text: The Company's management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program in a similar fashion to other legal, compliance, operational, and financial risk areas. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into six categories: identify, protect, detect, respond, recover and govern, and looks to other standards as well to help identify, assess, and manage cybersecurity risks relevant to our business.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). He has over 20 years of experience in leading information systems management, strategy, and operational execution, including incident prevention, management, and response. Our Company's Chief Information Security Officer (CISO) is responsible for developing and implementing our information security program and reports to our CIO. The CISO has over 25 years of experience supporting cybersecurity and information technology. They are supported by a direct and cross-functional team of professionals with expertise and experience in threat assessment and detection, mitigation strategies, incident response, training, and regulatory compliance.

secItem: Item 1C


text: In addition, we have established a Cybersecurity Steering Committee comprised of members of executive leadership. The Steering Committee, in which our CIO and CISO participate, meets regularly and has established Company-wide policies and standards concerning cybersecurity matters. These policies cover areas such as malware protection, remote access, multifactor authentication, containment of confidential information and the use of the internet, email and wireless devices. We have an established incident response plan led by our CIO and CISO and depending on the nature and severity of the incident, requires escalating notifications up to our CEO and Board.


text: Our Board oversees our enterprise risk management activities. The Board receives periodic updates on our cybersecurity risk management program as well as regular updates and education on relevant legislation and trends related to cybersecurity. Our Audit Committee assists the Board in its oversight role and receives regular reports from management on the Company's information systems and cybersecurity program. Several members of our Board's Audit Committee have expertise and experience in cybersecurity, and one director is the President of a major cybersecurity services provider.


text: The CISO and information technology security team conduct regular risk assessments to assess the overall technology infrastructure and related business processes, identify and address potential security gaps and vulnerabilities, and identify areas requiring additional focus. These risk assessments extend to our supply chain, where cybersecurity health assessments are employed for our critical suppliers. The results are used to calculate a Cybersecurity Risk Score, a key component of our Supply Chain Scorecard used to proactively identify and manage potential risks. Additionally, we require certain third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, as appropriate. Risk assessments are also performed on new products and software as part of our new product development process.


text: As part of our risk assessments, we engage third-party services for network penetration testing and security evaluations, conduct annual incident response table-top exercises, and perform regular testing of controls related to our financial information systems by our Internal Audit function.


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Our systems are continually subject to sophisticated and evolving cyber threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that have materially impacted our operations or financial condition. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification, escalation, and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to evolve our security controls, incident response capabilities, and third-party vendor management protocols.


text: For additional information on the cybersecurity risks that we face, also see Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: The oversight of our cybersecurity risk management process is integrated into our overall risk management process. Through our enterprise risk management process, which involves a broad cross-functional group across many areas of expertise and is structurally independent of our business lines, we identify and assess risk and risk-mitigation actions, including with respect to cybersecurity risks. Our Chief Information Officer ("CIO") provides oversight of our cybersecurity risk, which is addressed by a group of stakeholders that includes our information technology ("IT") and cybersecurity leadership and IT leaders within our various facilities, with cybersecurity risk input provided from this team to our senior leadership team on a regular basis. Our CIO provides key updates on risk and mitigation strategies to the Audit Committee.

companyName: SHYFT GROUP, INC.


text: While we have experienced cybersecurity incidents in the past, as of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material effect on the Company, including our business strategy, results of operations or financial position. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors-- More General Risks Applicable to Our Industry."


text: The Board of Directors is responsible for overseeing risk for the Company and has delegated to the Audit Committee responsibility for overseeing the cybersecurity risk management strategy for the Company. The Audit Committee reviews how we are executing against our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol. The Audit Committee receives regular updates on cybersecurity risks from our CIO. The Audit Committee also regularly receives updates on efforts regarding data loss prevention, regulatory compliance, data privacy, threat and vulnerability management, cyber-crisis management, and other topics as applicable. Additionally, management provides the Audit Committee with a cybersecurity dashboard, which the full Board of Directors can access as well.


text: We and our operators increasingly rely on information technology systems to operate our respective businesses, and the oil and natural gas industry depends on digital technologies in exploration, development, production, and processing activities. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with the employees of the Operating Partnership and third party customers and services providers. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, gathering, misuse, loss or destruction of proprietary and other information, fraud, extortion, harm to employees or customers, violation of data privacy or security laws and disruption of other business activities.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: Our risk management process also assesses third party risks. We perform assessments to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers and potential fourth party risks when handling and/or processing employee, business, or customer data.


text: We, in coordination with external experts, have implemented a cyber and data security incident response plan that has four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) identification, analysis, and notification of a security incident by external experts, as applicable, 3) containment, eradication, and recovery, and 4) post-incident analysis and learnings for future preparedness. Such incident responses are managed by our outsourced IT managed services provider, Chief Financial Officer ("CFO"), and department managers, who, together, comprise our primary incident response team. As part of our cybersecurity risk management process, our incident response team logs and tracks privacy and security incidents across the Partnership, vendors, third party service providers, and other business partners. Cyber and data security incidents are evaluated to determine materiality, as well as operational, business, and privacy impact, ranked by severity, and prioritized for response and remediation. Significant incidents are evaluated by the primary incident response team to determine whether further escalation is appropriate, and any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to the Chief Executive Officer ("CEO"). We consult with outside counsel and other subject matter experts regarding materiality analysis, disclosure, and other compliance matters, as appropriate, and our executive officers, with input from the Board of Managers, as appropriate, make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Partnership's independent public accounting firm of matters and any relevant developments.


