text: As methods of cybersecurity attacks are varied and constantly evolving, we regularly review and update systems, processes and procedures to safeguard against potential threats. However, there is no guarantee that the measures we undertake will be adequate to safeguard against all threats presented; and we may be unable to anticipate these techniques or implement adequate preventative measures. These attacks are also reviewed by our third party consultants.


text: Regulatory requirements related to data privacy and cybersecurity are also changing, presenting new and increasingly rigorous requirements that may be applicable to our business. Implementation of and maintaining compliance with the evolving changes requires significant effort and cost for a company of our size which may limit our ability to comply and our cyber insurance coverage may not be adequate for liabilities or costs actually incurred.

companyName: PROCYON CORP

secItem: Item 1C


text: The Company has current insurance coverage for Cybersecurity attacks. This coverage however, may not cover be enough to cover substantial attacks, if they occur. We also cannot be certain that insurance will be available to us with reasonable terms or that any insurer will not deny coverage of a future claim. These risks could substantially increase our operating costs, expose us to fraud or theft, subject us to potential liability and disrupt our business.


text: Acceptance of current payment options also subjects us to rules, regulations, contractual obligations and compliance requirements which may change over time or be reinterpreted, making compliance even more difficult, costly or uncertain. We cannot guarantee that our financial results will not be negatively impacted by complying with these requirements.


text: We will continue to mitigate risks by employing physical, administrative and technical measures including employee training, logical access controls, monitoring and testing, and maintenance of protective systems and contingency plans but remain potentially vulnerable to additional known or unknown cybersecurity threats and cannot be assured that the impact from such threats will not be material.


text: Management is in the process of starting an outside third party audit of our systems, to review if there are any improvements needed from either a security aspect or personnel training to safeguard against the internal human factor that can unintentionally cause harm. Management will report on these findings in the future.


text: Enterprise risk management (ERM) at Spire oversees significant risks to the Company's ability to successfully execute on strategy and achieve corporate objectives. Spire's ERM is based on a structured, comprehensive process that leverages ISO 31000:2018, adopted and customized to the Company's needs, utilizing an ongoing process of risk identification, evaluation, treatment, integration and monitoring. ERM helps assess priorities and facilitate decision-making for resource allocation as it relates to risk management. Two risks prioritized by our Enterprise Risk Oversight Committee related to cybersecurity are cyber threats and vendor management. Additionally, the ERM process is structured to integrate with operational levels, where risk is managed, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 utilized by the Company's Information Security function for managing cybersecurity.

companyName: SPIRE INC

ticker: SR


text: Spire's Board of Directors ("Board") recognizes the significance of cybersecurity risk and has therefore retained oversight of cybersecurity rather than delegating this risk to a committee of the Board. Every regular meeting of the Board includes a cybersecurity report provided by the Company's Chief Information Officer and the Managing Director of Information Security. These reports focus on developments within the Company's cybersecurity program and provide an update on any cybersecurity events or concerns. The Board recently added a new director with expertise in cybersecurity to assist the Board to appropriately oversee the Company's efforts.


text: Spire's cybersecurity program is led by the Chief Information Officer and the Managing Director of Information Security, who together have over 40 years of experience in information technology and cybersecurity, along with a cross-functional team of technology, legal, physical security and risk leaders. Internal Audit provides assurances of risk management activities, including certain third-party cybersecurity activities, such as penetration testing.


text: Our Senior Vice President of Information Technology (who is also a certified Chief Information Security Officer) manages our security program. Oversight of the program occurs via IT metrics-based updates provided to an Information Technology Steering team (consisting of the executive officers and other key employees of the Company) on a quarterly basis. Additionally, multiple elements of our cybersecurity security program are tested internally and externally on a bi-yearly basis in alignment with our Sarbanes-Oxley information security controls and we engage independent third parties annually to assess the risks associated with our information technology assets. Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Lastly, a cybersecurity risk assessment is provided to our Board of Directors on an annual basis which includes metrics, security incidents, key risk indicators, and risk mitigation plan as well as on the status of material risks, mitigation measures, and incidents related to such risks. Our Board of Directors has overall responsibility for risk oversight, with the Information Technology Steering team assisting the Board in performing this function based on its respective areas of expertise. As such, the Information Technology Steering team performs materiality determinations of cyber incidents and advises the Board of directors accordingly.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: We maintain a comprehensive cybersecurity risk management program that aligns to the National Institute of Standards and Technology (NIST) Cyber Security Framework and adopts a variety of cybersecurity best practices across the enterprise. We leverage industry-leading cybersecurity vendors that provide the following capabilities: Managed Detection and Response (MDR); a Security Operations Center (SOC) that monitors the Company's IT assets on a 24x7x365 basis; tools to interdict emails with phishing links and malware payloads; data leak protection tools that provide real-time interdiction of data transfers outside of normal business usage; vulnerability detection and automated patching tools; firewalls and instruction detection systems; multi-factor authentication mechanisms; mobile device management systems; penetration testing; and various third-party assessments. Our critical IP data is maintained on segmented, access-controlled data stores. We utilize a variety of backup mechanisms for its data including both warm and cold storage solutions. Lastly, we utilize token-based technologies to support Payment Card Industry Data Security Standard (PCI DSS) compliant safe handling and protection of credit card data.


text: We have a defined security policy that is reviewed on an annual basis. We have established response procedures for cyber-security incidents and tests the procedures on a periodic basis. We provide robust computer-based cybersecurity and wire fraud / phishing awareness training to all new employees as well as training to existing employees on an annual basis. We have not experienced material information security incidents in the last three years nor have we incurred any material expenses related to penalties and/or settlements related to a material breach nor have we been materially affected or reasonably likely to have had a material adverse effect on us, our business strategy, results of operations, or financial condition. Nevertheless, we do carry a cybersecurity insurance policy.


text: The Trust does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. The Trust also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor detailing cybersecurity review processes, any potential risks and any incidents which could impact the Trust. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes or are reasonably likely to materially affect, the Trust, including its operations, results of operations, or financial condition.


