text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Technology providers identifies and addresses known cybersecurity risks on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process. We are not aware of any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition as of the date of this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into its overall risk management systems and processes. The Company routinely assesses material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through its information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein.

companyName: GOLD RESOURCE CORP

ticker: GORO

secItem: Item 1C


text: The Company conducts periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: One of the key functions of the Board is informed oversight of the risk management process, including risks from cybersecurity threats. The Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect it or its business strategy, results of operations, or financial condition. For more information regarding the expertise of the Board as it relates to cybersecurity, see the section entitled "Governance" in the Company's definitive proxy statement relating to the 2024 Annual Meeting of Stockholders filed with the SEC on April 29, 2024.


text: Gold Resource Corporation Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare the Company to address cybersecurity risks. As part of the overall risk management system, the Company monitors and tests safeguards and trains employees on these safeguards. Personnel at all levels and departments are made aware of the cybersecurity policies through trainings.


text: Cybersecurity Threats As of December 31, 2024, the Company has not identified an indication of a cybersecurity incident that would have a material impact on the Company's business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: Glen Burnie Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Senior Vice President, Director of Information Technology. In addition, the Internal Auditor, Information Security Officer, and Compliance Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: The Senior Vice President of Information Technology ("IT") works with the Managed Service Provider (MSP) information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, standards, and architecture processes. The Director of IT is responsible for the IT-related security policies. The Director of IT, in coordination with compliance, the information security officer, and human resources, conducts at least annual and ongoing company-wide information security awareness training. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the Director of IT, vendor management team and the business department head assessing cybersecurity robustness during vendor review before onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Senior Vice President, Director of IT and the Information Security Officer on Glen Burnie Bancorp's cyber risks and threats, the status of projects to strengthen Glen Burnie Bancorp's information security systems, assessments of Glen Burnie Bancorp's security program, and the emerging threat landscape. Additionally, the Information Technology Committee drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. Glen Burnie Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Information Technology Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Information Technology Committee and Board of Directors.


text: Board of Directors The Audit Committee oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Company's Head of Information Technology ("Head of IT") provides reports on cybersecurity matters, including material risks and threats, annually or more frequently as appropriate to the Board, including to the Audit Committee.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Under the oversight of the Audit Committee, and as directed by the Head of IT, Company management is primarily responsible for the assessment and management of material cybersecurity risks.


text: The Head of IT brings over a decade of extensive experience in global technology organizations spanning various industries. With a background encompassing more than a decade of expertise in information security, risk management, and compliance, The Head of IT has successfully led cyber security initiatives and ensured compliance with regulatory standards such as the Health Insurance Portability and Accountability Act and The Telephone Consumer Protection Act. The Head of IT is also supported by an Incident Response Team Security Officer ("IRT Security Officer") who provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents. The Company's IRT Security Officer has completed rigorous cybersecurity awareness and threat response training and has the skills to develop effective incident response plans and swiftly mitigate emerging cyber threats. The IRT Security Officer enhances the Company's cybersecurity posture and readiness with expertise in threat detection, incident coordination, and remediation.


text: All dollar amounts expressed in thousands, except per share amounts The Head of IT oversees the Company's cybersecurity incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The Head of IT also coordinates with the Company's General Counsel and interim Chief Financial Officer (the "Interim CFO") to assess and manage material risks from cybersecurity threats. The Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: The Company's Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Interim CFO, General Counsel, Vice President of Investor Relations and Communications, Corporate Controller, and Financial Reporting Manager. The Cybersecurity Subcommittee of the Company's Disclosure Committee is comprised of, among others, the Company's Interim CFO, Head of IT, General Counsel, Corporate Controller, and IRT Security Officer.


text: The Head of IT, or a delegate, informs the Cybersecurity Subcommittee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes. The Cybersecurity Subcommittee is also primarily responsible for advising the Disclosure Committee and the Company's CEO and Interim CFO regarding cybersecurity disclosures in public filings. The Head of IT, with the General Counsel in attendance, also notifies the Audit Committee chair of any material cybersecurity incidents.


text: Risk Management and Strategy We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues which may arise in the most timely and aggressive fashion.

companyName: UR-ENERGY INC

ticker: URG


text: As potential new threats to security are identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our IT Manager and expert consultants who report to our Chief Financial Officer. Our Chief Financial Officer has relevant expertise gained from nearly 20 years' experience overseeing our information technology matters, including cybersecurity concerns. With respect to cybersecurity, our consultants support our risk assessment and scoring, securing devices and networks, vulnerability management, proactive monitoring, responding to cyber threats and more. They act as our security operations center, as well as a seamless extension of our IT department.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and HSE & Technical Committee of the Board each having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirements. In addition to its other responsibilities, the HSE & Technical Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.


text: Members of our Board each have a practical understanding of information systems, and the technology used in our business operations, as well as a recognition of the risk management aspect of cyber risks and cybersecurity; members of the Board are encouraged to review materials on these issues or attend informational sessions. The HSE & Technical Committee and/or the full Board receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. Management and our Board recognize that this is an evolving environment and therefore our analyses of the risks and risk management are also evolving. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," above.


text: Risk Management and Strategy Cybersecurity is an important component of our overall approach to risk management. We have implemented cybersecurity processes, technologies and controls to facilitate our efforts to identify, assess and manage material risks from cybersecurity threats. We leverage industry associations, third-party benchmarking, results from internal and third-party testing, and other similar resources to inform our cybersecurity programs and processes. We also adhere to applicable Payment Card Industry Data Security Standards. We have prioritized improving our cyber security posture to safeguard our systems and mitigate risks.

companyName: Citi Trends Inc

ticker: CTRN


text: Our cybersecurity programs include physical, administrative and technical safeguards designed to help us detect and prevent cybersecurity threats and incidents. We monitor our cybersecurity programs and processes through assessments focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. In addition, we have engaged third parties to perform reviews of our information security control environment, and to provide expertise on various cybersecurity programs and issues. Our cybersecurity team has established a written incident response plan in the event of an incident. We do not retain any sensitive customer data on our systems.