text: We also maintain a third-party risk management process to mitigate vulnerabilities associated with external service providers and vendors. This includes reviewing service-level agreements and third-party security certifications, such as PCI DSS and SOC reports, on an annual basis or as-needed to ensure vendors adhere to our security and compliance standards.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: Risk Management and Strategy The Company, our Manager and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our Manager's systems, train the Manager's employees and generally advise on cybersecurity processes. At least annually, our Manager has its information technology team and its third-party security firm make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and the Manager's employees, and the latest threats that have emerged.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: The Board of Directors maintains oversight of risks from cybersecurity-related threats, primarily through the Audit Committee. The Audit Committee holds a separate annual in-person meeting with the Company's Chief Information Officer (CIO) and subsequently provides an update to the Board. The Company's CIO also attends a second annual meeting directly with the full Board of Directors. Beginning in 2025, in addition to these annual meetings, the CIO or the Sr. Vice President of Engineering & Technology is scheduled to meet with the Audit Committee such that the Board and the Committee receive updates on at least a quarterly basis. Other updates are provided throughout the year to the Audit Committee and the Board, as needed. In the event a cybersecurity incident is determined to be significant, a formal meeting of the full Board of Directors may be convened.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: The Company's CIO, Senior Vice President of Engineering and Technology responsible for technical services, and Vice President of Engineering and Technology responsible for IT risk management oversee all material risks associated with cybersecurity threats. Our CIO has over 30 years of experience leading data and technology initiatives and has held executive and senior leadership roles across Fortune 500 companies. Our Senior Vice President of Engineering and Technology has more than 34 years of IT experience and has led initiatives in IT application development, IT operations, cloud computing, cybersecurity, business continuity, governance, compliance, and enterprise risk management across various industries. Our Vice President of Engineering and Technology, has more than 30 years of expertise with the Company in cybersecurity, engineering, governance, risk, and compliance, having successfully led numerous projects for the Company. Their backgrounds provide them with a comprehensive understanding of cybersecurity challenges and solutions.


text: In the event of a cybersecurity incident, these leaders engage the Incident Response Team (IRT), a team comprised of senior- and executive-level leaders from various business units, legal and finance departments, and the corporate communications team, to help manage and maintain business operations throughout the incident and any recovery period. The IRT is responsible for reporting details of the incident and its impact on the business to the Executive Leadership Team (ELT) and making key recommendations for managing operations. The ELT is responsible for advising the Board of any material cybersecurity incidents. Both the ELT and the IRT have participated in formal cybersecurity response training.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to employees, based on their role.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Risks Related to our Business" in this Annual Report on Form 10-k.


text: Cybersecurity risk is initially overseen at ConnectOne by the management IT Committee (the "ITC"). The members of this committee include, as co-chairs, the Chief Compliance Officer and the Chief Technology Officer. Additional members are our Information Security Officer, Information Technology ("IT") Manager, Chief Risk Officer, Chairman & Chief Executive Officer, Chief Digital Officer and Chief Brand and Innovation Officer.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Ali Mattera, Chief Digital Officer – Ms. Mattera is a technology subject matter expert with over 13 years of IT leadership and over 18 years of financial service experience. In her career she has been responsible for technology/digital strategy, enterprise program management, data analytics and IT service management at other financial institutions. In addition to the members above, Frank Sorrentino III, Chairman & Chief Executive Officer and Siya Vansia, Chief Brand & Innovation Officer are also members of the ITC due to their roles in overseeing entity-wide management.


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, members of the ITC, along with other lines of business heads, report to the management Enterprise Risk Management Committee (the "ERMC"), which in turn reports to the Board Audit and Risk Committee quarterly. The ERMC consists of the Company's Chief Risk Officer, Chairman & CEO, President, Chief Financial Officer, Treasurer, Chief Compliance Officer, Chief Technology Officer and Chief Credit Officer. In addition, the Company's Chief Technology Officer attends Company Board of Directors meetings and provides an information technology ("IT") report at each meeting.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into our approach to risk management, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). The Company uses recognized frameworks from the National Institute of Standards and Technology as guidelines to inform its cybersecurity policies, standards, and practices. We generally approach cybersecurity matters through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: BOYD GAMING CORP

ticker: BYD


text: Risk Management and Strategy Consistent with our Information Security Policies and Standards, our cybersecurity program focuses on the following areas:


text: Awareness: We maintain an extensive presence with cybersecurity threat operations functioning continuously and uninterrupted with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.


text: Third-Party Risk Management: We employ a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Training: We provide regular mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. We also publish an internal newsletter on a monthly and ad-hoc basis for enterprise-wide consumption to promote awareness of trends in cybersecurity threats and attack techniques.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to and recovery from a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.


text: Communication, Coordination and Disclosure: We take a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, internal audit and other key business functions and engage with our Board in an ongoing dialogue regarding cybersecurity threats and incidents while also implementing controls and procedures for the assessment and escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, vulnerability testing, and other exercises focused on evaluating our cybersecurity measures effectiveness. We regularly engage third parties to perform assessments of our cybersecurity program, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided.


