text: In the ordinary course of business, our board of directors receives at a minimum annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Both our Information Technology Steering Committee and Enterprise Risk Management Committee consists of members of the Executive Management Team and department heads with relevant technology experience and meets on a monthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Audit Committee which also meets on a monthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Audit Committee sooner than its next monthly update.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. As of this reporting, the Bank has not experienced any S1-Critical/Material incidents.

companyName: COMMUNITY WEST BANCSHARES /

secItem: Item 1C


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our trust account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any material cybersecurity incidents since our Initial Public Offering.

companyName: bleuacacia ltd


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in depth, layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology based products and services by us and our customers.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Information Security Officer, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers. We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.


text: Chief Information Security Officer, who reports to the Chief Operating Officer, has over 27 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have a material adverse effect on us."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level committee designated by our board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board of Directors receives an Annual Report from the Chief Information Security Officer on the Bank's Information Technology Systems, including cybersecurity risk.


text: We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks from nation state actors that might target our ecosystem through specific industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial condition, performance, our brand and results of operations.

companyName: EPLUS INC

ticker: PLUS


text: We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive culture of security, whereby all e Plus employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.


text: The processes overseen by our information security team are integrated with our enterprise risk management ("ERM") program, including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.


text: Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.


text: Our Board of Directors has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board of Directors. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board of Directors, as appropriate.


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to Item 1A. "Risk Factors."


text: Cybersecurity Risk Management and Strategy Roivant's corporate information security organization, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cybersecurity threat and incident detection and response centrally at Roivant and the majority of our Vants. Certain of our Vants, including Immunovant, Dermavant and our healthcare technology Vants, have established and maintain separate cybersecurity functions which are similarly designed to protect their information and assets from cybersecurity threats or incidents.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: Roivant and the Vants' information security organization manages a robust enterprise security structure with the goal of preventing and mitigating any cybersecurity incidents, while simultaneously working to continually increase information technology system resilience designed to minimize any business impact should a cybersecurity incident occur. Central to Roivant's information security organization is our Cybersecurity Incident Response Team, which is responsible for the protection, detection and response capabilities used to protect our data and enterprise computing networks. A Cybersecurity Risk Governance Committee oversees processes for identifying and mitigating cybersecurity threats and incidents and helps align our risk exposure with our strategic objectives. Cybersecurity threats and incidents deemed to have a moderate or higher business impact, even if immaterial to us as a whole, are reported to the Corporate Risk Management Committee and shared with Roivant's board of directors.


text: Roivant and the Vants implement multiple levels of cybersecurity measures, including standard malware detection and prevention software, email security programs, privileged access management, vulnerability detection and remediation software, security patching management, security event logging and reviews and special isolation and access controls for data repositories that may contain sensitive information, including protected health information.


text: Roivant and the Vants' cybersecurity programs are informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify and manage risks from cybersecurity threats and incidents. In addition, we have implemented employee security and awareness training related to cybersecurity threats and incidents.


text: Roivant and the Vants undergo periodic internal compliance audits and external reviews to evaluate our controls, including cybersecurity controls. Additionally, a majority of our information technology systems are built on services provided by third parties. In an effort to minimize third-party risk, we have established a process designed to assess the cybersecurity practices of third-party suppliers and related risks, including through review of relevant supplier certifications and cybersecurity procedures and responses to standardized information-gathering questionnaires, as we deem applicable and appropriate. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from any such compromise or failure.


text: Governance Related to Cybersecurity Risks Roivant's board of directors oversees our overall risk management strategy, including with respect to cybersecurity risks. Cybersecurity risk management policies and procedures are integrated into our overall risk management strategy, which is overseen by the audit committee of the board of directors ("Audit Committee"). At least annually, the Audit Committee discusses our risk management program, including any information security and technology risks and findings from any audits, with our internal audit staff, including our Chief Accounting Officer.


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy centrally at Roivant and the majority of our Vants. Our CISO has extensive cybersecurity experience across a wide array of industries, with previous leadership positions specializing in safeguarding healthcare data across various health technology companies.


text: At Immunovant, Dermavant and the healthcare technology Vants that have established and maintain separate cybersecurity functions, governance is similarly overseen in the first instance by the boards of directors of those Vants as part of their overall risk management strategy, with ultimate oversight on a company-wide basis by the Roivant board of directors.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors - risks relating to "cyber-attacks or other breaches of information technology security could adversely impact our business and operation".


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access;


text: protection of sensitive information; detection, assessment, and response to cyber threats; and continuous improvement of our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged approach to address cyber threats and incidents that includes (i) implementation of various industry best practices, (ii) proactive monitoring of our IT systems, (iii) ongoing employee training, (iv) quarterly phishing campaigns, (v) continued education for our cybersecurity team, and (vi) regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cybersecurity Framework for IT. We have an Information Technology Steering Committee that oversees the IT function, material projects, budgeting, and cybersecurity. In addition, we have an Incident Response Team, as highlighted in our cybersecurity policy to respond to any information security risks or incidents. These committees report directly to the Audit Committee of the Board of Directors, which is responsible for overall oversight of the Company's cybersecurity program.


text: We rely upon both internal and external resources for evaluating and enhancing our cyber posture. Our information security team works with external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. We require annual cybersecurity training by our employees, send out regular tips and memos to help our employees recognize phishing emails and other social engineering tactics, and provide various methods for employees to report suspicious activity that may give rise to a cyber-incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.


text: In response to the growing risks associated with third-party service providers, we do not have any direct connections between our enterprise resource planning ("ERP") system to our third-party suppliers and their access to our IT systems that could significantly disrupt our operations.


text: We maintain a set of core practices and procedures when responding to certain high-risk information security threats and incidents, which are designed to ensure appropriate resources are utilized to provide an effective, timely, and coordinated response in managing crises, including significant cyber threats and incidents. Our Management Risk Committee will assume overall responsibility in an effort to ensure that the appropriate functions and work streams are mobilized and coordinated to effectively manage any significant cyber events.


text: We have been a target of cyberattacks and other hacking activities, as have certain of our third-party service providers. While our cybersecurity program is designed to prevent unauthorized access and protect sensitive information, including through continuous improvement of our cybersecurity measures, and we have not experienced any material cyber threats or incidents to date, we can give no assurance that we will be able to prevent, identify, respond to, or mitigate the impact of all cyber threats or incidents. To the extent future cyber threats or incidents result in significant disruptions and costs to our operations, reduce the effectiveness of our internal controls over financial reporting, or otherwise substantially impact our business, it could have a material adverse effect on our business, liquidity, financial condition, and/or results of operations. For additional discussion on our cybersecurity risks, refer to Item 1A. "Risk Factors" of


text: Cybersecurity Governance Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. Our Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our VP of IT and General Counsel meet with the Audit Committee on a quarterly basis to provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape.


text: Our cybersecurity team is managed by a dedicated information security team, led by our VP of IT. Our VP of IT has more than 25 years of information technology experience across various disciplines, including nearly 15 years of experience in the financial, re-manufacturing, and distribution industries. She has led our global information security organization for almost three years. In addition to her employment experience in the cybersecurity field, our VP of IT has a Bachelor's of Business Administration and Computer Information Systems, and meets regularly with other members of our executive team to provide relevant updates on our cybersecurity program.


text: Risk Management and Strategy Overall Process The Company regards information and data as valuable assets. As a result, safeguards implemented protect corporate informational and data assets. Associated and established technology resources maintain the integrity, availability, and privacy of confidential information of the respective assets. Additionally, we maintain a similar risk-based approach to our third-party vendors including identifying and overseeing cybersecurity risks they present.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: The Company employs comprehensive methodologies for risk assessment and diligently identifies and evaluates potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks.


text: The Company's Information Security Officer and Chief Information Officer are responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.


text: The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network such as Distributed Denial of Service attacks, Corporate Account Takeover schemes, or ransomware. Cybersecurity threats that are identified and deemed material are escalated and communicated directly to the Incident Response Team, in collaboration with relevant information technology personnel, insurance providers, legal counsels and when necessary, external cybersecurity firms specializing in forensic investigations.


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the senior and executive management levels, and annually at the Board of Directors level, to validate roles and responsibilities, and response protocols respective to cybersecurity threats.


text: Third-party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks.


text: Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor and its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended June 30, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has oversight responsibilities to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.


text: Board of Directors Oversight The Board is responsible for the oversight of cybersecurity risk management and is composed of members with expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.


text: Management's Role in Managing Risk The Chief Information Security Officer ("CISO"), and the Chief Information Officer ("CIO"), each play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to both the Board and the Audit Committee as part of managements reporting. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and issues identified from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our regularly scheduled Board meetings, the CISO and the CIO regularly communicate regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Cyber Risk Management Personnel The CISO directly reports to the Chief Administrative Officer ("CAO"). The CISO and CAO meet regularly to discuss both internal and external cybersecurity risks and incidents. The CIO and CAO also regularly meet with the Chief Executive Officer ("CEO") to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our CISO. The CISO experience includes prior leadership roles within the Company, where they developed an expert level of understanding of the intersection between financial regulations and cloud-based technologies. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. The CIO and CISO oversee our governance programs, work with our technology-focused leaders and partners to align security and compliance, and has developed our employee security awareness training program.


text: Monitoring Cybersecurity Incidents The CIO and CISO utilize vendor relationships, the Financial Services Information Sharing and Analysis Center and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.


text: The Company recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. The Company believes that cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: The Company has an information security program and procedures in place to protect, identify, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. The Company uses various security tools that help prevent, identify, investigate, resolve and recover from identified vulnerabilities and security incidents to protect our information systems and data from cybersecurity threats. This framework is implemented and overseen by management's information security department which is led by the Information Technology ("IT") Support Associate Director and overseen by the Company's IT Steering Committee. The IT Support Associate Director has over twenty years of experience in technology management and cybersecurity. The IT Steering Committee is comprised of the Company's two Associate IT Directors, the CEO, and CFO and convenes quarterly to review IT control policies and procedures are properly followed and any new employees were properly onboarded in compliance with security procedures.


text: Third Party Engagement The Company employs third party risk security vendors to identify, mitigate, and remediate cybersecurity risks; however, we rely on the third parties we use to implement security programs commensurate with their risks, and we cannot ensure in all circumstances that their efforts will be successful. An annual penetration test is performed in April, which is a security test that simulates a real-world threat to the Company's IT network and includes comprehensive "Dark Web" searches of all domain user emails. The test performed by Connection (Data Partner) revealed no current cybersecurity breaches. Scans of the Company's firewall are conducted during the first week of each quarter by third party vendor Contego. Any necessary remediation would also be provided by Contego after the scan, but none has been required. The Company uses SolarWinds with Sentinel One software from Contego to continually monitor technology systems for viruses, malicious software, executable harmful files, and other cybersecurity risks. The Company requires the annual submission of SOC 1 security certificates from our third-party vendors which have access to our financial and sales data. The Company also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity related incidents.


text: The Company recognizes that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each employee is required to complete information security and data privacy training to build awareness of cybersecurity risks to the organization. The Company has engaged third party vendor Knowbe4 to send each employee an email that mimics a potentially harmful phishing attempt each month and to report to management the results of the phishing security test.


text: The Board of Directors are acutely aware of the critical nature of managing risks associated with cybersecurity threats. Each quarterly meeting, management presents a cybersecurity update which includes results of testing by third-party vendors and any suspected cybersecurity incidents to the entire Board of Directors. Management would report any material cybersecurity breach immediately to the full Board of Directors. The Company has a written policy for the employee reporting of any cybersecurity suspected incidents.


text: The Audit Committee of the Board has the primary responsibility to oversee effective governance in managing risks associated with cybersecurity threats. Our Audit Committee is composed of members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: The Cybersecurity Committee will receive prompt updates from officers regarding material cybersecurity incidents that come to management's attention. The Cybersecurity Committee will receive quarterly updates which address relevant cybersecurity issues and risks, if any. These reports are provided by the officers of the Wind-Down Entity, which include our Chief Executive Officer and Chief Operating Officer.

companyName: Woodbridge Liquidation Trust

ticker: WBQNL


text: Management's Involvement in Cybersecurity Risk Oversight Officers of the Wind-Down Entity are responsible for establishing the policies, standards, and requirements for the security of computing and network environments, protecting against the risk of unauthorized access by monitoring potential security threats, and overseeing the execution of corrective actions, including third party vendor compliance. The Company has engaged a third-party IT provider to manage our internal network and provide cybersecurity incident prevention and detection. This IT provider is an audit certified vendor (CISA) that evaluates and advises management on cybersecurity issues.


text: The Company's officers report significant cybersecurity risks and incidents directly to the Cybersecurity Committee and Audit Committee on a quarterly basis or more frequently if warranted under the circumstances.


text: If a cyber incident is identified, the Company will conduct an objective analysis of both quantitative and qualitative factors to determine if the cyber incident is material. An incident is considered material if there's a substantial likelihood that a reasonable Interestholder would consider it important. If a cyber incident is identified, the Company will assess materiality on a timely basis.


text: If the incident is determined material, the company will file a Form 8-K within four business days of determining the event was material. The disclosure would include the material aspects of the incident's nature, scope, and timing as well as the material impact on the Company.


text: Financial reports (10-Q and 10-K) will include disclosure of cybersecurity risks, governance, and any material incidents. The cybersecurity disclosures are reviewed and approved by the Cybersecurity Committee, Audit Committee, the officers of the Wind-Down Entity, and the Liquidation Trustee as part of the overall approval of all applicable 8-K, 10-Q and 10-K filings.


text: The Bank has implemented an information security program that encompasses the Bank's cybersecurity efforts as part of its risk management process. Risk assessments, including Information Technology and Cybersecurity Risk, are conducted annually by the Chief Risk Officer, Information Technology Officer and Information Security Officer to identify, assess and mitigate risks. The Bank recognizes the need for sound physical and internal controls over its critical financial data, confidential information and digital assets to ensure the accuracy, integrity, and confidentiality of the processed information. As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors annually approve this information security program and regularly receive reports from the Bank's Information Security Officer and Information Technology Officer that outline the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer and Information Technology Officer update the Boards of Directors through supplementary reports on issues related to Cybersecurity readiness.