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Global Head of IT. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (i) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (ii) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (iii) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (iv) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: The World Gold Council has an incident response plan ("IRP") which (i) identifies the incident response team and the roles and responsibilities of the team members, (ii) details the incident response lifecycle, including preparation, detection, response and recovery, and (iii) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact the Trust to be reported to the Principal Financial and Accounting Officer of the Sponsor.


text: The Trust also relies on its other service providers, including the Trustee and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on the Trust's service providers, including the Trustee and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor reviews and reports to the Board of Directors, the results of this annual review and any incidents or perceived risks.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor detailing the Sponsor's annual due diligence on the Trust's service providers, including a summary of any potential operational risks and any incidents which could impact the Trust. The Board of Directors also periodically receives reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.


text: GLDM does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of GLDM. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. GLDM also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor detailing the Sponsor's cybersecurity review processes, any potential risks and any incidents which could impact GLDM. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.

companyName: World Gold Trust

ticker: GLDM


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes are reasonably likely to materially affect, GLDM, including its operations, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this Annual Report for a discussion of the risks related to cybersecurity.


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Global Head of IT. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committe of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (1) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (2) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (3) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (4) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: The World Gold Council has an incident response plan ("IRP") which (1) identifies the incident response team and the roles and responsibilities of the team members, (2) details the incident response lifecycle, including preparation, detection, response and recovery, and (3) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact GLDM to be reported to the Principal Financial and Accounting Officer of the Sponsor.


text: GLDM also relies on its other service providers, including the Administrator and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on GLDM's service providers, including the Administrator and Custodians, which includes a revise of the relevant service provider's operational and cybersecurity controls. The Sponsor reviews and reports to the Board of Directors, the results of this annual review and any incidents or perceived risks.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor detailing the Sponsor's annual due diligence on GLDM's service providers, including a summary of any potential operational or cybersecurity risks and any incidents which could impact GLDM. The Board of Directors also periodically receives reports from World Gold Council and GLDM's service providers regarding their cybersecurity programs.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management process includes an evaluation of cybersecurity risk together with other company risks. The Company has established a cybersecurity risk management program (the "program") designed to assess, identify, and manage material cybersecurity risks. Our program is designed based on industry best practices and is aligned with the core components of frameworks established by the National Institute of Standards and Technology (NIST), Center for Internet Security (CIS) and International Organization for Standardization (ISO).

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: An annual risk assessment is performed to identify internal and external cybersecurity threats and vulnerabilities, assess the likelihood and potential impact of such threats and vulnerabilities, and prioritize the risks from such threats and vulnerabilities. The results of the risk assessment, along with professional judgment, are used to develop and implement cybersecurity risk mitigation strategies and controls.


text: A cybersecurity incident response plan that outlines a structured approach to investigating, containing, documenting, and mitigating cybersecurity incidents, including reporting findings and keeping senior management, the Audit Committee, and other key stakeholders informed and involved as appropriate; Annual external penetration testing to identify vulnerabilities, assess perimeter security, improve incident response, and strengthen security policies and procedures; Regular phishing, social engineering, and cybersecurity awareness training for employees with access to the Company's information technology environment;


text: Annual tabletop exercises to test incident response plans, improve communication and coordination between relevant employees, and identify gaps to inform needed adjustments to plans;


text: Ongoing risk assessments of third-party service providers designed to ensure they meet the Company's standards for reliability, security, compliance, and performance.


text: Third-party service providers are used in various capacities as part of our cybersecurity risk management program, including performing risk mitigation controls and providing cloud-based, cybersecurity services and platforms. For example, third-party service providers are used to conduct our external penetration testing, as well as assist the Company in detecting, responding, and mitigating cybersecurity incidents. The Company uses a variety of processes to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are required to complete a detailed questionnaire, which is used to identify and assess material cybersecurity risks. In addition, the Company performs an annual review of independent attestation reports of the third-party service providers' control environments designed to ensure that the controls meet Company security requirements and that any identified issues in the independent attestation reports do not present material cybersecurity risks to the Company.


text: To date, we have not identified any cybersecurity threats or incidents which have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition; however, there is no guarantee that we will not be the subject of future successful cybersecurity threats or incidents that may materially and adversely affect the Company, including its business strategy, financial condition, results of operations or prospects. Additional information on cybersecurity-related risks is discussed under the heading "Risks Associated with our Information Technology Systems" under Item 1A, which should be read in conjunction with Item 1C.


text: Cybersecurity Governance Our Board of Directors has delegated oversight responsibilities for enterprise risk, including cybersecurity risk, to the Audit Committee. The Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide periodic updates to the Audit Committee regarding the Company's cybersecurity risk management program. The Company has a cybersecurity incident response plan that includes a process to evaluate cybersecurity incidents for materiality. The escalation protocol includes reporting potentially material cybersecurity incidents to senior members of management for further evaluation. Any cybersecurity incident determined to have a material impact on the Company is timely reported to the Audit Committee.