text: Our Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. Our Board receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least quarterly, the Board discusses the Company's approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").


text: Our CISO is the member of our management team that is principally responsible for overseeing our cybersecurity program, in partnership with other business leaders across the Company. Our CISO has served in various roles in information technology and information security for over 25 years and holds a degree in Business Administration with a major in Accounting and Finance and a graduate degree in International Management. Our CISO also holds advanced certifications as a Certified Information Systems Security Professional and as a Qualified Technology Executive granted by Digital Directors Network and works in coordination with the other members of management, including, but not limited to, the Company's President and Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel. Our Chief Technology Officer holds an undergraduate degree in computer science and economics from Northwestern and has served in various roles in information technology for over 33 years with Boyd Gaming and numerous other public companies. The Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each has years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Our CISO works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. We believe with the cybersecurity and governance program we have in place that we have and continue to implement effective processes and controls to prevent cybersecurity incidents from being reasonably likely to materially affect the Company. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Failure to maintain the integrity of our information technology systems, protect our internal information, or comply with applicable privacy and data security regulations could adversely affect us", for additional discussion about cybersecurity-related risks.


text: Our Information Security program is led by our Chief Information Officer ("CIO"), who reports to our Chief Operating Officer ("COO"). Our CIO works with our Chief Privacy Officer ("CPO") to address cybersecurity and data privacy risks and concerns. The Information Security Governance Committee ("ISGC"), composed of executives from various corporate functions oversees our cybersecurity policy and strategy. Members of the ISGC, including the CIO and CPO, meet with the COO on a regular basis to review and monitor our cybersecurity risks and mitigation efforts. Our Board of Directors (the "Board") oversees our enterprise risk management activities in general, including cybersecurity risks. The Audit Committee of the Board has been designated with specific oversight responsibility with respect to cybersecurity and data privacy risk management. The Board receives a comprehensive update on the status of risks related to cybersecurity annually and periodic updates on particular matters. We engage external assessors, consultants, and auditors to assist us in evaluating and enhancing our cybersecurity risk management processes. We also have processes to oversee and identify such risks from cybersecurity threats associated with our use of third-party service providers.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: Cybersecurity Risk Management and Strategy Information technology is important to our business operations and we are committed to protecting the privacy, security, and integrity of our data, as well as our employee, customer, and vendor data. Accordingly, we have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats, as well as identify, contain, and respond to cybersecurity incidents. These processes include, but are not limited to, monitoring and updating of our information technology and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses, and other events that could have a security impact. Additionally, to protect and secure sensitive data, we employ multi-factor authentication, a suite of security tools, systems monitoring and alerting, audit logs, and controls across our major systems, devices, and business processes. We engage with external experts to evaluate and test our cybersecurity risk preparedness. Regular exams and threat and security assessments with these third parties ensure that our cybersecurity strategies align with industry best practices. To manage cybersecurity risks associated with third-party service providers, we impose security requirements upon our suppliers, including maintaining an effective security management program and notifying us in the event of any known or suspected cyber incident. We also conduct company-wide security awareness training periodically to provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report the majority of suspicious activities or threats. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.

companyName: AEye, Inc.

ticker: LIDR


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the risk factor within Item 1A "Risk Factors" in this Annual Report on Form 10-K, entitled "We, as well as our suppliers and partners, are subject to cybersecurity risks to operational systems, infrastructure, integrated software in our lidar solutions, and the data processed by those solutions, and any material failure, weakness, interruption, cyber event, incident, or breach of security could adversely affect our business by causing a disruption of our operations, a compromise or corruption of our confidential or other business-critical information, and/or damage our business relationships, all of which could negatively impact our business financial condition, and operating results."


text: Cybersecurity Governance Cybersecurity risks are among the enterprise risks that our Board of Directors oversees, primarily through delegation to the Audit Committee of the Board. The Audit Committee assists the Board in overseeing our privacy and information policies and reviewing our cybersecurity program. The Audit Committee engages with our management team, including our Director of IT and our Chief Financial Officer, and receives periodic reports on cybersecurity. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. These cybersecurity reviews by the Audit Committee or Board of Directors generally occur at least once annually, or more frequently as determined to be necessary.


text: The day to day operations of our cybersecurity risk management program are overseen by our Director of IT, who reports to our Chief Financial Officer. Our Director of IT has served in this position for 6 years. He has over 39 years of IT experience, including over 10 years of experience in security compliance. Our Director of IT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, alerts, or reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with executive leadership, the Company's ERM function, and the Company's Vice President of Information Technology. Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to executive management, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: The Vice President of Information Technology, in coordination with executive leadership including our Interim Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Vice President of Information Technology monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: The Vice President of Information Technology has been with the Company for over 25 years in various roles in information technology and information security. The Company's Interim CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Our Chief Information Officer, who reports to the Chief Financial Officer, and has over 30 years of experience managing information technology and cybersecurity matters, together with our executive management team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Legal and Regulatory Requirements."

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: Risk management and strategy Our information technologies, system networks, information technology infrastructure, enterprise applications and financial reporting platforms are critical components of our operations. Our business operations rely on the secure processing, transmitting, collecting and storage of sensitive and confidential data. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as defined in Item 106 (a) of Regulation S-K.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We partner with a third-party information technology company to address and manage each of the critical aspects of cybersecurity risk mitigation. The user aspect is addressed by deploying endpoint detection and response software on all endpoints, as well as extensive phishing testing and training for every user. This is further reinforced with additional monitoring to identify any aberrant activity within our network or software as a service ("SaaS") tools. A 3-2-1 backup strategy is used, resulting in a copy of all backup data offsite in the unlikely event that the disaster recovery plan is required. Our backup system is regularly confirmed through routine data recoveries, test recoveries and monitoring that alert to any unexpected errors or failures with the system.


text: In our business operation, we utilize various third -party service providers, including credit card companies, banks and financial platform providers, to process financial transactions and implement various software and information system processes. To that effect, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.


text: We are not aware of any risks from cybersecurity threats, nor have we experienced any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" in this Form 10 -K for discussion of risk factors.


text: Our management, represented by senior management, leads the cybersecurity risk assessment and mitigation processes, along with information technology management staff and our third-party business technology partner. Our third-party business technology partner has over 21 years of experience in cybersecurity and information technology. Continuous monitoring and routine meetings are conducted in order for the Company's information technology team and third-party business technology firm to update senior management regarding prevention, detection, mitigation and remediation of any cybersecurity threats or incidents.


text: The Company and the Board of Directors are committed to remaining updated on evolving cybersecurity regulations and best practices, as well as the development and amendment of processes to meet these changing demands. The Company did not experience any cybersecurity incident during 2024.

companyName: UNIVERSAL BIOSENSORS INC


text: Our Audit Committee, composed of two independent Board of Director members, has oversight responsibility for the Company's cyber-security risk. The internal members of management that oversee cybersecurity is the Chief Financial Officer, ("CFO") and the Director of Franchise Operations/Staff Attorney, ("DFO"). The CFO reports to the Audit Committee prior to each quarterly and annual 10-Q and 10-K filing, respectively, on any current cyber changes, procedures and any identified risks. The CFO provides the Audit Committee any cyber insurance information and will obtain approval for any changes in cyber insurance coverage. The CFO will also provide the Audit Committee any information on any possible third-party information technology, ("IT") service and consultant changes. The Audit Committee will review and approve any change in IT service providers. The Audit Committee will be immediately notified of any cyber security threats or incidents.

companyName: BAB, INC.

ticker: BABB


text: At BAB, Inc. we recognize the importance of safeguarding our systems, data and assets, even in an environment where the risk of cyber incidents is minimal due to the nature of our business. The CFO has over 30 years of experience in risk management and working with computer systems across various industries, providing strong oversight of the cybersecurity efforts. The DFO has several years of experience in IT operations within the company. The internal management team of the CFO and DFO are both familiar and knowledgeable of the company's computer systems and operations and they are familiar with the company's policies, procedures and accountability for safeguarding critical data and assets. Cybersecurity tools as listed below aid in mitigating cybersecurity risk.


text: Our cybersecurity infrastructure includes a combination of technical, administrative and physical safeguards designed to mitigate cybersecurity risks. As part of our risk management process, the CFO also regularly engages with the outside IT consultants to review and minimize the Company's cyber risk.


text: The Company has a firewall that protects the whole network, including intrusion protection, virus protection and other subscription-based protection that updates regularly. For those with remote access there is end-to-end encryption with a secure VPN to access the server. All computers, including those in office and any remote user's computers have an antivirus software from a company that specializes in cybersecurity that has been installed and maintained by an outside IT consultant. The software is updating and reviewing any cyber threats on a continual basis. Additional services provide email filters to minimize phishing and spam emails. Employees are trained to not open suspicious emails and to never open attachments unless they are expecting an attachment from that Company or individual.


text: Sensitive files are password protected and accessible by only select individuals. These files are maintained on a separate drive. Computer files are backed up and redundancy protocols are in place so that minimal downtime would occur in the event of a cyber breach. The Company also maintains cyber insurance coverage to ensure that the Company is adequately prepared in the event of an unforeseen cyber incident.


text: No system is entirely immune to cyber threats and although our risk is low, the impact of a cybersecurity incident could impact our business, cause reputational harm, subject us to increased operating costs and/or expose us to litigation. To date, we have had no cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact our operations or financial condition. Should an incident occur, the CFO and/or DFO will immediately report the incident to the Audit Committee with all details. The communication will identify what steps are currently being taken to resolve the incident, and what actions are being taken to prevent any further security incidents from occurring.


text: Risk Management, Strategy, and Governance Our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes are led by a dedicated, outsourced Chief Information Officer, in collaboration with outside cybersecurity partners, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Qualified third-party service providers are tasked with developing, implementing, and executing that strategy. These third parties play a key role in our cybersecurity risk assessment and management processes, as we rely on their cybersecurity experience and expertise to assess, identify, and manage emerging trends and risks from cybersecurity threats on an ongoing basis.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Our Chief Executive Officer and other members of our senior management, as appropriate, provide oversight and monitoring of these third parties, who provide regular reports to management. Management provides periodic reports to our Board as a whole, who are ultimately responsible for the oversight of risks from cybersecurity threats, which include updates on the Company's cyber risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape, and any recommendations for additional internal controls, systems, or insurance coverage for board approval.


text: Our cybersecurity policies are focused on ensuring the security and protection of our systems, networks, and proprietary data, which includes trade secrets, intellectual property, corporate strategic plans, marketing plans, material non-public financial information, and personally identifiable information, such as employee and customer information. We also actively engage with key vendors as part of our continuing efforts to actively monitor system access, identify and quarantine potential cybersecurity threats, to assess and implement cybersecurity systems and tools, and to enhance the effectiveness of our information security policies and procedures.


text: We assess materiality of cybersecurity incidents based on the type of breach, whether any information was accessed, the nature of the information accessed, and the potential for business interruption. As of the date of this report, we are not aware of any material incidents from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: With the guidance of a qualified third -party that reports to and regularly meets with the Chief Executive Officer, we continue to make improvements in our cybersecurity program throughout our operating companies. We have established processes, consistent with nationally recognized frameworks, for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. Our prevention efforts are multi-faceted, and are intended to address threats to our employees, networks, applications and data.

companyName: CRAWFORD UNITED Corp


text: Our third -party advisor has performed cybersecurity risk assessments of our information technology security processes and implemented technologies to lessen risk and respond to new risks as they arise. Using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across our networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we require employees to participate in ongoing training and testing programs through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Any potential cybersecurity incident discovered is promptly reported to the Chief Executive Officer and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns with management (including data privacy risk management) and the steps management has taken to monitor and control such exposures.


text: Although we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or have been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats and incidents we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A. "Risk Factors".

companyName: GRAY MEDIA, INC

ticker: GTN


text: We believe that cybersecurity is a critical part of our overall risk management profile, which is supported by both our management and our Board of Directors. We believe that we face the same external threats common to other participants in the infrastructure sectors, which include ransomware and malware attacks in addition to the risks brought on through the vendor supply chain. Through the leadership of our Vice President of Information Technology, who reports to our Chief Financial Officer, we continuously assess these threats and evaluate our landscape for new vulnerabilities, considering both for their probability of occurrence as well as their perceived potential impact. We supplement our risk assessment processes with robust third-party identification tools which we review routinely through the use of intrusion prevention and detection systems. We supplement our internal procedures with third parties, who routinely assess our network infrastructure for vulnerabilities both internal and external to our firewall. We also conduct periodic training and awareness programs for all of our employees with systems access in order to drive adoption and awareness of their critical roles in cybersecurity processes and controls.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: The pace of change in approaches undertaken by cyber criminals requires that we strive for continuous improvement and constant monitoring of the broader landscape. In 2024 we adopted the cybersecurity framework of the National Institute of Standards and Technology ("NIST"), and worked to assess our adoption of the NIST cybersecurity framework against a group of peers. We believe that continued evaluation by external experts is the best means to ensure both the design and operational effectiveness of our cybersecurity policies, internal controls, and standards. Furthermore, these periodic reviews are critical to evaluate that we have the right people, technology, and processes to identify, prevent, and detect the activities of bad actors who desire to challenge the system continuity and functionality of the information technology we depend on to operate our business. In addition to our prevention efforts, we also prepare for criminal infiltration through the evaluation of our incident response plan including table top exercises, which helps us assess our ability to react timely and effectively to various degrees of cybersecurity incidents. We believe our plan is well-designed and capable to manage an unforeseen breach including the eradication of the infiltrator from our networks. We carry cyber insurance to transfer the residual risk of an incident. We also work with our cyber insurance carrier to regularly refine our response procedures, which include the definition of internal and external communications channels to key stakeholders, as well as the identification of material breaches and the associated incident reporting up to senior management and our Board of Directors.


text: Our Board of Directors has charged the Audit Committee with the governance and oversight of this risk. Our committee charter requires quarterly reporting to our Audit Committee by our Vice President of Information Technology covering key cybersecurity accomplishments, planned enhancement activities, and monitoring observations of the threat environment. Board experience in risk assessment has been enhanced with certification achievements specific to cybersecurity risk, providing us with the appropriate oversight for this evolving threat.


text: As of the date of this report, we are not aware of any material breaches to our networks or computer systems that have materially affected or are reasonably likely to materially affect our execution of our business strategy, results of operations, or financial condition. We describe potential risks from cybersecurity threats under the heading "Our information technology systems can be negatively affected by cybersecurity threats," in Part I — Item 1. "Risk Factors" of this 2024 Form 10 K, which disclosures are incorporated herein by reference.


text: We have a Security Operations Center operating in multiple regions that provides daily monitoring of our global cybersecurity environment and coordinates real-time investigation and remediation of alerts. Identifying and assessing cybersecurity risks related to our business, operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT/OT security, governance, risk and compliance reviews. To deter, detect and respond to cybersecurity incidents, we conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and consultants, and conduct tabletop exercises to simulate responses to cybersecurity incidents. We also conduct and require our workforce to complete ongoing cybersecurity awareness education and training. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.

companyName: TIDEWATER INC

ticker: TDW


text: We engage third party security experts for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. We use the findings of these exercises to improve our practices, procedures, and technologies. We engage third party security experts to support our cybersecurity threat and incident response management and maintain cybersecurity risk insurance coverage.


text: Our risk management program also assesses third party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business or customer data.


text: We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company. For more information on our cybersecurity risks, see "Risk Factors – Risks Relating to Information Technology and Cybersecurity – Cybersecurity attacks on any of our facilities, or those of third parties, may result in potential liability or reputational damage or otherwise adversely affect our business."


text: Cybersecurity Governance The Audit Committee of our Board oversees our cybersecurity risk management program and meets on a quarterly basis with our Chief Information Officer (CIO) to review our cybersecurity programs and risks, including (as applicable) assessments and program maturity; evolving cyber risks; status on addressing and/or mitigating cyber risks; any recent cybersecurity or data privacy incidents at the Company and across the industry; and status on any key cybersecurity initiatives. These cybersecurity risks and programs are further reviewed and considered by the Board in connection with the company's overarching enterprise risk program.


text: Our cybersecurity team is led by our Director of IT Infrastructure, who has over 20 years of experience and obtained various professional security certifications and advanced training in the field of cybersecurity and technology and reports to our CIO. Our CISO is responsible for managing and supervising our cyber risk management program and informing the CIO and senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Risk Management and Strategy To effectively manage the cyber risk posed to our organization and to remain within our risk appetite, we maintain a cybersecurity strategy and risk management program to identify, assess and manage material risks from cybersecurity threats with the aim of protecting the confidentiality, integrity and availability of our critical systems and information.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Our cybersecurity program takes a cyberthreat and risk-based approach and was developed to align with ISO 27001, an international standard for information security, and we also assess ourselves against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, our cybersecurity risk management program aligns with ISO 31000, the international standard for risk management. The foregoing does not imply that we meet all technical standards, specifications or requirements, or that we have been certified on these requirements in any respect, only that we have used these industry standards as guides when designing our cybersecurity and risk management programs.


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. Major incidents emanating from cybersecurity threats are communicated to our Operational Risk team through our enterprise risk management system and escalated in accordance with our incident response plan. In addition, cybersecurity has been designated as a principal risk by the Risk Committee of our Board of Directors (the "Risk Committee"), which requires regular monitoring and reporting.


text: We identify material risks from cybersecurity threats through various sources, including, but not limited to, controls testing, compliance testing of our security standards, independent penetration testing, open-source threat intelligence feeds, and lessons learned and assessments against control frameworks. These threats are assessed by applying our Risk and Control Self-Assessment ("RCSA"), information technology risk and cybersecurity risk management processes, each of which we review regularly. Based on the RCSA, risks from cybersecurity threats that exceed established risk tolerance thresholds are recorded and incorporated into our reporting to the Risk Committee and senior management as described in more detail below. We also engage third -party assessors, consultants and auditors to assist in the administration, assessment and improvement of our cybersecurity risk management program.


text: To help bring risks from cybersecurity threats within an acceptable risk appetite and tolerance level, we created a cybersecurity strategy and associated program of necessary activities. The program mitigates the risks through the effective design and implementation of compensating controls or remediation actions, commensurate with the assessed risk level from such threats.


text: With respect to third -party service providers with access to our information systems, assets or data, our security policies, standards and procedures are designed so that periodic due diligence is conducted as appropriate on the cybersecurity controls maintained by such third parties. The aim is to ensure the third -party service provider has adequate and appropriate cybersecurity measures in place commensurate to the risk their access to our information systems, assets or data presents.


text: We have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the business strategy, results of operations or financial condition of the Company. Please refer to the risk factor captioned "We could be subject to losses and reputational harm if we, or our agents, fail to properly safeguard sensitive and confidential information against cyberattacks or other security breaches or if our business processes are not sufficiently resilient." in Part I, Item 1A. Risk Factors, for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors has established a Risk Committee to assist the Board in its oversight of risk. As part of its responsibilities, the Risk Committee oversees management's implementation of our cybersecurity and risk management program.


text: The Risk Committee receives regular reports from our Information Security leadership on our cybersecurity risks, including key status updates, security issues, current and future priorities, independent assurance, threat landscape and audit findings. The Risk Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity oversight.


text: Our Information Security team, including our Information Security leadership, has primary responsibility for identifying, assessing and managing material risks to the Company from cybersecurity threats, including our overall cybersecurity risk management program and supervision of our internal cybersecurity personnel and our external cybersecurity consultants. Our Chief Information Security Officer ("CISO") has over 20 years of information security/cybersecurity experience, working in a variety of roles within PricewaterhouseCoopers LLP, as the Director of Cyber Operations for Nationwide Building Society, the CISO at The Crown Estate and the CISO at Insight Investment.


text: Our Information Security leadership regularly briefs our Global Chief Operating Officer and Chief Technology Officer on cybersecurity issues, the scope of which is similar to the information presented by the Information Security leadership to the Risk Committee as described above. Major risks from cybersecurity threats determined following application of an RCSA are escalated by our Information Security leadership to the Risk Committee, Global Chief Operating Officer, Chief Technology Officer and other senior management.


text: a management team responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our Senior Director of Information Technology and Senior Vice President, Quality Assurance, who report to the Chief Financial Officer and Chief Executive Officer, respectively, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The Senior Director of Information Technology and Senior Vice President, Quality Assurance have primary responsibility for our overall cybersecurity risk management program and supervises both our internal technology and quality assurance compliance personnel and our retained external cybersecurity consultants. Our Senior Director of Information Technology has more than 20 years of experience in IT Management, including cybersecurity, and our Senior Vice President, Quality Assurance has more than 20 years of experience in computerized system and IT infrastructure controls, compliance, and risk management.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM") and is one of the key risks identified for oversight by the Board through our annual ERM assessment. Our ERM approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's information; and (iv) protect our IP. Vigilance: We maintain 24/7 cybersecurity threat operations designed to rapidly detect, contain and respond to cybersecurity threats and incidents.

companyName: CEVA INC

ticker: CEVA


text: Third-Party Management: We screen vendors, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented users of our systems.


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We periodically engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures. The assessments include information security maturity evaluations, independent environmental security control reviews, operating effectiveness and penetration testing. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our board periodically receives presentations and reports from the management team on information regarding the policies, processes and practices that we implement to address risks from cybersecurity threats including, for example, discussion of recent developments, evolving standards, third-party and independent reviews, the threat environment and technological trends. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, the board will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.


text: Our cybersecurity team is composed of the global head of Information Technology & Management Information Systems, the Chief Information Security Officer ("CISO") and deputy CISO. This cybersecurity team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our cybersecurity team members each possess 15-35 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training.


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of AI. We have experienced cyberattacks in the past, and although immaterial, there can be no guarantee that in the future such cyberattacks will not be material. We believe we are a particularly attractive target because of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. We have certified against, and demonstrated conformance to, the latest International Organization for Standardization's ("ISO") information security management system audit using the 27001:2022, 27701:2019, and 27017:2015 frameworks. Successfully achieving these three certifications demonstrates our prioritization of security and privacy for both us and our customers, and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations. Our three ISO certifications add to the company's overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP and FedRAMP.

companyName: AvePoint, Inc.

ticker: AVPT


text: 33 Table of Contents Our privacy and security program dictates a governance structure whereby we: Regularly engage senior management on data privacy and security issues; Align policies, procedures, and technical controls to demonstrate our process and our commitment to our customers and users; Train each of our employees on all privacy and security expectations; Conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; Maintain a robust cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across AvePoint; Periodically run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; Monitor emerging data protection and cybersecurity laws, and implement changes to our processes, systems and offerings designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; Complete several cyber-specific audits per year; and Engage consultants and other third parties in connection with our cybersecurity practices.


text: In addition, we maintain specific policies and practices governing our third -party security risks, including our third -party risk assessment (" TPRA ") process. Under our TPRA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to maintain security controls to protect our confidential information and data, and to notify us of material data breaches that may impact our data.


text: Our Chief Risk, Privacy and Information Security Officer (" CISO ") leads the company's privacy, data protection and security program. An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and has been a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100, featured in Forbes, and named a Top Global CISO by Cyber Defense Magazine. including being featured in the "CSO Hall of Fame".


text: In addition, our CISO oversees teams across the company supporting our security and privacy functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO reports directly to our Chief Executive Officer and is a member of the company's senior management team, and is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Additionally, our CISO and Chief Compliance Officer regularly update our senior leadership team, our Nominating and Corporate Governance Committee, and the full Board, on the company's privacy and cybersecurity program, including privacy and cybersecurity risks, incidents, and mitigation strategies.


text: Disclosure of the Board ' s Roles and Responsibilities Our Board oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles. Additionally, our CISO and Chief Compliance Officer regularly report on cybersecurity matters to the Board, as discussed above.


text: In 2024, we did not identify any privacy or cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10 -K.


text: Bel employs a full-time Cybersecurity Expert who reports directly into our Global Head of IT and Cybersecurity Services. During 2024, the Company worked with third-party cybersecurity specialists to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third-party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: The Audit Committee of the Board of Directors is responsible for overseeing the management of cybersecurity risks. The Audit Committee is informed about cybersecurity risks through quarterly reports from the Global Head of IT and Cybersecurity Services and, as necessary, to the full Board. The Audit Committee also reviews and approves the company's cybersecurity policies and the Company's Global Head of IT and Cybersecurity Services is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. This includes our overall information security strategy, policy, security engineering, operations and cyber incident detection and response reporting in alignment with Company policies. The current Global Head of IT and Cybersecurity Services has more than 16 years of information technology and program management experience which includes information security, and others on our IT security team have extensive cybersecurity experience and certifications.


text: Oversee requirements of the Bank's Vendor Management Policy, including processes for approving third -party providers including the financial condition, business resilience, and IT security position of third -parties. Ensure risk assessments and New Vendor Relationship Information is completed for all vendor relationships. Review and approve risk assessments for significant, critical vendor relationships on an annual basis. Examine the Bank's Business Continuity and Disaster Recovery Plan, including updates and testing. Provide for comprehensive, effective, and, if required, independent audit coverage of IT risks and controls.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: The Chief Information Officer ("CIO") works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. The CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the ITSC and CRMC.


