly to our Disclosure Committee. In the event a cybersecurity incident is determined to have, or is likely to have, a material impact on the Company, the Chair of the Audit Committee of the Board of Directors is directly notified by the General Counsel in coordination with the Chief Financial Officer and Senior Director - Information Security.


text: As of the date of this Annual Report on Form 10-K, we are no t aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: HeartSciences Inc.

ticker: HSCS


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our Company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and the Board of material cybersecurity threats and incidents. We engage third-party security experts for risk assessment and system enhancements. The Company delivers annual security awareness training to employees, augmented by periodic role-specific modules and recurring phishing simulation exercises to measure user susceptibility and inform further training.

companyName: Worthington Steel, Inc.

ticker: WS


text: The Board has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to the Board.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Management, including the CIO and our Director of Cybersecurity, regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, a third-party risk assessment program, vulnerability management, and on-going cybersecurity projects.


text: Our cybersecurity programs are under the direction of our Vice President and Chief Information Officer ("CIO") who receives regular reports from our Director of Cybersecurity. The Director of Cybersecurity, oversees our dedicated cybersecurity team comprised of 2 Senior Security Engineers and 2 Security Analysts and is augmented by a 24x7 managed security services who actively manage and execute our efforts to prevent, detect, mitigate and remediate cybersecurity incidents. The Director of Cybersecurity has over 15 years of experience in cybersecurity, with demonstrated expertise in incident response, threat detection, vulnerability management, and third-party risk assessments. He holds advanced degrees in IT Project Management and Network Security and maintains industry certifications including CISSP (Certified Information Systems Security Professional) and GCIH (GIAC Certified Incident Handler). The two Senior Security Engineers have 16 and 10 years of experience, respectively. Their areas of specialization include network security architecture, endpoint protection technologies, and operational technology (OT) security integration. Both hold advanced certifications such as CISSP, GRID (GIAC Response and Industrial Defense), and GCIP (GIAC Critical Infrastructure Protection). The two Security Analysts bring 3 and 4 years of experience, respectively. Each holds a bachelor's degree in Computer Science and maintain industry certifications including CompTIA Security+ (SEC+). Their responsibilities include real-time security monitoring, phishing simulation campaigns, and user awareness support. Collectively, the cybersecurity team brings 48 years of combined experience and is actively engaged in ongoing professional development to remain current with emerging cyber threats, technologies, and regulatory requirements.


text: In fiscal 2025, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, see "Risk Factors – Risks Related to our Business" in Item 1A. of this Form 10-K.


text: We regularly engage consultants and other third parties to assist in developing, maintaining, and enhancing our cybersecurity risk assessment program. These third-party engagements supplement our internal capabilities and help ensure the robustness of our program. Examples of these engagements include penetration testing of our customer facing domains, quarterly cybersecurity briefings with outside counsel, and an annual assessment of our overall cybersecurity program. We maintain policies and procedures to identify and monitor cybersecurity risks associated with these third-party service providers, particularly those with access to customer, employee, or other sensitive data. Our selection and oversight of these providers includes diligence reviews, contractual protections, and other measures to mitigate these risks over the entire lifecycle of the relationship, including through implementation of the CIS Critical Security Controls. In addition to these prevention measures, we work proactively to detect and minimize the impact of cybersecurity incidents. We have a written incident response plan designed to ensure the appropriate internal and, if necessary, external resources are employed to promptly and effectively respond to potential breaches, minimize any related damage, and avoid disruption to our operations. We routinely test our incident response process through simulated incidents. No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have not experienced any cybersecurity incidents or threats that have materially impacted us or our business, we have encountered incidents in the past, which we have used to improve our program and defenses. Since it is possible we could experience a material cybersecurity incident in the future, we remain diligent in maintaining and continuously improving our program in an effort to prevent such incidents and, if one was to occur, to manage it effectively.