text: The CISO has primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. Our CISO has 25 years of experience in information technology and cybersecurity generally, which has been gained from a combination of education, including relevant degrees, and prior work experience.


text: We have implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is an element of and is integrated into our overall enterprise risk management program, and is a key component of our annual organizational risk assessment. Our cybersecurity risk management program is based in part on, and incorporates elements of, the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Azenta, Inc.

ticker: AZTA


text: Our cybersecurity risk management program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;


text: a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and policies, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management; assessment of material cybersecurity risks posed by third-party service providers, including risks to employee, customer and financial information; a cybersecurity incident response protocol that includes procedures for responding to cybersecurity incidents; and business continuity plans.


text: As part of the above processes, we engage, as necessary, consultants and other third parties, to review our cybersecurity incidents if material to help quantify the impact and identify areas for continued focus, improvement, and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to confidential, proprietary, personal, or employee data, or to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or audits for System and Organization Controls (SOC) compliance.


text: We have been, and expect to continue to be, subject to cybersecurity risks and incidents related to our business. We have not experienced any material cybersecurity incidents during the last fiscal year. For more information about the cybersecurity risks we face, see Item 1A – Risk Factors of this Annual Report on Form 10-K.


text: Our Board considers cybersecurity risk as part of its enterprise risk management oversight function. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. This oversight includes periodic reports from management concerning cybersecurity related risks. The management of the program is the responsibility of our Risk Management Committee, comprised of our Chief Financial Officer, Chief Digital & Information Officer, Chief Accounting Officer and General Counsel. Our Chief Digital & Information Officer, who has over 30 years of extensive work experience in the field of technology and cybersecurity, leads our team of cybersecurity professionals and provides the Risk Management Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. Our team of cybersecurity professionals monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through the cybersecurity risk management and processes described above, including the operation of our incident response plan. The Risk Management Committee provides updates to the Audit Committee on our cybersecurity risk management program as appropriate, including updates on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies; (3) applicable regulatory requirements; and (4) industry standards. The Risk Management Committee also notifies the Board of any significant and/or material cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: Risk Management and Strategy In an effort to mitigate cyber intrusions, the Company has implemented a cybersecurity program intended to protect and preserve the integrity, confidentiality and reliability of data and systems. Cybersecurity risks are a key component of the Company's overall risk management, is integrated into other corporate processes and goes beyond the Company to certain vendors or suppliers. The Company has instituted certain cybersecurity requirements, interacted with various external organizations including its state regulator, and participated in proprietary briefings by industry experts to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: RGC RESOURCES INC

ticker: RGCO


text: The Company's cybersecurity program fundamentally aligns with the COBIT framework. This is reflected in our related policies, practices and procedures. We have multiple layers of security controls as well as a third-party SOC that helps identify, avoid and mitigate cybersecurity threats. The evaluation of risks includes consideration of cybersecurity and privacy risk, including (1) potential impact on the Company's employees, customers, and other stakeholders, (2) intelligence briefings on notable cyber events impacting the industry and (3) evaluation of external threats. The Company utilizes internal and third-party assessment tools and tests to evaluate its cyber risk policies, practices and procedures as well as to challenge how its defenses are built and deployed. These assessments provide opportunities for critical self-analysis, constructive feedback from third parties, and learnings from industry experts to enhance cyber resilience. Both formal and informal cybersecurity awareness trainings are provided to employees to help identify and avoid cybersecurity threats and to ensure employees understand the Company's cyber risk management policies along with the key role they play to ensure cyber hygiene. The Company has established a cybersecurity incident response team that includes the CEO, CFO, VP of HR, IT Director and other personnel. The Company has also retained counsel to advise on cybersecurity matters.


text: The Company's current security posture and regulatory compliance efforts are intended to address evolving and changing cyber threats. During the past three years, the Company has not experienced a cybersecurity incident resulting in a material impact to its business strategy, results of operations, or financial condition. The Company has identified the risk that a hostile cyber intrusion could severely impair the Company's operations, lead to disclosure of confidential information, damage the Company's reputation or otherwise have an adverse effect on the Companies' business as disclosed within Item 1A. Risk Factors.


text: The Company's Board of Directors, including its Audit Committee, provides oversight of the Company's risks from cybersecurity threats. Management, including the CEO, CFO and IT personnel, presents formal reports to the Audit Committee and to the full board at least annually, as well as whenever cyber events warrant update.


text: We have policies and procedures for identifying, assessing, and managing material risks associated with cybersecurity threats. We seek to address cybersecurity risks through a comprehensive approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third party information technology vendor), the use of a third party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular penetration testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan. We also maintain cybersecurity insurance that provides for certain protection against potential losses arising from a cybersecurity incident.

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: We have an Information Technology committee that meets at least quarterly and includes members of our management team and compliance team. The members of the Information Technology committee have gained cybersecurity experience through years of training, internal and external discussions, and the development, implementation, and periodic evaluation of our cybersecurity policies.


text: We have not experienced a material cybersecurity incident, any expenses we have incurred from cybersecurity breaches have been immaterial, and we are not aware of any cybersecurity incidents that are reasonably likely to materially affect our business. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents. However, future incidents could have a material and adverse impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A, "Risk Factors."


text: Our Board of Directors oversees cybersecurity risk management as part of its general oversight function. The Company's management team provides updates to the Board of Directors regarding cybersecurity as appropriate.


text: Risk Management and Strategy We rely on computer systems and information technology to conduct our business, including to securely transmit data associated with cashless payments. These systems and technology are increasingly complex and vital to our operations, which has resulted in an expansion of our technological presence and corresponding risk exposure. In addition, these systems are inherently vulnerable to disruption or failure, as well as internal and external security breaches, denial of service attacks and other disruptive problems caused by cybersecurity threat actors. We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition based on information known to us as of the date of this report. Under the oversight of our Board, our management has developed a cybersecurity risk management program based on the Center for Internet Security Critical Security Controls framework that is integrated with our overall risk management program and is designed to assess, identify, manage and mitigate material cybersecurity risks. Our cybersecurity program includes policies and procedures that govern how security measures and controls are implemented and maintained. We identify and implement security controls to address cybersecurity risks based on an annual risk assessment and our evaluation of relevant factors, including the likelihood of risk, the potential impact and severity of the risk, the feasibility and expense of potential controls, and the impact of controls on our operations. Our cybersecurity program includes regular security assessments and testing, regular employee trainings, third-party security audits, and solutions designed to detect and mitigate cybersecurity threats, including data breaches, malware, ransomware and phishing attacks.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: We utilize third party security firms and consultants to test our cybersecurity control environment and to provide certain security measures that we use to protect our information technology environment, including to detect and filter external phishing and malware threats, to provide enhanced endpoint protection and to protect our data through data classification. We have developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: We have prepared a written incident response plan and crisis management plan to enhance our ability to respond to cybersecurity incidents. We periodically conduct internal tabletop exercises to enhance incident response preparedness. Our employees are required to participate in regular cybersecurity awareness trainings upon hiring and on a quarterly basis thereafter.


text: Cybersecurity Governance Our Vice President of Information Technology (our VP of IT) has primary responsibility for monitoring, assessing and managing our material risks from cybersecurity threats. He oversees a dedicated information technology team that is responsible for managing enterprise-wide information security strategy, policy, standards, architecture and processes, and is regularly informed of, and monitors, the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our VP of IT has over 25 years of information technology experience, has earned a graduate degree in Cybersecurity and Information Assurance, and maintains relevant industry designations including Certified Information Systems Security Professional and Certified Information Security Manager certifications.


text: Our Board considers cybersecurity risk as a part of its overall risk oversight function. Our Board receives reports from our VP of IT at least bi-annually, and on an as-needed basis, on cybersecurity risks and actions taken to mitigate those risks. These reports include updates on our cybersecurity risks and the emerging threat environment, and the status of projects designed to enhance our information security systems and programs.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to materially protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes policies and processes for assessing, identifying, and managing risk from cybersecurity threats as well as a cybersecurity incident response plan. Our cybersecurity risk management program is integrated into our overall risk management system and processes, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other strategic, operational, legal, compliance, and financial risk areas.

companyName: VERU INC.

ticker: VERU


text: Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained, with assistance from a third-party service provider. These policies and procedures and the resulting safeguards are designed and evaluated in light of our risk assessments. We have implemented access controls, firewalls, and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes to safeguard our information systems. We maintain a business continuity and disaster recovery plan designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when hired and based on periodic phishing tests.


text: As of the date of this Annual Report on Form 10-K, we have not identified risks from known cybersecurity threats, including or as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks to us from cybersecurity threats, see "Risk Factors" in Item 1A. of this report.


text: One of the key functions of our board of directors is risk oversight, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly and through the audit committee.


text: Our Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from a third-party service provider. Our Chief Financial Officer supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include quarterly briefings from our third-party service provider and alerts and reports produced by security tools deployed in the IT environment. Our Chief Financial Officer has over 10 years of experience in overseeing our cybersecurity and information technology programs. We also rely on our third-party service provider for advice and expertise on monitoring evolving industry standards and best practices.


text: Our Chief Financial Officer provides periodic briefings to the board of directors regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cyber security systems testing, and activities of third parties.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our IT department and our management actively oversee our risk management program, including the management of cybersecurity risks. We have contracted with cybersecurity and risk assessment experts to help test our systems and guide the ongoing development of best practices policies. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: cbdMD, Inc.

ticker: YCBD


text: Network and endpoint protection: Utilizing firewalls, intrusion detection systems, antivirus software, and advanced encryption protocols to safeguard sensitive data and systems. Multi-factor authentication, security and principle of least privileged (PoLP)


text: Employee training and awareness programs: Educating employees on cybersecurity best practices and conducting phishing simulations to promote vigilance against social engineering attacks.


text: Incident detection and response plans: Maintaining real-time monitoring and implementing a structured incident response plan that allows us to quickly detect, respond to, and recover from cyber incidents.


text: Third-party risk management: Vetting the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.


text: While we have not experienced a cybersecurity incident that has had a material impact to date, the threat of potential incidents remains high. We continually evaluate our exposure to risks such as: Operational disruption from ransomware or other cyberattacks. Data breaches that could compromise customer or proprietary information. Regulatory and legal exposure arising from cybersecurity failures.


text: As part of our risk management framework, we regularly assess whether any cybersecurity incidents, or the likelihood of such incidents, could materially affect our business. We are also committed to continuous improvements to address emerging threats. Governance.


text: Our board of directors plays an active role in overseeing the company's approach to managing cybersecurity risks. The board receives regular updates from senior management regarding the company's cybersecurity strategy, potential risks, and any incidents that may arise. These updates ensure that the board remains informed and able to provide guidance on cybersecurity matters.


text: The board is also regularly briefed by management on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.


text: Management, led by the IT department, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The IT department is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.


text: The Company is subject to attempted cyberattacks and other cybersecurity risks. Our business relies on various information technology and application systems that may be impacted by a malicious cyberattack. Such cyber incidents may cause lost revenues or increased expenses stemming from inability to use certain systems for a period of time, loss of financial assets, fines related to breach of personally identifiable information or other protected information, reputational damage and remediation and litigation costs as well as increased cybersecurity protection costs.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: We regularly evaluate cybersecurity risks from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are monitored and reviewed by management on a periodic basis as deemed appropriate.


text: We have developed and continue to invest in a variety of solutions and controls for real-time threat prevention, detection and instantaneous, automated reaction to such cyberattacks. Our overall strategy in combatting known cybersecurity risks includes:


text: The use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect intrusions such as identity attacks. Engagement of a provider for real-time threat detection, alerting and immediate, automated remediation service for the entire organization.


text: The use of multi-factor authentication for all remote users when they connect to the corporate network and the corporate email platform.


text: The deployment of updates and patches as they are available for all installed versions of enterprise software to reduce the exposure to vulnerabilities.


text: The review of the security procedures and controls used by third parties that may host or otherwise have access to the Company's data. If necessary, the use of third-party security experts if and when an incident is detected.


text: Regardless of the controls we have in place, cybersecurity risks continue to become more complex and pervasive, and our internal controls cannot provide absolute assurance that we will be able to protect ourselves from significant cyberattack incidents. Additionally, by outsourcing certain administrative functions to third parties, we may be exposed to risk of data security breaches against those third parties.


text: We are not aware of any existing cybersecurity threats that would materially affect, or that are reasonably likely to materially affect, our business strategy, results of operations, liquidity or financial conditions. Furthermore, we are not aware of having experienced any significant cybersecurity incidents during fiscal year 2024. Management periodically updates the Board of Directors regarding efforts to minimize cybersecurity risks.


text: At Track Group, Inc., we recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: Track Group, Inc.

ticker: TRCK


text: We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and then reported to the Board of Directors.


text: We comply with the AICPA Trust Services Criteria for Security and have based our Information Security Management System on the ISO 27001 standard.


text: Track Group's Chief Information Security Officer, Tim Hardy, has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and report any findings and recommendations, as appropriate, to the full Board of Directors for consideration.


text: Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.


text: Risk Management and Strategy Our cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resident on them. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats. We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms. Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: An incident response plan has been established which provides detailed information on actions to take in the event of an incident. The incident response plan includes the scope of the plan, establishes the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high pressure situations which can occur during incidents.


text: Our management periodically evaluates information on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2024, and through the date of filing of this Form 10-K.


text: While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.


text: The Company is committed to safeguarding its information systems and data against evolving cybersecurity threats. With operations spanning traditional publishing and the technology-driven Journal Technologies segment, the Company prioritizes robust cybersecurity measures to protect its operations, customers, and stakeholders. The Company employs a comprehensive cybersecurity risk management framework to identify, assess, and address risks that could impact business operations, sensitive client data, and the Company's portfolio of marketable securities. This framework incorporates: Technology Solutions: Prioritizing the security of Journal Technologies' court and justice software systems, which manage critical data and workflows. Traditional Business: Protecting the systems and data supporting the Company's publishing and printing operations. Financial Portfolio: Securing systems and processes related to the management of the Company's substantial marketable securities portfolio.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: Governance and Oversight The Company's Board of Directors as a whole supervises the Company's cybersecurity strategy and regularly reviews cybersecurity risks, incident reports, and risk mitigation initiatives.


text: Journal Technologies has a Chief Information Security Office (CISO) made up of internal cybersecurity practitioners who evaluate, identify, and mitigate significant risks posed by cybersecurity threats, with a focus on safeguarding the Company's technology, data, and intellectual property.


text: In August 2024, Journal Technologies hired a Director of Security Operations to lead the CISO team. With extensive IT leadership experience and a Certified Information Systems Security Professional (CISSP) credential, the Director oversees security strategies, incident response plans, and risk assessments. Reporting directly to senior management, the Director works closely with internal teams and external experts to align Journal Technologies' practices with industry standards.


text: The Company has also established a dedicated Cybersecurity Working Group, with members from both the Traditional Business and Journal Technologies, to collaborate on threat intelligence, incident response strategies, policy alignment, and security technology advancements. This partnership ensures both entities remain proactive in addressing evolving threats and benefit from shared expertise to implement coordinated security measures. The Company's senior management works closely with the CISO and the Cybersecurity Working Group to identify matters requiring the attention of the Board of Directors.


text: Threat Detection and Response: The Company employs enterprise security systems as the backbone of a defense in depth (DiD) strategy, such as patch management, intrusion detection, and network segmentation. A managed detection and response (MDR) solution from a world-class security company unifies our antivirus/malware (NGAV), endpoint detection and response (EDR), cyber threat intelligence, managed threat hunting capabilities, and security hygiene.


text: Employee Training and Awareness: The Company provides regular cybersecurity training for employees to enhance awareness of common threats, such as phishing and ransomware. All Journal Technologies employees undergo annual CJIS training and certification.


text: Risk Register: The Company maintains a central Risk Register as part of its cybersecurity risk management framework. This Risk Register identifies risks and their potential impacts, mitigation strategies, and ongoing monitoring efforts.


text: Third-Party Risk Management: The Company evaluates third-party vendors prior to onboarding to ensure they have industry standard best practices in place and, when applicable, verified by an external audit firm. The Company monitors third-party providers for breaches or other cybersecurity events and annually review each vendor's SOC 2 audit reports.


text: Incident Response Planning: The Company maintains a formalized incident response (IR) plan to address and remediate cybersecurity incidents. The plan defines roles and responsibilities and includes runbooks for likely scenarios. The Company performs testing of the IR plan at least annually with the results reported to senior management.


text: Certifications: Several of the Company's security personnel on the CISO team have and maintain CISSP, GCIH (GIAC Certified Incident Handler) and OSCP (Offensive Security Certified Professional) certifications.


text: Business Continuity: The Traditional Business and Journal Technologies have each implemented a Business Continuity Plan and Disaster Recovery (BCP/DR) with procedures aimed at minimizing downtime and facilitating recovery of both internal and customer assets in the event of a service disruption. The plan includes clearly defined roles, step-by-step recovery processes, and prioritized action plans to address various scenarios, such as natural disasters, cyber incidents, and hardware failures. We regularly test and update our BCP/DRs.


text: Enforcing multi-factor authentication (MFA) for all systems Deploying anti-phishing solutions to detect and block suspicious emails Using single sign-on (SSO) solutions integrated with secure identity providers Simulating phishing attacks to measure awareness and improve training programs Implementing Security Information and Event Management (SIEM) systems for continuous monitoring and logging.


text: Incident Reporting and Disclosure The Company adheres to strict protocols for evaluating and reporting cybersecurity incidents. Any incidents determined to have a material impact—assessed based on financial, operational, or reputational factors—are raised with the Board of Directors and, if necessary, disclosed in accordance with regulatory requirements.


text: Risk management and strategy We rely on our technology network infrastructure and information systems to operate our business, interact with vendors and customers, and collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats and incidents, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity or availability of such systems or related information.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: We manage our risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by the Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. The Company seeks to prioritize the management of cybersecurity risk and the protection of confidential information and systems, and the Company's program and processes are based on industry standards as guided by the National Institute of Standards and Technology ("NIST") framework. Under the supervision of the Chief Financial Officer ("CFO") and our Director of IT, we regularly work to identify all computing assets including hardware, software, and network infrastructure in order to conduct a risk assessment. We consider threats that may originate from both internal and external sources and maintain technical security controls internally. To identify risks, we complete vulnerability assessments on a recurring basis to help proactively identify potential weaknesses. We additionally engage a third-party vendor to conduct external and internal penetration testing on a periodic basis in order to assist in identifying additional vulnerabilities in our environment. We also perform business continuity planning and disaster recovery exercises throughout the organization annually by our in-house team.


text: In connection with our overall cybersecurity risk management processes, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors. Employees at the Company receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. We also engage a third-party service provider to provide monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. We additionally have a cybersecurity incident response plan ("CIRP") that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents.


text: The Company's Director of IT reports to our CFO and leads the Information Technology team (collectively "the IT Security Team"). The IT Security Team is responsible for the strategic oversight of cybersecurity risk management and strategy including the identification and assessment of cybersecurity threats and incidents. Periodically, they are also responsible, alongside the CFO and senior management, to keep the Audit Committee of the Board of Directors informed and briefed with respect to cybersecurity risks and incidents. Our Director of IT has extensive experience of over 15 years in various IT roles across a range of cyber technologies, processes and strategies and is supported by the IT Security Team and the wider IT team, including the IT Security Manager, to support the Company's cyber risk management processes, including the prevention, detection and mitigation of cybersecurity threats and incidents, and any required response to and remediation of such cybersecurity threats or incidents.


text: The Audit Committee is responsible for providing governance and oversight over the Company's operational cybersecurity program, risk management and incident response on behalf of the Board. The CFO reports the results of risk assessments, including the evaluation of cybersecurity risks, the actions that the Company has taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry to the Audit Committee. This includes assessing the measures and controls in place to mitigate cybersecurity risks and providing oversight of the response of any significant cybersecurity threats and incidents.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. Our policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, we use various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and routine employee awareness updates.

companyName: AmeriCann, Inc.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including monitoring systems and employee engagement.


text: Our board of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and our management is responsible for the day-to-day supervision of the material risks we may face.


text: Risk Management and Strategy The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Audit Committee. The Company has in the past, and may continue to do so in the future, engage third-party consultants, to review and assess the Company's information technology and security.


text: To identify and assess material risks from cybersecurity threats, we follow best practices in routine network and endpoint auditing, vulnerability assessments, penetration testing, and other forms of security auditing. We continuously monitor endpoint activity and network traffic for unusual or prohibited behavior to prevent, identify, and contain malicious actions.


text: We have developed incident response plans by using the information gained through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. Such plans set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats including but not limited to malware, ransomware, and social engineering attacks, password hygiene and incident reporting processes.


text: We review our cybersecurity risk framework and related policies annually with senior management to help identify areas for continued focus and improvement. We also engage third party experts to review and assess our processes to ensure they are robust and consistent with the current security landscape. The data center where we host our critical data is SOC II complaint.


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data by discussing issues to be addressed and recommending securities measures to be improved where possible.


text: Although in the periods reported we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including penalties and settlements, were immaterial, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. To prepare for any such event, we have a full Disaster Recovery plan in place that is tested annually to ensure resilience against a myriad of threats.


text: Role of the Board of Directors and the Audit Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly, which covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our incident response plan, material cybersecurity risks, whether developing or actual, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations, technologies and best practices. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Role of Management Our Chief Financial Officer is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our Chief Financial Officer works to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: The Company places a high priority on safeguarding its data, systems, and infrastructure from cybersecurity threats. To manage this critical aspect of operations, the Company partners with a third-party IT provider that specializes in cybersecurity services. Established in 1997, this provider brings over two decades of expertise in managing and mitigating cyber risks, including network security, vulnerability assessments, and incident response planning. The provider's comprehensive approach ensures the protection of the Company's sensitive information and critical systems, while also adhering to industry best practices and regulatory requirements. By leveraging the expertise of its third-party IT provider, the Company is able to implement robust cybersecurity measures that support operational continuity and reduce exposure to potential security incidents.


text: Cybersecurity protection and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud and violation of privacy or security laws.

companyName: FULLER H B CO

ticker: FUL


text: Our cybersecurity risk is managed as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity) is designed to assess, identify and manage cybersecurity-related risks and mitigation measures. Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident.


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to senior management and, if warranted, to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected our business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors.


text: Governance and Management's Responsibilities Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities, and has delegated responsibility for oversight of this risk to the audit committee. The audit committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. Our audit committee oversees our enterprise risk management ("ERM") process, and cybersecurity represents an important component of our overall approach to ERM. Our cybersecurity policies, standards, processes and practices are informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional program that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To manage our cybersecurity program, management has established a cybersecurity steering committee and cybersecurity incident response team, both led by our chief information officer. Our cybersecurity steering committee and cybersecurity incident response team include multidisciplinary groups of corporate and operational leaders, external cyber-specialist resources and technical experts in cybersecurity risk management, incident response and security operations. Many members of our cybersecurity team have extensive experience in the operations of networks, network security and infrastructure management. Our chief information officer has over 20 years of information technology experience, including leadership roles at large, global, publicly-traded companies, and is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity steering committee and cybersecurity incident response team, and through the use of technological tools and software. Our chief information officer is also responsible for updating the audit committee on cybersecurity on a quarterly basis and, where appropriate, escalating certain cybersecurity incidents to the full Board of Directors.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of Mullen's overall enterprise risk management framework. We have implemented comprehensive measures to safeguard our information systems, protect sensitive data, and identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program encompasses threat prevention, detection, mitigation, and remediation strategies tailored to the dynamic risk landscape in the automotive sector.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: Our risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of advanced cybersecurity technologies. These measures are designed to help protect Mullen's proprietary systems and customer data from both internal and external cybersecurity threats. From time to time, Mullen has engaged third parties, on an as needed basis, to perform various cybersecurity services and risk assessments. Additionally, we maintain third-party tools to monitor for vulnerabilities.


text: We perform diligence, which includes reviewing SOC II reports, on certain third-party service providers who provide critical data and cloud services in order to oversee and identify risks from cybersecurity threats associated with such critical third-party service providers.


text: As a function of its oversight role, the Board is responsible for ensuring that material risks are identified and managed appropriately. While the Board of Directors has the ultimate responsibility for risk oversight, the Board of Directors has delegated responsibility for the oversight of data privacy and cybersecurity to the Audit Committee. Senior management of Mullen regularly report to the full Board regarding risks we face, however, there has been no specific reports of risks related to cybersecurity threats that have been discussed with the Board.


text: Our VP of IT and our Director of IT Operations are responsible for assessing and managing risks from cybersecurity threats. Our VP of IT and Director of IT Operations each have over 20 years of experience in information technology, with cybersecurity comprising a significant role in their experience. The VP of IT and the Director of IT Operations are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents as a function of their management of our cybersecurity program.


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as the result of past cybersecurity incidents, have had, or are reasonably likely to have, a material effect on our business strategy, results of operations, or financial condition. While we strive to employ safeguards, no system can guarantee absolute security and we cannot guarantee that any future risk from cybersecurity, including any future cybersecurity incidents, will not be material to our business strategy, results of operations or financial condition.


text: Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods, and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers, and other third parties. Our business involves the collection, processing, storage, and transmission of personally identifiable information and other sensitive and confidential information. This data is wide-ranging and relates to our employees, customers, and third parties.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: Our management, led by our Chief Executive Officer, has the overall responsibility for identifying, assessing and managing any material risks from cybersecurity threats, and our Board of Directors, assists in overseeing and monitoring cybersecurity risks and risk management. Our cybersecurity posture is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. This posture includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect, and respond to cybersecurity threats and incidents, we undertake the following activities: Closely monitor emerging data protection laws and implement changes to our processes designed to comply; Undertake reviews of our consumer-facing and internal policies and statements related to cybersecurity; Proactively inform our customers of substantive changes related to customer data handling; Conduct annual cybersecurity training for all our employees;


text: Through policy, practice, and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;


text: Update and assess our cybersecurity technologies to address threats and vulnerabilities; and Carry cybersecurity insurance to protect against potential losses from incidents. Cybersecurity Risk Assessment Program We do not have a formal cybersecurity risk assessment program.


text: Policies and Procedures for Third-Party Service Providers We do not have specific policies and procedures to oversee, identify, or mitigate the cybersecurity risks associated with our use of third-party service providers, other than relying on SOC 1 Type 2 reports for materially in-scope applications.


text: Activities to Prevent, Detect, and Minimize Cybersecurity Incidents We undertake various activities to prevent, detect, and minimize the effects of cybersecurity incidents. These activities include: ensuring that company data accessed via a desktop or laptop computer is only accessible from company-owned computers ensuring that company-owned computers are regularly updated and maintained, are running the latest versions of our Endpoint Detection and Response antivirus software ensuring that company-owned computers access the internet through secure connections via our corporate VPN solution updating and assessing our cybersecurity technologies such as our firewall and various cybersecurity software Impact of Previous Cybersecurity Incidents At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.


text: Impact on Results of Operations or Financial Condition Cybersecurity risks and incidents have not materially affected our results of operations or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.


text: Consideration of Cybersecurity Risks in Business Strategy, Financial Planning, and Capital Allocation Cybersecurity risks are considered as part of our business strategy, financial planning, and capital allocation. We regularly review and update our cybersecurity posture to address emerging threats and ensure the protection of our information systems.


text: Risk Management and Strategy The Company has developed a standards-based information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. The maturity and effectiveness of the security program is reviewed biennially by a reputable third party.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management. An internal information security audit program is in place to ensure controls remain operational and effective.


text: The Company has a written incident response plan ("IRP") and conducts tabletop exercises to enhance incident response preparedness. Disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training, including phishing simulation training, when hired and periodically throughout the year.


text: The Company's executive leadership team meets regularly to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discuss with the Board changes in assessment of these risks and mitigation plans.


text: The Company activated their incident response plan to address a security incident in 2024. The Company is not aware of additional cybersecurity threats or any material cybersecurity incidents to date that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: On July 10, 2024, we detected unauthorized occurrences on a portion of our information technology (IT) systems. Upon detecting the unauthorized occurrences, we immediately began taking steps to contain, assess and remediate the cybersecurity incident, including beginning an investigation with leading external cybersecurity specialists, activating our incident response plan, and shutting down some systems. As a result of these and other measures, we believe the threat actor was ejected from our IT systems on July 10, 2024.


text: After we shut down some of our systems, we experienced disruption to certain of our operations, including interrupted manufacturing at our domestic plants and delayed order fulfillment for our retail network and delay of some wholesale shipments. Within a few days of the incident, we were able to resume retail order fulfillment and caught up on fulfilling wholesale orders that were delayed as a result of the cybersecurity incident. We have fully restored the IT systems and data and our investigation has not found evidence that any of our core operating systems for manufacturing, wholesale and retail order processing and fulfillment, or financial reporting were impacted.


text: While we believe the impacts were not material to our financial condition and results of operations for the fiscal year, we estimate that between $1,000 and $2,000 of sales were lost due to the shutdown during the cybersecurity incident. During the third quarter of 2024, we also incurred legal and remediation costs related to the incident of approximately $98 which are included in selling, general and administrative expenses. In addition, cost of goods sold for year ended November 30, 2024 includes $609 for wages paid to hourly production employees during the work stoppage resulting from the cybersecurity incident. Because no inventory was produced during the temporary shutdown of our manufacturing operations, these wages were charged directly to expense. We are seeking reimbursement of certain costs, expenses and losses stemming from the cybersecurity incident and have submitted a claim to our cybersecurity insurer. We expect final resolution and payment of the claim during the first half of 2025.


text: Additionally, in Item 1A Risk Factors under the heading of "Risks Related to Electronic Data Processing and Digital Information," forward-looking cybersecurity threats that could have a material impact on the Company are discussed. That section of Item 1A should be read in conjunction with this Item 1C.


text: The Chief Information Officer ("CIO") holds primary oversight responsibility for the team managing the development, operation, and maintenance of our information security program. This team also has responsibility to maintain and enhance the Company's written cyber security incident response plan, which identifies incident severity classifications and serves as a trigger for escalation for the response team.


text: With over 25 years of experience across diverse IT technologies, the CIO brings extensive expertise to the role. The CIO is also a member of the Company's executive leadership team, meeting regularly with the CEO, CFO, and other senior leaders. The CIO directly reports to the Board at least annually, addressing cybersecurity risks and strategy, and attends Board meetings to discuss cybersecurity matters as needed. The Audit Committee provides oversight of the information security program. The CIO reports to the Audit Committee annually on cybersecurity risks and related internal controls and attends quarterly meetings to provide updates and address any questions regarding cybersecurity and information technology systems.


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Kiromic Biopharma, Inc.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.


text: We have a multi-layered approach to assess, identify and manage material risks from cybersecurity threats. This approach includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other cybersecurity incidents or vulnerabilities affecting the data.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a cybersecurity incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.


text: As part of our risk management process, we conduct regular application security assessments to identify vulnerabilities within our IT infrastructure. These assessments include both automated scans and manual reviews by our cybersecurity team. Threat intelligence feeds and security reports are continuously monitored, with the goal of staying ahead of emerging threats. In the event of a cybersecurity incident, we maintain incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually along with random internal phishing campaigns.


text: We are led by our Director of IT, who is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with our senior leadership team. We also engage assessors, consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. Our cybersecurity risks and associated mitigations are evaluated by senior leadership and routinely by our Board of Directors.


text: Our Director of IT, who has extensive cybersecurity knowledge and skills gained from over 10 years of work experience in various information technology roles, heads the team responsible for implementing and maintaining cybersecurity and data protection practices and reports directly to the Chief Financial Officer.


text: As of the date of this report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Cybersecurity threats are continually evolving, and no assurances can be given that our risk management systems and processes will fully mitigate all cybersecurity threats and risks.


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.

companyName: iShares S&P GSCI Commodity-Indexed Trust

ticker: GSG