text: We have not experienced any material cybersecurity incidents in fiscal 2024, and as of the date of this Report, we have not identified any material risks from active cybersecurity threats, including as a result of any prior cybersecurity incidents. However, despite our security measures, there can be no assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain insurance to mitigate potential losses from a cybersecurity incident, such insurance may be insufficient to cover all losses or all types of claims that may arise. See Item 1A. Risk Factors in this Report for a discussion of whether and how risks from identified cybersecurity threats have materially affected or, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Mesabi Trust does not have any directors, officers or employees. The Corporate Trustee is responsible for oversight of Mesabi Trust's risks from cybersecurity threats as it relates to financial record keeping, cash and investment management, administration and reporting. The Corporate Trustee also serves as registrar and transfer agent for the Trust. The Corporate Trustee has dedicated personnel responsible for assessing and managing Mesabi Trust's cyber risk management efforts, informing senior management of the Corporate Trustee regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts. The Corporate Trustee's information technology team has significant experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Corporate Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Corporate Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Corporate Trustee. The Corporate Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Corporate Trustee's overall risk management process. The Corporate Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions, computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Corporate Trustee has an annual assessment, performed by a third-party vendor, of the Corporate Trustee's cyber risk management program. Other non-technical protocols include securing of documents and work areas that could contain non-public information and independent verification of information changes by outside vendors. Mesabi Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, results of operations, cash flows or reputation. The Corporate Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Mesabi Trust's focus, financial condition, results of operations, or cash flows. See "Risk Factors – General Risk Factors – The Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, financial record keeping, investment management, reporting, results of operations, cash flows or reputation."

companyName: MESABI TRUST

ticker: MSB


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management policy intended to protect the confidentiality, integrity and availability of our critical systems and information. Our policy establishes the framework for managing cybersecurity risks and outlines the measures and protocols to protect our information systems. Our risk management and strategy is managed by our third-party IT Management Service Provider, Network Center, Inc. ("Network Center") with oversight by our VP of Operations. Our policy applies to all employees, contractors, and all third-party partners who have access to our information systems. Our cybersecurity risk management policy is integrated into our overall enterprise risk management processes.

companyName: Lodging Fund REIT III, Inc.


text: Our risk management policy includes continual monitoring by Network Center, as they manage our technical defenses. Risk assessments and penetration testing are performed on a quarterly basis to identify and mitigate potential threats. Procedures have been implemented for identifying, evaluating and addressing vulnerabilities. Additionally, vulnerability assessments are performed monthly by Network Center. An additional part of our risk management strategy is having a clear process for reporting cybersecurity incidents and the development and maintenance of an incident response plan to address and mitigate the impact of cybersecurity incidents.


text: A key component of our risk management and strategy surrounds data protection. We have implemented strict access controls for each individual employee to ensure only authorized personnel can access sensitive and confidential data. All digital communication is pre-screened for potentially malicious actions through a dedicated email security provider. For additional protection, we have implemented multi-factor authentication along with email encryption to ensure data is protected while at rest and in transit. We are also protected through a multilayered approach to security through the ESET Protection Platform, which provides formidable defense through cyber threat prevention, detection and response.


text: In addition, we provide regular cybersecurity training to all employees on a quarterly basis and conduct ongoing awareness programs to keep employees informed about cybersecurity best practices. Employees have been trained, enabling them to detect and report on any malicious intrusions or social engineering attempts to infiltrate our systems. They are also regularly trained, tested and reported on through KnowB4 spear-phishing email campaigns to ensure our training is effective. We are fully insured for cyber risk through our insurance provider.


text: Our board of directors is responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On an annual basis, management receives a report from Operations Management on our cybersecurity threat risk, management processes, and strategies. In addition to annual meetings, our board of directors, management and Audit Committee are notified of any cybersecurity incident, its threat level and the response. The threat level and response are evaluated and documented in a report by Operations leadership and our IT Services Provider. Based on our board of directors and Audit Committee review of the incident report, they determine if the findings require disclosure to the SEC.


text: Our cyber security policies and procedures are reviewed and updated annually or as needed to address any emerging threats and changes in regulatory requirements.


text: To date, there have been no confirmed cyber security breaches, unauthorized intrusions or threats detected within our mainframe operating systems, our encrypted e-mail servers, or our advanced firewall protections, and we have not identified risks from known cybersecurity threats, that have materially affected or that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors – We and our hotel managers and franchisors rely on information technology in our operations, and any material failure, inadequacy, interruption, cyber-attack or security failure of that technology could harm our business."


text: Cybersecurity Risk Management and Strategy The Bank's information security program is designed to protect sensitive, confidential, and non-public personal information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public personal information, financial data, and internal operational information. Our Chief Information Officer ("CIO") manages our information security strategy and development as overseen by our overarching Enterprise Risk Management ("ERM") program.

companyName: Primis Financial Corp.

ticker: FRST


text: The Bank's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products, and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.


text: The Bank's Network Team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Network Team also actively monitors the Bank's networks and systems to detect suspicious or malicious events, and contracts with third-party consultants to perform penetration testing and routine vulnerability scans. A third-party managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.


text: We maintain policies and procedures for the safe storage, handling, and secure disposal of customer and employee information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could place sensitive customer or employee information at risk. We employ a number of technical controls to mitigate the risk of phishing emails targeting employees.


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CIO who closely coordinates with the Bank's Information Technology team. The Incident Response Plan describes the Bank's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Bank's Executive Management, including the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Risk Officer ("CRO"), and the Board of Directors. We regularly test the Incident Response Plan, including through tabletop exercises, and document lessons learned. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents.


text: The Bank conducts due diligence prior to engaging third-party service providers which have access to the Bank's networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Bank's policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Primis conducts ongoing monitor of third-party service providers/vendors on a risk-based approach.


text: We continue to optimize our business continuity and disaster recovery plans aligned to the pervasive nature of cybersecurity incidents and threats. We also increased our cyber insurance which aligned to strengthen our internal systems. While the Bank has encountered, and will continue to encounter, cyber incidents in the normal course of business, to date, the Bank has not experienced a cybersecurity incident that has materially impacted our business strategy, financial condition, or results of operation. Despite our ongoing efforts to continually strengthen our cybersecurity program, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in safeguarding our systems and information. We face risks from certain cybersecurity threats that, if realized, could reasonably be expected to materially affect our business strategy, financial condition, or results of operation. See "Item 1A. Risk Factors – Operational Risks" in this 10-K for additional information.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing the Bank's business and affairs, including risks associated with cybersecurity threats. The ERM Committee ("ERMC") of the Board has primary responsibility for overseeing the Bank's comprehensive ERM program, including its cybersecurity program. The ERM program assists the Executive Management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both Audit Committee ("AC") and ERMC meetings.


text: The Board's oversight of cybersecurity risk is supported by our CIO. The CIO attends ERMC meetings and provides cybersecurity updates to these Board committees on a quarterly basis. Our CRO, in conjunction with our CIO, facilitates the involvement of the ERMC in oversight of potentially significant cybersecurity incidents.


text: The Bank's CIO directs the Bank's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CIO manages the Bank's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CIO is also responsible for the Bank's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CIO, the Network Team examines risks to the Bank's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. Our CIO has worked in the financial services industry for over 20 years and held similar roles at other financial institutions including four years as a Chief Information Officer. Our CRO has over three decades of experience in risk management, and our Network Team collectively has over 19 years of experience in cybersecurity operations.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our policies over areas such as information security, access on/offboarding, and access and account management help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows and/or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We believe cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries, as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluate the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: The Audit Committee, under oversight of the Board of Directors, has responsibility for oversight of risks from cybersecurity threats, and the assessment and management of cybersecurity risks is the responsibility of the Information Security ("INFOSEC") team. The INFOSEC team is managed by the Vice President, Information Technology, who reports to our Chief Financial Officer. Our current Vice President, Information Technology and other members of our INFOSEC team collectively have more than 60 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.


text: Upon the identification of a cybersecurity incident, the Incident Response Team ("IRT") initiates our Security Incident Response Policy. This includes determining the scope and risk level of the incident, the incident response, and the steps necessary to reduce the likelihood of reoccurrence. Depending on the severity of the incident, the IRT reports the incident to the Audit Committee, as well as communicates with other appropriate stakeholders. In addition, a summary of cybersecurity incidents, results of testing, corporate security training and planned enhancements are reported to the Audit Committee at least quarterly by the Vice President, Information Technology.


text: Our third-party business partners also play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party business partner risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new third-party business partners and maintain ongoing evaluations to ensure compliance with our security standards.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, nor are we aware of any cybersecurity risks that are reasonably likely to have, a material adverse impact our business strategy, results of operations, or financial condition. Notwithstanding the extensive approach that we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion of the risks we face from cybersecurity threats, see risk factor titled "Our management information systems and databases could be disrupted by system security failures, cyber threats or by the failure of, or lack of access to, our Enterprise Resource Planning system. These disruptions could negatively impact our sales, increase our expenses, subject us to liability and/or harm our reputation." in Item 1A. "Risk Factors."


text: Our information technology personnel and our senior management lead the operational oversight of the company -wide cybersecurity strategy and processes. The board of directors provides oversight of our cybersecurity risk. Additionally, the board of directors reviews our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of cybersecurity in upholding the safety and security of our systems, services and data and maintaining the trust of our customers. Cybersecurity risk management is an important part of, and is integrated into, the Company's overall enterprise risk management program. We maintain a cybersecurity risk management program that is designed to identify, assess, manage and mitigate cybersecurity risks and provides a framework for responding to cybersecurity threats and incidents. We regularly assess and update our cybersecurity risk management program and our cybersecurity posture to protect the confidentiality, integrity and availability of the Company's and our customers' infrastructure, resources and information.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Risk-based, layered controls – We regularly assess and adjust our technical controls and methods to identify, respond to and mitigate emerging cybersecurity risks and use a layered approach with overlapping controls to defend against cybersecurity attacks and threats to our networks, end-user devices, infrastructure, applications, data and cloud solutions and the data that our customers entrust to us.


text: Cybersecurity incident response plan and testing – We have a global incident response process and dedicated teams responsible for monitoring, detecting and responding to cybersecurity threats and attacks, whether external or internal, periodically testing our processes and protocols, and regularly communicating and providing reports to our CISO, Security & Resiliency global practice leader and senior executive leadership.


text: Training and awareness – We use a combination of training and education, including mandatory annual cybersecurity and privacy training, phishing simulation exercises and a multitude of alerts, educational tools, videos and other ongoing awareness initiatives on a variety of topics relating to the rapidly evolving threat landscape, throughout the year that foster a culture of security awareness and responsibility among our workforce.


text: Supplier risk assessments – Recognizing that our suppliers can be subject to cybersecurity incidents which may impact us and our customers, our procurement process includes security, data governance and privacy risk assessments to identify and evaluate risk associated with certain key suppliers, including reviewing relevant cybersecurity certifications and third-party audit results, assessing technical and organizational controls and evaluating their risk profile.


text: We periodically engage third-party security consultants to conduct evaluations of our cybersecurity controls and procedures, including penetration testing, third-party audits, and reassessing best practices to address new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls and procedures. Our internal audit function conducts additional reviews and assessments of our cybersecurity controls and procedures and reports to the Audit Committee and the Board of Directors as appropriate. We use the findings from these efforts to improve our practices, procedures and technologies.


text: Cybersecurity Risk Oversight and Governance Our Board of Directors is responsible for the overall oversight of our enterprise risk management. The Audit Committee periodically reviews the Company's enterprise risk management framework, including enterprise risk management processes, and assists the Board of Directors in its oversight over certain key areas of risks, including overseeing cybersecurity, data governance and privacy risk and regularly reporting on such matters to the Board. The Audit Committee and full Board of Directors receive periodic updates from our CISO about Kyndryl's cybersecurity policies and practices, cybersecurity developments, trends, risks, notable incidents, mitigation strategies, maturity initiatives and other developments throughout the year, as well as periodic updates from our CIO, Security & Resiliency global practice leader and other senior leaders on cybersecurity-related matters.


text: Our information security program is led by our CISO, who is responsible for the overall security of the enterprise, and our Security & Resiliency global practice leader, who is responsible for the security of the services that we provide to customers. Our CISO and Security & Resiliency global practice leader collaborate closely with one another and other key stakeholders across the Company in developing and implementing our cybersecurity strategy, policy, controls, operations, threat detection and incident response and remediation. Our teams that support the CISO and Security & Resiliency global practice leader in these efforts are comprised of cybersecurity professionals with many years of experience in cybersecurity across multiple sectors, including heavily regulated industries such as financial services and defense, and many of them hold relevant industry certifications.


text: Under our global incident response process, cybersecurity incidents are assessed and classified by severity, and significant incidents are escalated as appropriate to senior executive leadership. In addition, we have a process to promptly notify the Board of Directors, as appropriate, in the event of any cybersecurity incident impacting the Company that may be material.


text: We face various cybersecurity threats as a prominent target, including denial-of-service attacks, ransomware, phishing, and advanced persistent threats. As an aerospace and defense company providing advanced defense technologies and services to the U.S. and foreign governments, these threats are not just from low-level threat actors, but rise to the level of sophisticated threat actors from organized and funded adversaries, including groups affiliated with various nation states. Our customers, suppliers, subcontractors, and vendors also face similar threats. Cybersecurity incidents impacting us, or any of these third parties, could have a material adverse effect on our operations, financial condition, and results of operations. Given the cybersecurity risks we face, we dedicate ample resources to addressing and mitigating our cyber risks.

companyName: AeroVironment Inc

ticker: AVAV


text: Risk Management and Strategy Our cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber risks and incidents. Our cybersecurity program is part of our internal risk management processes, and we continually improve our cybersecurity practices as new threats and vulnerabilities emerge.


text: Our Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), and Vice President of Cybersecurity, all within our "CIO organization," lead our Detection and Response Team ("DART") which is responsible for our cybersecurity incident response processes pursuant to our Incident Response Plan and playbooks. The DART also includes members of our IT department responsible for supporting the technologies and processes to protect against, detect, contain, mitigate, and recover from cybersecurity incidents. The DART evaluates and assigns severity levels to cybersecurity incidents and, based on the severity, escalates and engages incident response teams to respond to and mitigate the risks.


text: Our cybersecurity team proactively hunts for cyber threats and vulnerabilities in our networks and information systems as part of our cyber risk management program. This includes monitoring our networks and systems for indicators of compromise ("IOCs"), active intrusion attempts, and other suspicious activity, including insider threat risks. The cybersecurity team stays apprised of existing and emerging cybersecurity threats through commercial threat intelligence feeds and by partnering and data sharing with third parties such as the U.S. government, law enforcement agencies, customers, and other Defense Industrial Base ("DIB") participants. We also engage third parties to conduct evaluations of our cybersecurity controls by performing penetration testing and controlled cybersecurity framework audits. We also review the cybersecurity practices of our third-party service providers and suppliers.


text: We require our employees to take cybersecurity-related training regularly to promote awareness of how to detect, report, and respond to cybersecurity threats. Employees with certain roles and responsibilities are also assigned cyber training for their specific functions. We also maintain an Insider Threat program, headed by our Director of Security, to identify, assess, and deal with potential risks from within our company, including cybersecurity risks.


text: We have aligned our cybersecurity program to the National Institute of Standards and Technology's ("NIST") published cybersecurity standards, and our policies and processes are compliant with NIST Special Publication 800-171 and other applicable publications. Given our status as a defense contractor, we are subject to numerous regulations, including those pursuant to the Defense Federal Acquisition Regulation Supplement ("DFARS"), requiring us to have controls in place to protect U.S. government CUI and to report cybersecurity incidents to the DoD.


text: We are also subject to the DoD CMMC requirements which necessitates that companies receiving, storing, or processing federal contract information ("FCI") and CUI be formally assessed by a CMMC C3PAO. AeroVironment, Inc., including its subsidiaries Arcturus UAS and Tomahawk Robotics (but excluding any of the BlueHalo acquired entities) is scheduled for a formal Level 2 assessment. The recently acquired BlueHalo passed a formal CMMC Level 2 assessment under the CMMC 2.0 framework, which went into effect December 16, 2024. If we fail to achieve or maintain certification ahead of contract awards, or if we fail to achieve the level required for a particular contract, we will be unable to bid on new contracts or follow-on efforts containing CMMC clauses, which could adversely impact the success of our operations. Additionally, our subcontractors and certain vendors may need to obtain CMMC certification, and we may be negatively impacted if they are not compliant with the CMMC requirements.


text: Our CIO, CISO, and VP of Cybersecurity, each with 20+ years of related experience, are responsible for the day-to-day management of our cybersecurity program and cybersecurity risks. Our CISO and team are primarily responsible for our overall cybersecurity risk management program and supervise both internal and external resources to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and incidents.


text: We have internal Cybersecurity Council which meets monthly to help communicate our enterprise cybersecurity strategy and ensure it is implemented across the business, as well as maintain awareness of events and changes occurring throughout the business. The Cybersecurity Council consists of members from our CIO organization as well as senior leadership from various functional areas of the business.


text: The CISO and VP of Cybersecurity report cybersecurity incidents to members of the company's senior management, including the Cybersecurity Council, CIO, CEO, and the Board of Directors based on the severity and type of the incident to ensure proper external reporting is completed thoroughly and timely. Pursuant to its charter, the Cybersecurity Committee of our Board of Directors is responsible for reviewing, discussing, and making recommendations to the full board regarding cybersecurity matters. Our CIO, CISO, and VP of Cybersecurity provide presentations to the Cybersecurity Committee on our cybersecurity program at each of the committee's regularly scheduled quarterly meetings. These briefings include assessments of the cyber risk and threats landscape, updates on incidents, policies and procedures, and our investments and plans in cybersecurity risk mitigation and governance. The Cybersecurity Committee also meets with members of the Cybersecurity Council to discuss various aspects of our cybersecurity program between regular meetings. All members of the Board of Directors are invited to attend all meetings of the Cybersecurity Committee, and the committee regularly briefs the entire board regarding their oversight of our cybersecurity program.


text: Cybersecurity Threats We have experienced cybersecurity incidents in the past and will experience cybersecurity incidents in the future. Prior cybersecurity incidents have not materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition; however, there is no guarantee that a future cybersecurity incident would not have a material adverse effect on such items. While our cybersecurity program is designed to mitigate cybersecurity risks, we cannot eliminate all risks from cybersecurity threats. See Item 1A. Risk Factors for more information on our cybersecurity risks.


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and business operations, including vetting and managing third-party service providers with comprehensive due diligence, continuous monitoring and strict compliance with industry standards. In addition, we provide cybersecurity awareness training to our employees, incident response personnel, and senior management, including training on best practices for data privacy and security. Our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.

companyName: Capstone Green Energy Holdings, Inc.

ticker: CGEH


text: The Board is responsible for overseeing assessments of major risks facing the Company and for reviewing options to mitigate these risks. It has delegated oversight responsibility for information security matters to the Audit Committee, Chief Financial Officer ("CFO") and our internal information technology ("IT") resources. Our Director of IT manages our internal team of security professionals, as well as our third-party IT service providers, which provides 24/7 security monitoring. The personnel comprising our IT team include a certified information system security professional and other professionals with many years of experience across a variety of technological sub-specialties.


text: Our CFO oversees our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives updates from IT and our third-party IT service providers on cybersecurity and information security matters. The CFO communicates with the Audit Committee and the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes. We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Audit Committee and the Board for timely and accurate reporting of any material cybersecurity incident. The incident response plan is reviewed and tested in the annual cybersecurity desktop exercise.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional discussion of our cybersecurity-related risks, see Part I, Item 1A, "Risk Factors."


text: Risk Management and Strategy Assessing, Identifying and Managing Material Risks Our cybersecurity program is focused on assessing, identifying, and managing risks arising out of our use of information technology including the risk of cybersecurity incidents and threats. Our program is informed by recognized frameworks (such as the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework) and leverages external and internal expertise, as appropriate. Our program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, regular awareness exercises, and employee outreach activities including cybersecurity tech talks, on-site digital signage, intranet resources, CEO cybersecurity champion recognition at quarterly town hall meetings, and other targeted communications. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our internal cybersecurity team.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Activities to assess vulnerabilities including penetration testing, red teaming, tabletop exercises, and phishing and social engineering drills Engagement with law enforcement and U.S. government agencies, directly and through memberships in various cybersecurity intelligence and risk sharing organizations to help us stay informed about evolving threats Utilization of third-party experts to test, validate, and strengthen our plans, practices, and policies Technology team collaboration sessions to share information across different teams, geographic areas, and areas of responsibilities Assessing and managing cybersecurity risks arising out of the use of third-party technology and services, including pre-contract diligence, imposition of contractual obligations, and performance monitoring Learnings from these activities are used to inform our training, guide our incident response preparedness and enhance our plans and processes. To further inform our cybersecurity program, we also participate in discussions with third-party service providers who have experienced cybersecurity incidents.


text: Investment in Cybersecurity Program The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in several key areas including investing in our employees through talent recruitment, retention, training and development, investing in external resources including procuring and deploying the correct tools to monitor, evaluate, and address threats, investing employee resources to maintain effective processes, and investing in strategic relationships to monitor evolving risks including third-party service provider vulnerabilities. While our third-party service providers have experienced cybersecurity incidents and we have experienced threats to our data and systems, to date, we are not aware that we have experienced a breach that had a material impact on our operations or business, however, cybersecurity risks that may materially impact the Company are discussed in more detail in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity and Information Technology Risks," which should be read in conjunction with the foregoing information.


text: Conagra's Cybersecurity Team is led by our Chief Information Security Officer (CISO). Our CISO, a certified information security professional, has more than 25 years of cybersecurity leadership experience across multiple industries and holds a Doctor of Science (DSc) degree in Cybersecurity. The CISO reports to our Chief Information Officer (CIO), who has been with Conagra for more than 20 years serving in various leadership roles in information technology, finance, and business services. We believe our CIO possesses a firm understanding of the Company's cybersecurity landscape, risks, and knowledge of the capabilities of our cybersecurity and information systems personnel.


text: Our management periodically evaluates information provided by consultants on evolving cybersecurity risks and, based on management's assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: CytoDyn Inc.

ticker: CYDY


text: Risk Management and Strategy The Company relies heavily on its information systems, and the availability and integrity of these systems is essential to conducting its business and operations. As a developer of modern energy economy technology systems and services, the Company faces various security threats, including cybersecurity threats, to gain unauthorized access to its sensitive information or to render its information or systems unusable, and threats to the security of its facilities and infrastructure or third-party facilities and infrastructure, such as gathering and processing and other facilities, and pipelines. This risk may be heightened as a result of an increased remote working environment, similar to the one created by the COVID-19 outbreak in 2020. The potential for such security threats subjects its operations to increased risks that could have a material adverse effect on its business, financial condition, results of operations and cash flows.

companyName: ConnectM Technology Solutions, Inc.

ticker: CNTM


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We operate in markets that are dependent on Information Technology (IT) systems and technological change. Failure to maintain and support customer-facing services, systems, and platforms, including addressing quality issues and execution on time of new products and enhancements, could negatively impact our revenues and reputation" and "Risk Factors – The failure to prevent a cybersecurity incident affecting our systems could result in the disruption of our services and the disclosure or misappropriation of sensitive information, which could harm our reputation, decrease demand for our services and products, expose us to liability, penalties, and remedial costs, or otherwise adversely affect our financial performance".

companyName: Stride, Inc.

ticker: LRN


text: Our management team, including our Chief Information Security Officer ( CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 20 years of experience managing the security and compliance organization for global companies, providing online and cloud-based services to more than a majority of the Fortune 500 and the United States Government.


text: Cyber Risk Management Strategy Adtalem recognizes the importance of safeguarding sensitive information pertaining to our students, employees, institutions, and operations. Our Cyber Risk Management Framework ("CRMF") is designed to fortify our defenses against potential cyber threats and to protect the integrity, confidentiality, and availability of critical data. Our CRMF includes continuous risk assessments, threat modeling, vulnerability scans, and monitoring for indicators of compromise. These assessments inform control implementations based on likelihood and impact to operational, financial, and reputational harm.

companyName: Covista Inc.

ticker: CVSA


text: Program Highlights The CMRF is anchored by our Enterprise Information Security Framework ("EISF"), which adheres to the guidelines set forth by the National Institute of Standards and Technology ("NIST") 800-53 Framework. To enhance comprehensiveness, our policies also harmonize with other leading frameworks such as the ISO 27001 Standard, Family Educational Rights and Privacy Act of 1974 ("FERPA"), Payment Card Industry Data Security Standard ("PCI DSS"), Gramm-Leach-Bliley Act ("GLBA"), California Consumer Privacy Act ("CCPA"), General Data Protection Regulation ("GDPR"), and other pertinent local, state, national, and international regulations governing data privacy and information security. Our cybersecurity program has adopted controls mapped to these frameworks and incorporated them into Adtalem's policies, risk registers, control testing plans, and vendor assessments.


text: Our Chief Information Security Officer ("CISO") manages Adtalem's enterprise-wide cybersecurity program and reports to Adtalem's Chief Financial Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Adtalem since 2018. The CISO has over twenty years of information technology and cybersecurity experience, including executive leadership roles at Fortune 500 organizations within regulated sectors including financial services and healthcare. The CISO leads a team of experienced subject matter experts with focus on strategy formulation, architecture design, incident response, colleague training, risk management, and governance functions. This team includes diverse industry backgrounds spanning financial services, healthcare, and government. The CISO provides regular updates to executive management and ensures independent validation of key controls through internal and external reviews. The CISO's function operates independently of IT operations, with direct access to the Audit and Finance Committee as needed.


text: The CISO team is supported by a Security Operations team reporting into the Information Technology ("IT") function. This IT team provides engineering and technical expertise. The team is further supported by a 24x7 Security Operations Center ("SOC"). Adtalem has a Cyber Incident Response Plan ("Incident Response Plan") that delineates the requirements of notification, classification, analysis, and communication of cybersecurity incidents based on the identified severity level. The Incident Response Plan includes initial steps to convene a response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and possible disclosure requirements, and consider involving law enforcement. The Incident Response Plan also provides for a lessons learned review to identify improvements that could be made. Adtalem's Legal and Compliance teams also provide incident response support to the CISO and manage cybersecurity-related legal and compliance issues. Processes are in place to escalate cybersecurity incidents promptly so that decisions regarding public disclosure and regulatory reporting can be made by management in a timely manner.


text: An integral component of Adtalem's Incident Response Plan is our Privacy Incident Response Plan (the "Privacy Response Plan") which addresses privacy of our students' records, including under the FERPA. The Privacy Response Plan requires annual training for our employees on how to recognize and report potential privacy incidents.


text: We regularly conduct Incident Response Plan tabletop exercises, including simulations of malware and ransomware attacks. Our IT environment and cybersecurity-related controls are reviewed by our internal audit function and external third parties. We sponsor third-party assessments, including cyber risk reviews and penetration testing, to evaluate our cybersecurity program independently.


text: Adtalem subjects its systems to penetration testing to identify potential exposures, ensuring that our infrastructure maintains an acceptable level of cyber risk. In addition, Adtalem leverages third-party experts to enhance its cybersecurity program and Incident Response Plan. Our organization has not identified or discovered any cybersecurity threats over the past three fiscal years that have materially impacted or are reasonably likely to materially impact our business strategy, operations, or financial condition. Expenses related to cybersecurity incidents have not been material.


text: Our year-round cybersecurity awareness program mandates training for all system users, covering essential topics such as safeguarding sensitive information, identifying phishing attempts, securing mobile devices, and understanding the risks associated with artificial intelligence ("AI") platforms. Our cybersecurity awareness training is mandatory for all employees and is conducted at least annually, with targeted phishing simulation campaigns conducted throughout the year. Third-party suppliers are subject to a formal onboarding process that includes completion of a cybersecurity questionnaire, review of SOC 2 or ISO certifications where available, and risk scoring. New engagements with third parties are contingent upon affirmative evaluations or adherence to risk mitigation/acceptance protocols. Contracts with third parties include provisions for breach notification, investigation, root cause analysis, and remediation.


text: Cybersecurity is acknowledged as an important enterprise risk at Adtalem. Our Audit and Finance Committee ("AFC"), comprised entirely of independent directors, is responsible for oversight of risks from cybersecurity threats. The Chair of our AFC has received a CERT certificate in Cybersecurity Oversight from Carnegie Mellon University in partnership with the National Association of Corporate Directors. Our CISO briefs the AFC on cybersecurity matters, including the evolving threat landscape and Adtalem's threat mitigation efforts, four times a year. At each quarterly meeting, the Chair of our AFC also briefs the full Board on cybersecurity matters discussed at AFC meetings. Cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of our annual enterprise risk management ("ERM") assessment.


text: Cybersecurity Governance and Oversight Bio-Techne's cybersecurity program is led by the Company's Chief Information Officer ("CIO"), with day-to-day management and administration of our cybersecurity program performed by the Director of IT Infrastructure and Security and the IT Security Operations team. The Director of IT Infrastrcuture and Security reports to the CIO, and the CIO reports to the Chief Financial Officer. The CIO is supported by the Incident Response Team ("IRT"), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions. The IRT supports the CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation. In addition to leadership and support within management, we also work with security service providers to monitor for vulnerabilities and threats, and which are reported to the Security Operations team. All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises. We also conduct periodic tabletop exercises for key personnel involved in cybersecurity risk management, including the IRT.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Bio-Techne's General Counsel updates the Audit Committee multiple times per year regarding Bio-Techne's cybersecurity programs, including regularly-tracked metrics on incident response, internal security testing, and measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Audit Committee regularly updates the full Board on these matters. In addition, on at least an annual basis, the CIO provides the full Board with a thorough review of the Company's cybersecurity program, including current status, industry risks and exposure, and future strategy.


text: Cybersecurity Risk Management and Strategy Bio-Techne's cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our internal and our customers' data while supporting our and our customers' business needs. Our cybersecurity program follows industry standards and best practice for preventing, detecting, remediating, and mitigating potential cybersecurity threats, including regular processes to identify, evaluate and manage potential risks.


text: We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity, including risks arising from our use of third-party providers software and service providers. In addition to our evolving processes and systems, we foster a culture of cybersecurity education, training, and testing. Every year, employees must take and pass rigorous information security and protection training.


text: Risk Management and Strategy As a leading global, diversified animal health and mineral nutrition company, we are increasingly reliant on information technology systems and infrastructure to support critical operations and manage our business effectively. These systems process, transmit, and store electronic information, including customer, employee, and company data. This reliance exposes us to data security breaches and cybersecurity attacks. For more information on these risks, see "Item 1A. Risk Factors — Risk Factors Relating to Our Business — We may be subject to information technology system failures, network disruptions, and breaches in data security."

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Although the aggregate impact on our operations and financial condition has not been material to date, the Company has been the target of cybersecurity attacks and anticipates continued attempts as threats become more sophisticated and frequent. Future incidents may have a material effect on our business.


text: Our information security program is led by the Director of IT Cybersecurity and Compliance, who reports directly to the Chief Information Officer (the "CIO"). The program is aligned with the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Israel National Cyber Directorate. We are also members of the New Jersey Cybersecurity and Communications Integration Cell, which enhances our industry awareness and proactive response capabilities by facilitating information sharing, identifying attack profiles, and promoting continuous improvement.


text: We employ a range of tools and practices to assess, monitor, and mitigate cybersecurity risks. These practices extend to third-party service providers who have access to our systems and data. At least every two years, we engage an independent third party to conduct penetration testing and risk assessments of our cybersecurity posture.


text: Over the past year, we have made significant progress in strengthening our cyber defense capabilities. Our Security Operations Center and Managed Detection and Response services continue to evolve and improve daily. This progress is driven by real-time incident response, continuous team development, and the incorporation of lessons learned from both internal experiences and external industry intelligence. To complement these efforts, we have implemented an advanced cyber threat intelligence process that enhances our ability to detect threat actors, anticipate emerging risks, and align our detection and prevention strategies with global threat trends. Monthly cybersecurity training for all users; Bi-weekly phishing simulations; and A monthly interactive cyber awareness magazine.


text: The rapid emergence of AI technologies has had a notable impact on our operational and strategic environment. These technologies quickly entered our ecosystem, and we responded by implementing necessary user awareness programs and governance mechanisms. Responsible adoption of AI technologies remains a key focus area. Our efforts encompass raising organizational awareness, deploying suitable monitoring tools, and fostering innovation while ensuring compliance with privacy regulations and industry standards. Our program continues to evolve to ensure the safe, ethical, and compliant use of AI across the enterprise.


text: In parallel, we are enhancing our third-party cybersecurity and regulatory risk management framework. This includes a structured process for evaluating and monitoring external entities using standardized risk questionnaires, internal knowledge repositories, and validation procedures. These mechanisms are applied both prior to onboarding new suppliers, service providers, or technologies, and as part of periodic reviews of existing third-party relationships. Identify security and compliance gaps early in the vendor lifecycle;


text: Prioritize suppliers based on their risk profile and level of exposure; and Ensure that third-party engagements align with our corporate, regulatory, and contractual obligations. Together, these measures strengthen our organizational cyber resilience, regulatory preparedness, and long-term operational integrity.


text: In the event of a cybersecurity or data privacy incident, our triage team evaluates the probable frequency and magnitude of potential loss. Incidents are categorized by severity and escalated to the CIO, Chief Executive Officer, and the Senior Vice President, General Counsel, and Corporate Secretary ("Legal Counsel"), who determine any additional communication or disclosure requirements. The Board of Directors is notified of high-severity incidents. Each incident is followed by a formal investigation, root cause analysis, and remediation plan. Additionally, our cyber insurance program is reviewed regularly to ensure adequate coverage in support of our layered protection model.


text: Our CIO manages our information technology systems. He has over 45 years of experience in digital systems and technology in the animal health, bio-tech pharmaceutical, pharmaceutical, and oil and gas industries. He has held multiple leadership roles driving business value for investments in digital solutions. He also spent six years as a leader within internal auditing, providing experience and wisdom in business-driven risk management.