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third -party assessments, internal information technology audit, information technology security, governance, and risk and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and techniques to test security controls, conduct employee training, and monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: Our risk management program also assesses third -party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third -party cybersecurity incidents to identify and mitigate risks to us from third -party incidents. We also carry business interruption insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: Cybersecurity Risk Management Program The Company's cybersecurity risk management program, aligned with the National Institute of Standards and Technology Cybersecurity Framework (CSF) domains and HITRUST CSF, is designed to employ industry best practices, including ongoing enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third -party service providers. This program includes the engagement of consulting firms and other third parties.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: The Company maintains cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity matters. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We do not believe that any risks we have identified to date, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we or the third parties with which we interact have not identified or experienced, or will not experience, a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business" included in Part I, Item 1A of this Form 10-K.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats to our business and operations and developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems. CoreCard's information technology network, infrastructure, and software systems, including integration points to third parties related to the FinTech services the Company offers, are critical to the Company's business and operations. The Company holds confidential, proprietary, and personal information about its customers, its customers' customers, employed or contracted personnel, and third-party vendors. In addition, the Company's business in the FinTech industry requires it to be compliant with Payment Card Industry (PCI) Data Security Standards and U.S. and foreign data and information security mandates specific to its operations and services. To address these items, CoreCard has developed a robust cybersecurity risk management program focused on identifying, assessing and managing cybersecurity risk. The program involves a dedicated team responsible for operational cybersecurity, and includes an internal IT Security Team, PCI Compliance Force, and Emergency Management Team, which together are responsible for developing and executing the Company's cybersecurity strategy and identifying and mitigating related risks.

companyName: CoreCard Corp

ticker: CCRD


text: The IT Security Team consists of five members, led by the VP of IT of the Company's CoreCard Software subsidiary, and focuses on the Company's overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the subsidiary's Chief Technology Officer, and focuses on the Company's compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company's third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company's Emergency Management Team, which consists of seven members and is led by the Company's Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.


text: The Company has also designed its information technology systems and infrastructure to protect its and its customers' data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company's operation of cardholder data environments. The Company's cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting. This partnership enables us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current.


text: Our business is managed under the direction of our Board of Directors (the "Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.


text: Our cyber risk management program is integrated into our overall risk management system, which includes a cybersecurity risk assessment process, that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee as part of their involvement in managing and overseeing cybersecurity risks.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: a security team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: We have established separate processes and procedures to oversee and identify cybersecurity risks associated with our use of third -party service providers. All third parties involved in our cybersecurity risk assessments and risk management are required to provide reports designed to allow us to monitor and assess such third parties' security controls.


text: As of the date of this report, though the Partnership and our service providers have experienced certain cybersecurity incidents, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite implementation of our cybersecurity process, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors – Our business is subject to cybersecurity risks" included elsewhere in this Annual Report on Form 10-K.


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives, as necessary, briefings from management on our cybersecurity risk management program and receive presentations on cybersecurity topics from IT leadership, which includes our Chief Sustainability and Administrative Officer ("CSAO"), or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our cybersecurity team, led by the CSAO, is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Partnership stakeholders and external advisors. Our cybersecurity team includes the CSAO and IT leadership. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity team includes professionals with deep cybersecurity expertise across multiple industries. The CSAO has over 20 years of audit, risk management and cybersecurity experience covering the energy, pipeline, utilities, manufacturing, and financial services industries.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel, threat intelligence and other information obtained from public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: The Information Security and Information Technology teams support the business through early engagement in the Project Management Office routines and the Vendor Management Office's requirements, to ensure that new products, projects, and third -party vendors are onboarded with appropriate oversight.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: Third-Party Risk Management: Rigorous controls are in place to mitigate risks associated with third -party service providers, including security risk assessments and contractual security requirements.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: External Assessments and Attestations, and Certifications: Annual vulnerability and penetration tests and data privacy and protection reviews are performed by third -party experts. No significant findings were identified. OPKO maintains industry certifications such as SOC 2 Type 2 and PCI DSS attestations.


text: Board Oversight: The Audit Committee of the Board has direct oversight, regularly reviews reports on cybersecurity risks and vulnerabilities. The Audit Committee is informed about risk assessments, progress of risk reduction initiatives, and feedback from external auditors. Our chief compliance & audit officer ("CCO/CAO") and his direct report, chief information security officer ("CISO"), have primary responsibility for assessing and managing material cybersecurity risks. The CCO/CAO reports to the Audit Committee, which is the primary governing body that drives alignment on security decisions across the Company. The Audit Committee meets at least four times a year on cybersecurity and such meetings are attended by the CCO/CAO, CISO, in-house counsel, chief financial officer ("CFO"), corporate controller, associate general counsel, and other senior company executives as needed to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Audit Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation.


text: Expertise and Leadership: Our Chief Compliance & Audit Officer (CCO/CAO) possesses over 28 years of experience in Cyber Security and IT Controls across various complex organizations, including initial tenure at Boston University Medical Center, followed by roles at PricewaterhouseCoopers, Biogen, Vertex Pharmaceuticals, and currently OPKO Health for the past 7 years. The CCO/CAO has a master's degree in Computer Science with a specialization in Cyber Security from Boston University, a qualifying UK law degree from the University of Edinburgh, an MBA in Accounting, and a Master's of Finance from Northeastern University, in addition to a BA in Economics from Dartmouth College.