companyName: NEOGEN CORP

ticker: NEOG


text: We have developed a program for assessing, identifying and managing material risks from cybersecurity threats to our information and information systems. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective identification, prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cybersecurity risks and mitigations. We have a comprehensive cybersecurity program which includes risk management designed to protect the confidentiality, integrity and availability of our information systems and maintain compliance.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: The CIO has extensive leadership experience with 25 years of experience in information technology, project management, business applications including manufacturing. The CISO is responsible for overseeing our cybersecurity risk management program, in coordination with the CIO and our other business leaders, including in the legal, internal audit, finance and risk management departments. The CISO has extensive cybersecurity knowledge and skills gained from over 25 years of technical and business experience in the cybersecurity and information security fields. The CISO reports directly to the CIO who in turn reports directly to the CEO. The CISO receives reports on cybersecurity threats on an ongoing basis and, regularly reviews risks to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with our legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: Our cybersecurity and risk management program encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. We regularly educate and share best practices with our employees to raise awareness of cybersecurity threats creating a culture where everyone shares responsibility to help protect our sensitive data and information. All employees are regularly provided cybersecurity training and involved in phishing prevention campaigns to raise awareness. Our identity and access management program involves access controls for least privileged access and additional authentication methods. We have many cybersecurity systems including firewalls, intrusion detection systems, continuous monitoring by a full-time Security Operation Center to defend against unauthorized access. Incident response exercises are performed using our response and ransomware playbooks ensuring our readiness to response to cybersecurity events. We have a risk management program for our critical third-party vendors focusing on mitigating risks from external sources. Those third-party applications are monitored and access is reviewed including evaluating System and Organization Controls reports. We have an AI governance council and approval process who key activity is to review, evaluate risk of AI technology.


text: Our cybersecurity program's effectiveness is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including periodic evaluation against established quantifiable goals and other external benchmarks, including the Center for Internet Security, the National Institute of Standards and Technology and several other security frameworks. The evaluation is conducted through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct evaluations and assessments and to advise us on the effectiveness of our cybersecurity program.


text: During fiscal 2025, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect us or our strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.


text: We continuously monitor our computing environments, products, and services for vulnerabilities and signs of compromise, and we utilize our own security products to combat cybersecurity threats. We integrate security into our computing environments, products, and services through our Security Development Lifecycle ("SDL"). Our SDL introduces security and privacy considerations throughout all phases of our development process and through the adoption of zero-trust end-to-end architecture. We utilize machine learning and AI-powered security tools to gain insights from 84 trillion signals per day. We track over 1,500 unique threat actors, including more than 600 nation-state actors, 300 cybercriminal groups, 200 influence operation groups, and hundreds of others. To support our efforts, we operate a Cyber Defense Operations Center connected to over 10,000 security and threat intelligence experts, including engineers, researchers, data scientists, cybersecurity experts, threat hunters, geopolitical analysts, investigators, and frontline responders across the globe.

companyName: MICROSOFT CORP

ticker: MSFT


text: Our Board of Directors oversees cybersecurity risk. Cybersecurity reviews by the Board are scheduled to occur at least quarterly, or more frequently as determined to be necessary or advisable. Presentations to the Board of Directors are made by senior management, including our Chief Information Security Officer ("CISO"), our EVP of Microsoft Security, our EVP of Cloud + AI, and the head of our Customer Security and Trust organization. The presentations address topics such as cybersecurity threats, incidents, top risks and related remediation efforts, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, regulatory developments, and digital diplomacy efforts. In addition, we have an escalation process in place to inform senior management and the Board of significant issues. Cybersecurity issues are also considered during separate Board meeting discussions regarding important matters like ERM, audit issues, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our CISO leads the strategy, engineering, and operations of cybersecurity across the company, and reports to the EVP of Cloud + AI. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Before joining Microsoft, our CISO served in a prior Chief Technology Officer role as well as in senior leadership, engineering, and operational roles within multiple organizations. In addition to the Board's oversight of cybersecurity risk, to support the CISO, we have established a Cybersecurity Governance Council ("CGC") charged with overseeing initiatives that safeguard Microsoft's computing environments, products, and services. The CGC is comprised of an executive-level team of Deputy CISOs with cybersecurity backgrounds and expertise relevant to their roles. The CGC responsibilities include approving our enterprise security risk assessment process and results, determining the appropriate cybersecurity risk level and mitigations, reviewing the NIST CSF alignment, and supporting compliance with cybersecurity regulations. Our cybersecurity efforts are supported directly by Microsoft's security and threat intelligence experts and our employees across the company, all of whom receive cybersecurity awareness training and education and are expected to support our efforts.


text: Risk Management and Strategy We are focused on the growing threat of cybersecurity risks we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and focuses on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information. We have an established incident response plan ("IRP") to respond to cyber incidents.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL