text: Role of the Board On an annual basis, the Board reviews and approves the overall enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including cybersecurity.


text: Role of Management Company management has established a Cybersecurity Governance Committee that is comprised of the Information Technology Manager and senior members of management. The Committee meets periodically to discuss cybersecurity program updates and challenges, watch for potential threats from both external and internal sources, monitor compliance in existing or emerging business practices, and respond to stakeholder inquiries. The Information Technology department is comprised of professionals with extensive expertise and led by its manager with over 20 years of experience in network security, cybersecurity and enterprise risk management. The manager is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.

companyName: MARINE PRODUCTS CORP

ticker: MPX

secItem: Item 1C


text: Risk Management and Strategy RPC approaches cybersecurity as an enterprise-wide risk and has created an accountability framework that includes oversight of cybersecurity risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, RPC has adopted the Center for Internet Security (CIS) framework, which provides prioritized guidance to help defend systems and networks against the most prevalent cyber-attacks as well as support for a Zero Trust. RPC has created a cross-departmental team to screen Company vendors (also known as partners and managed service providers) for vulnerabilities on their own systems and compliance with RPC's policies and procedures, to mitigate risks potentially caused by third party breaches.

companyName: RPC INC

ticker: RES


text: As part of its Standard Operating Procedures, RPC has adopted Incident Response Policy (IRP), Data Classification and Handling Policy, and other policies regarding key areas of information security. These policies are reviewed periodically and updated as needed to address emerging risks or gaps in compliance. The IRP also includes guidance on internal and external escalation in the event of an incident or breach. RPC has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed by the cybersecurity team to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. The IRP provides for consultation with outside legal counsel and our independent registered public accounting firm as appropriate, including on materiality analysis and disclosure matters, to make the final materiality determination regarding disclosure and other compliance decisions.


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack including assistance in the timely remediation of material cyberattacks and incidents.


text: Role of the Board On an annual basis, the Board reviews and approves the overall enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber related priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including risks related to cybersecurity.


text: Role of Management RPC's cybersecurity program is overseen by the Chief Information Officer (CIO) as well as several key members of RPC's Enterprise Technology team. These key leaders collectively have over 50 years of experience in network security, cybersecurity and enterprise risk management. The Chief Executive Officer and CIO receive regular updates on cybersecurity matters, results of mitigation efforts related to existing risks and cybersecurity incident response and remediation. These leaders communicate closely with members of RPC's Information Security Committee (ISC) which oversees the adopted CIS Control Framework, governs the Company's information security programs and monitors the effectiveness of the Company's cybersecurity and technology risk management practices. In addition, ISC provides oversight to align security strategies with business objectives. The Company also maintains business continuity and disaster recovery plans.


text: Risk Management and Strategy In the ordinary course of our business, we collect and store data, including sensitive data such as our proprietary business information and that of our customers, suppliers and business partners, information related to potential ventures and transactions, and personal information related to our employees, customers and business partners. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to process the data necessary to conduct our business. In addition, the breadth and complexity of the technologies we use continue to grow, including as a result of the use of mobile devices, cloud services, artificial intelligence, open-source software, social media and the increased reliance on devices connected to the internet. We are committed to protecting the confidentiality and integrity of, and access to, our operational and information technology as well as the other systems used to conduct our business.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: To protect our data and systems against cybersecurity threats, our cybersecurity risk management program is designed to assess, identify, manage and mitigate cybersecurity threats that could adversely and materially affect our business. Our cybersecurity risk management program is aligned with our business strategy and integrated throughout our operations. Our cybersecurity risk management program is comprised of technical and administrative controls, processes, policies and procedures based on applicable laws and industry standards and guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: As part of our cybersecurity risk management program, we undertake ongoing cybersecurity risk assessments to help us detect, evaluate and respond to potential cybersecurity threats, including regular testing by our internal cyber operations team. Our vulnerability management program is designed to identify, assess, and remediate cybersecurity threats in our systems, such as through penetration testing. We have implemented measures designed to address the risks associated with the use of industrial control systems to help maintain the reliability and safety of our operations. Our information technology and operational technology disaster recovery program is designed to help maintain the continuity of critical business operations in the event of a disruptive cybersecurity incident through procedures for data recovery, system restoration, and business resumption. We engage third-party cybersecurity consultants to provide cybersecurity audits, targeted attack testing, cybersecurity threat intelligence and cybersecurity incident response services. We also operate a threat hunting program to help us identify potential cybersecurity threats in our systems. We require all employees and contractors to participate in cybersecurity training designed to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential incidents.


text: Our internal data privacy and data security team evaluates vendors that have access (directly or indirectly) to our data and/or systems to help us document and mitigate potential cybersecurity threats associated with our use of those vendors and the products and services they provide. These evaluations also include how these vendors may incorporate generative artificial intelligence and other similar artificial intelligence tools into their offerings.


text: Our cybersecurity risk management program includes an incident response ("IR") plan that is designed to facilitate our response to cybersecurity incidents, including an escalation process for cybersecurity incidents that may have a moderate or higher business impact to notify our executive officers, other members of our senior management team and other internal stakeholders. The IR plan provides our executive officers and other members of our senior management team with the information needed to assess whether a cybersecurity incident materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition, and the need for public disclosure. We aim to test the IR plan at least annually to assess its operational effectiveness. We strive to conduct an annual "tabletop" exercise during which we simulate cybersecurity incidents to help us prepare for and respond to a cybersecurity incident and to identify areas for potential improvement. These exercises are conducted in close coordination with members of our internal cybersecurity risk management team, our retained cybersecurity incident response consultants, outside cybersecurity counsel and internal technical, operations and insurance risk management, internal audit and legal personnel, as well as certain executive officers and members of the senior management team.