text: The CIO provides periodic reports to the Board of Directors, the executive management team, and our Legal Counsel. These reports include updates on our cybersecurity risks and threats, assessments of our information security program, and any changes in the threat landscape. Our information technology systems are regularly evaluated by internal and external consultants, with the results of the review reported to the executive management team and the Board of Directors.


text: Cybersecurity, Risk Management, Strategy and Governance There continues to be a rise in electronic fraudulent activity security breaches and cyber-attacks within the financial services industry. We are confronted with a spectrum of cyber threats, ranging from common attacks such as ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners. Maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and to maintain customer confidence in our financial services.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Oversight and Identification of Risks Associated with Third Parties Third party risk management is a component of our vendor management program. New vendors are reviewed prior to onboarding to ensure proper oversight and identify potential risks. Ongoing monitoring of emerging risks related to third-party services providers is performed periodically according to the vendor's risk rating. Vendor reviews include risk reviews for financial, reputation, information security, cybersecurity and business resiliency risk. These reviews are reported to the IT Committee and Board of Directors for approval..


text: Management and Board Oversight of Cybersecurity Risks Our cybersecurity program is managed by the Information Security Officer who leads our IS team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Officer provides periodic reports to the IT Committee and Board of Directors. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operations Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.


text: Processes for Assessing, Identifying and Managing Risks from Cybersecurity Threats We, like any other organization operating in the biotechnology and pharmaceutical space, are subject to cybersecurity threats. In order to be prepared to respond to a potential cybersecurity threat, we have implemented an Information Technology ("IT") Security Guidelines Policy. Such policy sets forth a framework for management of all Company-managed IT systems and equipment. In connection with such policy, we have also implemented an IT Security Incident Response Plan, which sets forth processes in the event of a suspected cybersecurity incident. The processes set forth in such IT Security Incident Response Plan are part of our overall enterprise risk management system. As set forth in the IT Security Incident Response Plan, we may engage third-party consultants to assist us with the response to any suspected cybersecurity incident. We engage third parties on a periodic basis in connection with our overall enterprise risk management assessment. With respect to third-party service providers that we may engage in connection with our day-to-day operations, we attempt to assess such service provider's processes regarding potential cybersecurity threats in connection with first engaging such service provider.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: Oversight of Risks Related to Cybersecurity Threats Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Head of Human Resources, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition for the years of financial statements presented in this report.


text: Notwithstanding the approach we take to cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of risks related to cybersecurity threats.


text: Oversight of Risks Related to Cybersecurity Threats Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: TXO Partners, L.P.

ticker: TXO


text: Key elements of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a team of IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; and • cybersecurity awareness training of all our employees.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business could be negatively affected by security threats, including cybersecurity threats, and other disruptions".


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program described above.


text: Our Manager of Information Technology periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives reports from our IT team on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.


text: Our IT team, including our Manager of Information Technology, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents that impact our systems and information through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our corporate IT environment.


text: Our Manager of Information Technology is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for leading our overall cybersecurity risk management program. Our Manager of Information Technology has over 20 years of experience in the cybersecurity field.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including information pertaining to Hosts, guests, employees, and other users. Our cybersecurity risk management program includes a cybersecurity incident response plan ("Incident Response Plan").

companyName: Airbnb, Inc.

ticker: ABNB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and, while distinct in certain aspects described below, the program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information security team who, in collaboration with the broader technology organization, manages and maintains our (1) cybersecurity risk assessment processes including our Incident Response Plan, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • an Incident Response Plan that includes procedures for recognizing and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Risk and Compliance Committee (the "Audit Committee") oversight of cybersecurity, privacy and other information technology risks. The Audit Committee has responsibility for oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports and briefings from management on our cybersecurity risks and cybersecurity risk management program updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Legal Officer, our Chief Security Officer and our Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security team and our retained external cybersecurity consultants. Our management team has over 20 years of cybersecurity technology leadership experience.


text: Our management team supervises our information security team's efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, or external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and confidential information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Key elements of our cybersecurity risk management program include but are not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and digital assets; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, senior management and our Board of Directors; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, based on their critically and risk profile.

companyName: EVERTEC, Inc.

ticker: EVTC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk factors - We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Information Technology Committee (the "IT Committee") oversight of cybersecurity and other information technology risks, which includes, among others things: • oversight of IT and cybersecurity related risks with regard to the Company's IT platforms and investments; • advising and making recommendations to the Board regarding the state of the Company's cybersecurity preparedness, including review of the threat landscape facing the Company; and • monitoring and evaluating the effectiveness of IT security and cybersecurity protocols within the Company, including disaster recover capabilities.


text: The IT Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the IT Committee, as necessary, regarding any significant cybersecurity incidents.


text: Board members receive presentations on cybersecurity topics. For example, February 2024, the full Board held a cybersecurity tabletop exercise to help prepare to respond to a cyberattack or other security incident.


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 17 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 18 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.


text: At Rapid7, cybersecurity risk management is integrated into our overall enterprise risk management program and is one of the pillars of our broader cybersecurity program. Our cybersecurity risk management program is designed based on prevailing security standards and controls, such as NIST-800 and ISO 27001, and to continuously evaluate cybersecurity risks in alignment with our business objectives and operational needs. Our information security team manages a framework for handling both information security risk management and operational cybersecurity threats and incidents, including those associated with the use of products and services provided by third-party service providers, suppliers, and vendors. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of such cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party service provider, supplier, or vendor), implementing cybersecurity countermeasures and mitigations and an escalation path for informing management, the audit committee of the board of directors (the "Audit Committee"), and our full board of directors (the "Board") of cybersecurity threats, incidents and risks.

companyName: Rapid7, Inc.

ticker: RPD


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, consultants, and auditors in evaluating and supporting our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.