text: We have an internal cybersecurity risk management team consisting of our cybersecurity operations team, cybersecurity engineering team and data privacy and data security compliance team that reports to our Chief Information Security Officer ("CISO"). This team is responsible for identifying and managing cybersecurity threats and assessing and managing material risks from cybersecurity threats.


text: With more than two decades of cybersecurity and information security experience, our CISO leads our cybersecurity risk management team and holds certifications including CISSP, CISA, CISM, and CRISC. Leveraging their cybersecurity experience, knowledge of our company and leadership, our CISO plays an important role in both the strategic development and tactical execution of our cybersecurity risk management program. Our CISO reports to the Chief Information Officer ("CIO") and regularly consults with our Chief Legal Officer ("CLO") and other members of the legal team, as well as outside cybersecurity counsel, for strategic and operational input on risk management and compliance with applicable cybersecurity laws and regulations.


text: We have a management-level cybersecurity committee that has primary responsibility for our overall cybersecurity risk management program and oversees our internal cybersecurity personnel and retained external cybersecurity consultants and applicable third-party service providers. The cybersecurity committee includes our Chief Financial Officer, CIO, CLO and our Director of Internal Audit. Our CISO and members of the internal cybersecurity risk management team regularly meet with the cybersecurity committee to provide updates on cybersecurity threats, risk management activities and other issues related to preventing, detecting and mitigating cybersecurity incidents. Our cybersecurity committee also consults with internal and external cybersecurity and threat intelligence consultants and communicates with senior management about cybersecurity threats and resource needs for managing them.


text: Our Board of Directors (the "Board") oversees all cybersecurity risk management activities. At least annually, the CISO, CIO and other members of the cybersecurity committee report to the Board on the state of our cybersecurity risk management program and current and emerging cybersecurity risks. The Board's Audit Committee has been delegated strategic oversight of the cybersecurity committee and our cybersecurity risk management program, and is responsible for providing feedback, as needed. Any cybersecurity incident deemed to have a moderate or higher business risk also is reported to the Board.


text: Impacts from Cybersecurity Threats As of the date of this report, though we and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity risk management program and governance structure, we cannot guarantee that a significant cyberattack will not occur. A successful attack on our operational and information technology or other business systems could have significant consequences to the business. See "Part I, Item 1A, Risk Factors," for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: The Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024, and the Company is not currently aware of any cyber security attacks or breaches that are reasonably likely to materially affect the Company's business, business strategy, operating results or financial condition. However, as discussed under Item 1A "Risk Factors," specifically the risks titled "Risk of operational interruptions relating to computer software or hardware failures, including cyber-attacks," a cybersecurity incident could negatively impact sales and profits. The sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well controls are designed and implemented, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: The Company's cybersecurity risk program is supervised by members of our executive team. The program is led and managed by the Director of Information Technology, whose experience includes over ten years in information security leadership roles, with the assistance of third-party experts, including consultants and a computer security firm. The Audit Committee and the Board of Directors receive periodic reports on the Company's actions to respond to the cyber security incidents and the overall cyber risk environment. In accordance with our Security Incident Response Plan ("SIRP"), the Audit Committee is to be promptly informed by management of cybersecurity incidents with the potential to have a material impact on the Company, its financial results, or its information systems.


text: The Company maintains cybersecurity prevention and response plans and procedures (the "Cybersecurity Policies") that set forth the Company's plan to prevent, manage, report and resolve cybersecurity events. The Cybersecurity Policies set forth the Company's policies and procedures for cybersecurity event prevention, including the Company's (i) network and computer systems acceptable use policy, (ii) data backup procedures, (iii) business continuity plan, (iv) data retention policy, (v) disaster recovery plan, (vi) email use and security policy, (vii) network change management procedures, and (viii) password and authentication requirements policy. The Cybersecurity Policies also (i) provide indicators that Company employees should be aware of to recognize a cybersecurity event, (ii) outline the roles and responsibilities for Company employees and other third parties with respect to the Company's cybersecurity incident response team ("CSIR Team"), (iii) set forth the steps to take in response to a cybersecurity incident, including reporting the incident, investigating the incident, preserving non-affected systems and data, informing, as appropriate, Senior Management (as defined below), insurance carriers, law enforcement and other parties that may be affected by the incident and (iv) include the processes for maintaining business continuity.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: The Company's President and Chief Executive Officer, Chief Financial Officer and Treasurer, Chief Operating Officer and General Counsel and Secretary (" Senior Management ") are responsible for assessing and managing cybersecurity risks with the support of the entire CSIR Team, led by the Director of Operations/Risk Management. The Director of Operations/Risk Management is the primary lead for monitoring the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and ensuring that the Cybersecurity Policies are followed. Senior Management works collaboratively with the Director of Operations/Risk Management and the entire CSIR Team to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Cybersecurity Policies. The CSIR Team also includes a third-party, on-demand IT support team, a Primary IT Support Contact, who is the technical response lead, a Primary Communications Contact responsible for handling external communications during and after an incident, as well as other delineated primary contacts in areas including, but not limited to, HR, Legal, Accounting, Asset Management and Acquisitions. Pursuant to the Cybersecurity Policies, information security incidents must be reported, without delay, to the IT support team or the Director of Operations/Risk Management, who will then advise Senior Management of the incident. Senior Management will then report such threats and incidents to the Audit Committee, when appropriate.


text: The members of Senior Management each hold degrees in their respective fields and combined have approximately 30 years or more of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: The Company engages in the periodic assessment and testing of its policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of the Company's cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on its cybersecurity measures, including information security materiality assessments and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and reviews.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. We face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We, our tenants, and our property managers face risks associated with security breaches through cyber-attacks, cyber-intrusions, or otherwise, as well as other significant disruptions of information technology networks and related systems."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: We regularly experience cyberattacks and other incidents and will continue to experience varying degrees of attacks and incidents in the future. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents (including the Cybersecurity Incident), that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however we cannot guarantee that material incidents will not occur in the future.


text: The Committee receives briefings from our information security team ("Information Security") on our cybersecurity risks no less than annually. In addition, management updates the Committee in addition to the full Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Information Security is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Information Security reports to the Chief Administrative and Legal Officer, who, together with other members of our management team, including the Chief Financial Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats based on regular reports from Information Security and information technology ("IT") teams. Management receives periodic reporting on the status of projects to strengthen the security of our IT systems and efforts regarding the prevention, detection, mitigation, and remediation of cybersecurity events. Reports may include briefings that have been informed by internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources in addition to alerts and reports produced by security tools deployed in the IT environment.


text: Information Security has significant experience in incident response, forensics, vulnerability management, network security administration, fraud prevention, and other governance, risk, and compliance areas. Information Security maintains subject matter expert level knowledge in cybersecurity frameworks and governance organizations such as NIST, ISO 27001, and PCI-DSS, along with industry certifications commensurate with their roles.


text: Our CISO has over twenty-five years of experience in cybersecurity and holds active Certified Information Systems Security Professional and Certified Information Security Manager certifications. Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident or the individual's supervisor to immediately report the cybersecurity incident to the appropriate reporting channels, which include the CISO. In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident. Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: We model our cybersecurity program to align with the practices and standards referenced within the National Institute of Standards and Technology cybersecurity framework. Our information security program is integrated within our larger enterprise risk management program and includes, but is not limited to: Following the methodology of Identify, Protect, Detect, Respond, and Recover; Mandatory annual cybersecurity awareness training for all teammates accessing our network; Monthly Company-wide phishing prevention and awareness exercises;


text: Risk Management and Strategy To combat the ever-present cyber risks, the Company maintains a comprehensive ISP, which includes continuous risk assessments, an Incident Response Plan, and a multilayered control environment meant to protect, detect, respond to, and limit unauthorized or harmful actions across our information environment. The control environment is based off industry leading recommendations, including the Center for Internet Security (CIS) Critical Security Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our Information Security Officer (ISO) is primarily responsible for coordinating the various aspects of the ISP with cross-functional support teams across various teams within the Company.

companyName: Merchants Bancorp

ticker: MBIN


text: Standards over information security are Board-approved and various types of control testing is conducted throughout the year, by internal and external parties. Recommendations are implemented and reported to various committees. These security and privacy policies and procedures, aimed at protecting personal and confidential information, are in effect across all businesses and geographic locations. Board-approved policies are in place to effectively mitigate risks linked to third-party service providers, encompassing factors such as availability, confidentiality, and governance and compliance. As part of this risk mitigation, the Company actively monitors vendors' cybersecurity practices through periodic assessments and contractual security requirements. This ensures that vendors adhere to our security standards and promptly address emerging threats or vulnerabilities.


text: The Company employes a defense in depth posture, designed to safeguard information, prevent unauthorized access, detect, and respond to threats, and maintain the confidentiality, integrity, and availability of data. The ISP establishes controls across many domains including but not limited to: Information Security Governance, Inventory and Control of Enterprise Assets and Software, Data Protection, Secure Configuration of Enterprise Assets and Software, Account and Access Control Management, Continuous Vulnerability Management, Audit Log Management, Email and Web Browser Protections, Malware Defenses, Data Recovery, Network Infrastructure Management, Network Monitoring and Defense, Security Awareness and Skills Training, Service Provider Management, Application Software Security, Incident Response Management, and Penetration Testing.


text: However, it is difficult or impossible to defend against every risk being posed by evolving technologies as well as criminal intent on committing cyber-crime. Increasing sophistication of criminal organizations and advanced persistent threats makes staying ahead of new dangers difficult and could result in a security breach. Controls employed by our information technology department and cloud vendors could prove inadequate. A breach of our security that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations, as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage, any of which could have an adverse effect on our business, financial condition, and results of operations. The Company has established conditions to quickly respond to a cyber incident, ensuring a resilient, information environment.


text: The Chief Administrative Officer is responsible for the appointment of the Information Security Officer. The Information Security Officer serves as the focal point for the information security program and is responsible and accountable for its implementation and monitoring, and management of the Information Security team. The current Information Security Officer has over a decade of experience in the cyber security field, including critical roles in security operations, security governance, risk, and compliance, and cyber threat intelligence. They have multiple industry leading certifications, including nine GIAC and CISSP from the ISC2 and a Master of Engineering in Cybersecurity Policy and Compliance.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO, our Vice President – Cyber Risk Governance and our Senior Vice President – Enterprise Information Security. The management team is highly experienced in cybersecurity matters. The CISO has over 20 years of experience in cybersecurity including working at a global bank and leading cybersecurity vendors, and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Privacy Professional certifications for security and privacy, respectively. The CISO has a bachelor's, master's, and law degrees. The Vice President – Cyber Risk Governance has advanced degrees and certifications related to cybersecurity and over 15 years of experience with the federal government in a similar role. The Senior Vice President – Enterprise Information Security has more than 30 years of experience at the Company and held various information technology and information security risk management roles, including serving as a bank information security officer, and has a bachelor's degree and security certification.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: The CISO, Senior Vice President – Enterprise Information Security, and Vice President – Cyber Risk Governance regularly inform the Chief Executive Officer, the Chief Operating Officer, the Chief Risk Officer, the Chief Information Officer, the Chief Technology Officer, the Chief Compliance Officer, and the Chief Audit Officer of all concerns related to cybersecurity risks and incidents, including the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. This aims to ensure that senior management is kept up to date on the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Company's Board of Directors, ensuring that they have comprehensive information and can provide oversight with respect to critical cybersecurity issues.


text: Our management team is responsible for the day-to-day management of risks we face, including our current Chief Operating Officer and Chief Security Officer. The Chief Operating Officer is an experienced Certified Information Systems Security Professional (CISSP) with more than 10 years of relevant experience in technology, security, and risk management across multiple industries, including finance and banking.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: We assess, identify and manage risks from cybersecurity threats through CNH's Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of CNH's larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors for CNH (the "CNH Audit Committee") and is managed by CNH's Chief Information Officer (the "CNH CIO") and a dedicated CNH Chief Information Security Officer (the "CNH CISO"). The CNH CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network and, information assets. The CNH CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial Capital LLC


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. These include the ongoing monitoring of our systems, including with the assistance of third-party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2024. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.


text: Under the Cybersecurity Program, cybersecurity matters are generally managed by a combination of functional groups that report to CNH N.V.'s global leadership team, as appropriate, on matters such as enterprise level cybersecurity initiatives, threat intelligence and product cybersecurity risks and remediations.


text: The CNH CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This is intended to provide cross-functional visibility, as well as executive leadership oversight, to address and mitigate associated risks. Our internal IT group audits our information security programs, and the results are reported to our executive management and the Risk Committee of our Board of Directors by the Director of Information Technology. We also engage third-party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards. We further employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. We also carry cybersecurity insurance to protect against potential losses arising from a cybersecurity incident.

companyName: Calumet, Inc. /DE

ticker: CLMT


text: Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy stipulates that each third-party service provider go through a mandatory IT Security Governance review and obtain formal approval by our IT Security Governance group before it can be used.


text: We have an Incident Response Plan ("IRP") that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process aligns with the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel (including third-party partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board of Directors.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Risk Committee. Aside from more immediate reporting of certain incidents to our Board of Directors as described above, our Director of Information Technology provides our Risk Committee an update on cybersecurity at least every other quarter and more often as necessary. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Risk Management and Strategy Due to the utilization of technology, Atlanta Braves Holdings is subject to material risks from cybersecurity threats. Accordingly, we have committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place to respond in a timely and appropriate manner. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: For additional information on our cybersecurity risks, see " Data loss or other breaches or disruptions of our information systems and information system security could materially harm our business and results of operations." in Part I, Item 1A – "Risk Factors" of this Annual Report on Form 10-K.


text: Role of the Board of Directors Our board of directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program the CESC (as defined below) including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management We have established a cross functional Cybersecurity Executive Steering Committee ("CESC") led by our Senior Vice President ("SVP") and Head of Technology Services, Chief Legal Officer, Chief Financial Officer and other executives from our Legal, Accounting, Cybersecurity and Facilities departments. The CESC meets at least quarterly and has primary management oversight responsibility for assessing and managing information security, data protection and privacy, and cybersecurity risks.


text: Our SVP and Head of Technology Services, together with the Director Cybersecurity and IT Infrastructure, is responsible for day-to-day management and oversight of our cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The SVP and Head of Technology Services provides regular reporting to Braves Holdings executive management, the CESC and the Audit Committee.


text: A Compliance Committee has also been established and is responsible for overseeing and monitoring all corporate compliance initiatives at Braves Holdings, including cybersecurity. The Compliance Committee is composed of members of the CESC as well as the Braves Holdings executive leadership team, including the President and Chief Executive Officers of the Baseball and Development divisions, Chief Financial Officer and Chief Legal Officer. The SVP and Head of Technology Services provides periodic updates to the Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.


text: Our management team's experience includes a diverse background in telecom, financial services and other industries, with decades of experience in various aspects of technology and cybersecurity. Our SVP and Head of Technology Services has more than 30 years of leadership experience, including delivering technology solutions and designing and building new business strategies in regulated businesses and our Director Cybersecurity and IT Infrastructure has more than 20 years of cybersecurity and information technology experience and is a Certified Information System Security Professional. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.


text: Information security and cybersecurity incidents undergo thorough review and assessment by the Information Security Subdirector, in collaboration with cybersecurity specialists and experts. Those incidents classified as material are reported to the Technology and Information Security Director, relevant Business Directors, and the Board's Audit Committee, with additional review by AMC's Productivity and Risk Committees. Simultaneously, these processes allow cybersecurity incidents classified as "material" to be promptly disclosed to the SEC in a Form 8-K report within 4 business days of the Company's determination that such incident is in fact a "material" incident.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Cybersecurity Incident Impact While we identified no cybersecurity incidents, we have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. For additional discussions of risks from cybersecurity threats we face, see Item 1A "Risk Factors". There were no material cybersecurity incidents in 2024.


text: We utilize various tools and security technology to help us deter, detect, identify, and respond to potential cybersecurity threats. Annually, we undergo external evaluations by third-party consulting services, including the performance of penetration testing and vulnerability scanning. With respect to third-party service providers, we generally require our vendors to maintain security controls to protect our confidential information and data, and we perform risk assessments of IT vendors, including their ability to protect data from unauthorized access. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate the incident to our Chief Technology Officer ("CTO"). As described in Part 1, Item 1A (Risk Factors), our operations rely on the secure processing, storage, and transmission of confidential and other information in our IT systems and networks. Computer viruses and other events beyond our control, including cybersecurity attacks and other cyber incidents such as denial of service, system failure, security breach, intentional or inadvertent acts by employees or vendors with access to our systems or data, or disruption by malware, could expose our IT systems and those of our vendors to system interruptions, impacting the availability, reliability, speed, accuracy, and other proper functioning of these systems or result in the release of proprietary information or sensitive or confidential data, any of which could materially and adversely affect our business. Because the sophistication of cybersecurity threats is increasing and new techniques for attack are being developed rapidly, including attacks enabled by artificial intelligence, we cannot be certain that the controls and preventative actions that we have implemented to reduce the risk of cybersecurity incidents and to protect our systems will be effective in preventing a cybersecurity incident from materializing. While we have experienced minor cybersecurity incidents, we are not aware of any material cybersecurity incidents that occurred during the year ended December 31, 2024. Our Audit Committee, with delegated authority from our Board of Directors, has primary oversight of cybersecurity risks.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Our CTO and Director of Information Security are responsible for oversight of the Company's cybersecurity program, implementation and compliance of our information security standards, and mitigation of information security-related risks. Our CTO, with 38 years of IT experience and an undergraduate degree in Computer and Information Science, has served in his current role for five years and previously served as our director of infrastructure management for 12 years. Our CTO reports directly to the Company's Chief Innovation Officer and indirectly to the Company's President of ArcBest Technologies, who directly reports to the Chief Executive Officer. Our Director of Information Security, reports to our CTO, has 33 years of IT experience, including over 20 years in information security; a Master of Business Administration; an undergraduate degree in Computer Information Systems and Quantitative Analysis; and is a Certified Information Systems Security Professional.


text: The Information Security Committee, chaired by our Director of Information Security, includes IT, legal, compliance and other business leads. The Information Security Committee provides a forum for these cross-functional members of management to consider existing and emerging cybersecurity risks; review cybersecurity regulations; determine cybersecurity project prioritization; approve, review, and update policies and standards, as appropriate; and promote cross-functional collaboration to manage cybersecurity risks across the enterprise to support the Company's goals and address cybersecurity risks.


text: Management's Role Our chief information officer and our security architect are responsible for day-to-day assessing and managing the cybersecurity risk and threats through internal assessment tools as well as third-party control tests, for audits and evaluation against industry standards and regulations. Our chief information officer has over twenty-five years leading IT and Cybersecurity teams and continually improve his expertise through cybersecurity classes and collaborate with cybersecurity professionals in hospitality industry.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Cybersecurity Risk Management We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. In the ordinary course of our business, we use, store, and process data, including data of our employees, partners, collaborators, and vendors. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or our partners, collaborators, vendors, or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our business. To help the Company identify, assess, and mitigate risks to this data and our systems, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same.

companyName: PLUG POWER INC

ticker: PLUG


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. In 2024, Plug continued to fortify its comprehensive cybersecurity and risk controls. We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company and evaluate potential risks consistent with industry practices, customer requirements, and applicable law, including privacy and other considerations. We mandated an annual cybersecurity awareness training module, enhanced our Information Technology Infrastructure Library (ITIL) based discipline of change and incident management, and overhauled our monthly patching/vulnerability management rigor. Additionally, Plug continued leveraging top-tier third party support for external and perimeter examination: completing exhaustive Penetration Testing and Vulnerability Scans (performed by OrbitalFire), establishing a robust Network Operations Center (NOC), and leveraging industry-leading endpoint monitoring and detection services (CrowdStrike). Additionally, we have implemented an employee education program whereby employees are able to attend cybersecurity awareness training during the onboarding process.


text: The Vice President of Information Technology (" VP of IT ") oversees the daily operations of our cybersecurity risk management program and plays a central role in assessing and managing critical risks from cybersecurity threats with the support of additional IT professionals. The VP of IT role is currently held by an individual who has approximately twenty years of experience in information security management, application portfolio management, and IT governance, risk, and compliance. The VP of IT periodically reports on the cybersecurity program to the Chief Financial Officer ("CFO").


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience, threats to and breaches of our data and systems, including ransomware attacks and phishing attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "We are dependent on information technology in our operations, and the failure of such technology may adversely affect our business. Security breaches of our information technology systems, including cyber-attacks, ransomware attacks, or use of malware or phishing or other malicious techniques by threat actors, have in the past and could in the future lead to liability, impact our operations, or damage our reputation and financial results" in Item 1A, "Risk Factors".


text: Cyber threat actors and the types of threats posed are becoming more sophisticated and effective and are increasingly targeting commercial companies. In seeking to mitigate these cyber threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data, customers and other stakeholders entrusted to us, a top priority. The board of directors and our management are actively involved in the oversight of our risk management program, which includes cybersecurity. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. There may be instances where our policies and procedures are not properly followed or where such policies and procedures prove to be ineffective. As of the date hereof, we are not aware of any material risk from cybersecurity threats that has materially affected the Company, including our business strategy, results of operations or financial condition. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding risks related to system security risks, data protection breaches and cyber-attacks, see the risk factor entitled "System security risks, data protection breaches, and cyber-attacks could compromise our proprietary information, impair customer and vendor relationships, disrupt our internal operations, harm perception of our products and expose us to litigation and/or regulatory penalties, which could have a material adverse effect on our business and our reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: CPI Card Group Inc.

ticker: PMTS


text: We work to identify and address our cybersecurity risks through a comprehensive, cross-functional approach. Key security, risk and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to encourage prompt escalation of certain cybersecurity incidents so that decisions regarding customer and supplier disclosure, public disclosure and reporting of such incidents can be made by management and the board of directors in a timely manner.


text: Education and Awareness Our Company policies require our employees to assist in the protection of our customers' data. We have various training programs, conducted frequently, designed to heighten employees' awareness of current threats, educate them on effective mitigation strategies and reinforce the importance of handling and safeguarding customer and employee data in accordance with our established security protocols. To evaluate the effectiveness of these training programs and monitor the effectiveness of our security controls, we have implemented mock testing practices. Annual incident response training is conducted for administrative personnel that would be expected to be involved with, and respond to, a security incident.


text: Management's Role Our Chief Information Security Officer ("CISO"), Chief Information Officer ("CIO"), Chief Technology Officer ("CTO"), Chief Legal and Compliance Officer ("CLCO") and Director of Information and Cybersecurity ("DC") have primary responsibility for assessing and managing material cybersecurity risks and are members of an internal committee that reviews issues and initiatives related to data security and privacy (the "Security Committee"), which drives alignment on security decisions across the Company. The CISO has over 20 years of experience in various roles related to information security and related technology, including roles specific to managing security requirements related to organizations operating in the payment card industry. The CIO, CTO and DC also each have over 20 years of experience serving in various roles in information technology fields; the CIO has over 25 years of global technology leadership across fintech, software, and payments industries, leading technology, product, and engineering organizations for multinational companies, with extensive experience in implementing software solutions and managing risk across the entire technology lifecycle. The CTO has been with the Company since 2014 and the DC previously served as the Chief Information Security Officer at an IT services and consulting company. The CLCO has over 20 years of experience managing risks and related disclosure requirements, including risks arising from cybersecurity threats, at publicly traded companies. The Security Committee meets at least quarterly to evaluate security performance metrics, prioritize risks identified through threat intelligence, vulnerability and risk assessments, external audits, and incident response insights, and review the progress of approved security enhancements. The Security Committee also considers and makes recommendations to the Audit Committee on security policies and procedures, security service requirements and risk mitigation strategies.


text: Governance: The board of directors' oversight of cybersecurity risk management is led by the Audit Committee of the board of directors, which regularly interacts with our Chief Compliance Officer, our Chief Financial Officer, and other members of management.

companyName: Passage BIO, Inc.

ticker: PASG


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The board of directors, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with management.


text: Our management team has implemented a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our enterprise risk management team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. Our Chief Financial Officer, Kathleen Borthwick, currently serves as our Chief Cybersecurity Officer and leads our cybersecurity risk assessment and management processes. Prior to being named CFO, Ms. Borthwick served as the Company's Senior Vice President, Finance, and interim CFO. She is supported by external Information Technology and third-party internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training, and risk management efforts.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials and product, product candidates, and technology or our Information Systems and Data.

companyName: Y-mAbs Therapeutics, Inc.


text: We have a multi-stakeholder team to help identify, assess, and manage the Company's cybersecurity threats and risks, comprised of representatives from our third-party IT administrator, and from our Legal and Compliance, and Finance departments. This team, along with our third-party IT service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using automated monitoring tools, subscribing to analysis and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external review of certain data and systems, and having third parties conduct periodic assessments of our threat environment. We continue to invest in talent and infrastructure in our IT department to manage IT operations and mitigate cyber risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the heading "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences"


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Senior Director of IT, and our Chief Financial Officer, and Treasurer, or the CFO.


text: Our Senior Director of IT is currently responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO has the overall IT and cybersecurity responsibility and is currently responsible for approving IT and cybersecurity related policies, processes, and procedures, approving related activities and budgets, helping prepare for cybersecurity incidents, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and our President and Chief Executive Officer, as appropriate and provides for our management team to work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within our IT and risk management systems and addresses both the corporate and the operational IT environment.

companyName: W&T OFFSHORE INC

ticker: WTI


text: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. We have adopted a Cybersecurity Incident Response Plan that applies if a security event occurs. Our Incident Response Plan provides a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting, and responding to security events that are identified by or reported to the Chief Information Officer ( "CIO "). Our Incident Response Plan applies to our personnel including contractors and partners that perform functions or services that require securing our information assets, and to all devices and networks that we own. The Incident Response Plan details the coordinated, multi-functional approach for investigating, containing, and mitigating incidents. Under our Incident Response Plan, cybersecurity incidents are escalated based on a defined incident categorization to the CIO and the General Counsel. Regular updates are provided by the Cybersecurity team to the CIO, who will maintain communication and information flow to senior leadership including the General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders as well as the Audit Committee and/or the Board of Directors as appropriate. Generally, our incident response process follows the National Institute of Standards and Technology (NIST) framework and focuses on preparation; detection and analysis; containment, eradication, recovery and post-incident remediation.


text: Our CIO leads the information security organization which oversees the identification and management of information security risks. Our CIO has extensive information security and risk management experience in Information and Operational technology and holds the following information security certifications: Certified Information Systems Security Professional (CISSP); Certified Information Systems Auditor (CISA); and Certified Risk and Information Systems Control (CRISC).


text: Our CIO is a member of InfraGard, ISC2 and ISACA and serves as Adjunct Professor of Cyber Security at Lone Star College and San Jacinto College.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To our knowledge, such risks have not materially affected our operations nor have we experienced any cybersecurity incidences which have impacted our operations. In the past three years, we have not experienced a material information security breach. We will continue to face cybersecurity threats whether directly or through our supply chain or other channels in the normal course of business. See Risk Factors in Part I, Item 1A in this Form 10-K for additional information.


text: Cybersecurity risk management and strategy The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to management and relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company believes it is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

companyName: Vireo Growth Inc.

ticker: VREOF


text: Cybersecurity Governance Cybersecurity risk management is overseen by the Company's Vice President of Information Technology and Security who is supported by full-time information security staff. These individuals have experience across industries that, among other things, develops and distributes information security policies, standards and procedures; engages in employee cybersecurity training; implements security controls; assesses security risk and compliance posture; monitors and responds to security events; and executes security testing and assessments The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.


text: The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see " Item 1A. Risk Factors — We face risks related to our information technology systems, including potential cyber-attacks and security and privacy breaches ".


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced cybersecurity incidents that have materially affected us, our business strategy, our results of operations or our financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding risks from cybersecurity threats, please refer to "Item 1A. Risk Factors" of this annual report on Form 10-K.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: While the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management, our management also plays an integral role in cybersecurity oversight. Our management is responsible for day-to-day risk management processes. This includes periodic updates from the Executive Director of Information Technology who has over 24 years of work experience in the life science industry, and holds an undergraduate degree in Industrial Technology. The Executive Director of Information Technology is responsible for managing the daily measures of safeguarding the information technology infrastructure from potential threats and vulnerabilities, which includes monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, we have established a Crisis Management Team (CMT), which is a team of cross-functional participants who are prepared to review and assess any potential cybersecurity incidents. The CMT team is led by our CFO and our General Counsel who will advise the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee of the Board accordingly in the event of any incident. We believe this division of responsibilities is the most effective approach for addressing our cybersecurity risks and that the Board leadership structure supports this approach.


text: Cybersecurity operations generally fall under the discretion of the IT Director, who has 20 years of experience and is a Certified Secure Infrastructure Specialist (CSIS - Comptia) and IT Operations Specialist (CIOS - Comptia). Our IT Director regularly communicates with and provides relevant cyber reporting, analysis, statistics and statuses to the Chief Financial Officer, who also has a background in IT and is a Certified Information Systems Auditor.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Our Cyber Incident Response Plan employs an operational incident-handling capability that includes preparation, detection, analysis, containment, eradication, recovery, and communication procedures.


text: Our cyber policies are based on the National Institute of Standards and Technology 800-171 and CMMC Level 2 framework, requiring formal written policies, procedures, plans of action, general security plans and regular audits. In addition, Southland carries Privacy, Security and Technology Insurance covering incidents and responses related to business interruption, data recovery, data breach, extortion and ransomware, and crisis management.


text: See "Systems and information technology interruption and breaches in data security and/or privacy could adversely impact our ability to operate and negatively impact our results of operations" in "Item 1A. Risk Factors."


text: We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Our cybersecurity program is led by our director of information technology (IT), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our director of IT has extensive information technology and program management experience and leads a team that has many years of experience with our organization. Our director of IT reports to our vice president in charge of coordinating operational activities within our business segments. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our director of IT and senior executives including our chief executive officer, chief financial officer and general counsel, and our executive vice president who is also the Contran chief information officer. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT team is responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief executive officer and chief financial officer, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- Risk Factors.


text: Over the last three years, we have experienced no known information security breaches. However, as cybersecurity incidents continue to increase in scope, complexity, and frequency, we may be unable to prevent a significant incident in the future which may materially impact our results of operations.

companyName: ALLIENT INC

ticker: ALNT


text: Our cybersecurity program engages third parties when necessary. In the past, we have had cybersecurity incidents and we have made, and continue to make investments, seeking to address these threats, including monitoring of networks and systems, hiring of experts to evaluate and test our systems, employee training and security policies for employees and third-party providers. All third parties that we use have been vetted and have deep experience and strong reputations in the industry. As such, controls from the third-party vendors have been deemed to be adequate prior to any goods or services having been provided.


text: We maintain an information security program that includes physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, while timely and effectively responding to, cybersecurity threats or incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. Through our cybersecurity risk management process, which is overseen by the Amplify Information Technology Steering Committee (the "Steering Committee"), we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats. This process has been integrated into the Company's Risk Management Program, and we have integrated Cyber Incident Response planning into our Business Continuity Program. In addition, we routinely engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. We provide monthly cybersecurity awareness and weekly phishing simulations, data protection modules, tabletop exercises, as well as more contextual and personalized modules for targeted users and roles.

companyName: Amplify Energy Corp.

ticker: AMPY


text: The Nominating & Governance Committee, which is comprised entirely of independent directors, has primary responsibility for oversight of the Company's initiatives, policies and performance regarding risk management matters, including information security, cybersecurity, business continuity and data protection and privacy. Committee members have extensive experience working for and/or serving on the boards of directors of publicly traded companies and are experienced in overseeing cybersecurity and information security risks, understanding the cybersecurity threat landscape and/or assessing emerging cybersecurity risks. The Nominating & Governance Committee generally meets at least quarterly and as frequently as circumstances dictate. Members of senior management, representing a variety of teams and functions including information technology, operations, finance and legal, routinely provide updates regarding assessments of cyber risks, the threat landscape, and the Company's cybersecurity risk mitigation and governance strategies. The Nominating & Governance Committee and members of senior management brief the entire board, as necessary, on cybersecurity matters discussed during committee meetings.


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face certain ongoing risks from cybersecurity threats, that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations, and/or financial condition. For more information about these risks, see the risk factor titled, "Our business could be negatively affected by security threats, including cybersecurity threats, destructive forms of protest and opposition by activists and other disruptions" under Item 1A of Part I of this Annual Report.


text: We proactively address cybersecurity risk through a comprehensive cybersecurity program to identify, protect, detect, respond to, and manage any reasonably foreseeable cybersecurity risks and threats. We use a multi-faceted approach including, but not limited to, third-party assessments, internal cybersecurity audits, IT security, governance, risk, and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things, require mandatory third-party cybersecurity training and testing for all employees, perform periodic user access reviews across the organization, perform penetration testing using external third-party tools and techniques to test security controls, employ multifactor authentication and biometrics login tools, take steps to verify whether vendors have appropriate cybersecurity programs, and conduct frequent security assessments to identify and remedy vulnerabilities.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: We also employ the use of Secure Socket Layer inspection on our firewalls, which are able to decrypt and scan all network traffic entering and leaving our facilities. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards, including regularly reviewing and updating our incident response plan. These partnerships enable us to leverage specialized knowledge and insights, seeking to continue to improve upon our cybersecurity strategies and processes.


text: Based upon the information that we have as of the end of the year covered by this report, we do not believe that we have experienced any material cybersecurity incidents to date. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken, and continue to take, to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurance that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially affect us. As described in Item 1A – "Risk Factors", any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks, or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.


text: Our Board understands the critical nature of managing risks associated with cybersecurity threats. Accordingly, our Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and in maintaining shareholder confidence. The Audit Committee has been made primarily responsible for the Board's oversight of cybersecurity risks. However, the entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address these issues. Our Chief Information Officer is responsible for overseeing cybersecurity and reports to the Audit Committee, as well as the Board at all its regular quarterly meetings regarding matters of cybersecurity. These reports include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), updating the status on defensive security measures and risk assessment, and key information security initiatives. Our Audit Committee and our other Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our Chief Information Officer has been with the Company for more than 25 years, developing and overseeing our information systems and cybersecurity risk management program. Our Chief Information Officer and his team, which includes a cybersecurity professional, are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board and Audit Committee on any appropriate items.


text: Additionally, the Company maintains an Information Security Program designed to prevent, detect, and respond to cyberattacks, and maintains a cybersecurity incident response plan designed to enable the Company to respond to cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify clients and customers, as applicable. The Company's risk and technology teams, led by the Company's Chief Risk Officer ("CRO") and Chief Technology Officer ("CTO"), respectively, are responsible for leading the incident response team, identifying technology and cybersecurity risks, utilizing management's expertise in assessing the materiality of cybersecurity events, and are responsible for the controls to manage threats. The Company's risk team in conjunction with the broader incident response team conduct periodic tabletop exercises and business continuity simulations to train and align on best practices and assessment of potential cyber events. Management utilizes the incident response plan and incident response team to assesses materiality of any cyber event through a qualitative and quantitative assessment. The information security program and overall cybersecurity risk management processes are aligned and integrated into the Company's overall risk profile and appetite through the Company's Enterprise Risk Management Committee.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: The Company's governance structure is designed to identify, escalate, and mitigate information security risks. Management utilizes its Enterprise Risk Management Committee and IT Steering Committee, comprised of senior leaders including the Company's CRO, CTO, Chief Financial Officer, and other leaders with cybersecurity expertise, to disseminate information and monitor information security efforts throughout the Company. Each committee's charter, in addition to the Information Security Policy, establishes roles and responsibilities related the Company's cybersecurity governance and program. The risk team provides oversight of the Company's activities designed to identify, assess, measure, and mitigate cybersecurity risk. The Company's Information Security Program includes training that reinforces the Company's Information Security Program policies, standards, and practices, as well as the expectation employees comply with these policies. The technology team engages employees through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees, and is supplemented by various testing initiatives, including social engineering testing. Finally, the Company provides specialized security training for certain employee roles such as system administrators and all information security training is monitored and reported on by the risk team as well as the Company's learning and development function.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks faced by the Company. In addition, our board of directors, as a whole and through its Audit Committee, is responsible for the oversight of cybersecurity risks. In that role, the board of directors and Audit Committee are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, the board of directors and Audit Committee receive periodic updates on the Company's Information Security Program, cybersecurity policies and practices, ongoing efforts to improve security, as well as the Company's efforts to prevent, detect, mitigate, and remediate significant cybersecurity incidents.


text: Risks from cybersecurity threats, including any previous cybersecurity events, did not materially affect the Company or its business strategy, results of operations or financial condition during the period covered by the report. Notwithstanding the comprehensive approach that the Company takes to address cybersecurity risk, the Company may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management The Information Security Program employs various information security controls, tools, and strategies to combat threats and to ensure the Company's information and systems remain secure. The Information Security Program contains specific provisions for identifying, assessing, and mitigating cyber threats, including but not limited to ransomware attacks, denial of service attacks, phishing and social engineering, data breaches, credential theft, and vulnerability exploitation.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Due to the dynamic nature of risks, threats, vulnerabilities, and the information systems themselves, all information systems that store, process, or transmit sensitive and confidential information are protected by comprehensive defense-in-depth strategies that include strong authentication techniques, firewalls, intrusion detection systems, end point protection, physical security measures, encryption and security awareness training.


text: The Information Security Program complies with all applicable regulations, including Section 501(b) of the Gramm–Leach–Bliley Act and Section 216 of the Fair and Accurate Credit Transactions Act of 2003. The Information Security Program aligns with National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security (benchmarks for device hardening).