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer, Information Technology Officer and Chief Risk Officer. Together with the Bank's Electronic Data Processing (EDP) Committee, comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security and Information Technology Officers of the Bank work to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors receives training annually.


text: The Bank engages a third party to audit and examine its processes, conduct vulnerability assessments, and review the security of its network infrastructure consistent with FFIEC (Federal Financial Institutions Examination Council) Information Technology Audit guidelines, regulatory requirements and federal banking agency expectations. Trusted third parties are engaged to assist the Bank in improving its cybersecurity readiness. The Bank engages third party vendors to monitor and assist in maintaining its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by a specialized vendor that assists the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.


text: While our Board of Directors has responsibility for the oversight of risk management on an enterprise-wide basis, it has delegated certain risk oversight responsibilities to its committees. The Audit & Finance Committee of our Board of Directors is tasked with, among other things, providing oversight of cybersecurity risk.

companyName: BERRY GLOBAL GROUP, INC.


text: The Audit & Finance Committee receives quarterly briefings regarding the Company's cybersecurity matters from our Chief Information Security Officer, who has primary management oversight of cybersecurity matters and reports to our Chief Information Officer. The topics reported by the Chief Information Security Officer include updates on the Company's cybersecurity threats, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party and internal assessments conducted. The full Board of Directors receives briefings on an as-needed basis from the Audit & Finance Committee or management, as applicable.


text: The Global IT Team is led by the Chief Information Officer, who has served in various roles in information technology and information security for over 30 years and has significant experience across information security, infrastructure, operations and compliance. Our Chief Information Security Officer reports to the Company's Chief Information Officer and has served in various roles in information technology and information security for over 30 years. He leads a team that focuses on the Company's cybersecurity, including primary responsibility for leading enterprise-wide information security strategy, processes, as well as assessing, identifying, and managing cybersecurity risks, which is an integrated aspect of our overall enterprise risk management program.


text: Members of our Global IT Leadership Team and appropriate members of Senior Management, supervise efforts to identify, assess, manage and mitigate cybersecurity risks and incidents through various means, including briefings from internal personnel and other information obtained from governmental, public, or private sources, including external consultants engaged by us.


text: We recognize that global cybersecurity threats and targeted attacks are an evolving risk to our data, infrastructure, and overall operations and are committed to addressing cybersecurity risks through a comprehensive, cross-functional approach that reduces security risks, helps ensure business and stakeholder information is handled securely, and effectively responds to cybersecurity incidents when they occur.


text: We have also established and maintain a comprehensive Global Incident Response Plan designed to enable compliance with reporting standards and provide robust response to global cybersecurity events. Incidents are reviewed by the Global IMS Leadership Team and appropriate members of Senior Management.


text: Cybersecurity Assessments We conduct targeted security assessments and penetration tests throughout the year by internal teams as well as through engagements with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company's cybersecurity related risks, see the risk factors titled " We depend on information technology systems and infrastructure to operate our business, and increased cybersecurity threats, system inadequacies, and failures could disrupt our operations, compromise customer, employee, vendor and other data which could negatively affect our business" and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company maintains a comprehensive risk management program designed to assess, identify, and manage material risks facing the Company, including material risks associated with cybersecurity risks and vulnerabilities. Through this risk management program, the Company seeks to mitigate the potential impact of any cybersecurity incidents on the Company's operations and financial condition. We have a comprehensive set of processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Implementation of cybersecurity measures, such as firewalls, endpoint intrusion detection and response systems, and anti-virus/anti-malware software. Employee training and awareness programs to educate all employees about cybersecurity threats, incident reporting and prevention measures. Monitoring of network traffic and information technology systems for signs of potential threats.

companyName: JANEL CORP

ticker: JANL


text: Incident response plan to ensure swift, effective and accurate disclosure of cybersecurity incidents to the appropriate employees of the Company, as well as our Board of Directors, if applicable.


text: We engaged a third-party expert in January 2021 for the development of our information technology ("IT") risk management program, which included the development of a common framework for assessing and mitigating IT risks for the Company. The framework included a specific cybersecurity category to address measures to protect the Company from malware, ransomware and phishing, among others. The outcome was the creation of Company IT narratives and an IT risk control matrix. We regularly work with a third-party expert to test and update our risk mitigation controls.


text: As of the date of this annual report, we are not aware of any cybersecurity incidents that have had, or are reasonably likely to have, a materially adverse effect on our operations, business, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—Security breaches or cybersecurity attacks may have a material adverse effect on Janel's ability to operate, could result in personal information being misappropriated and may cause Janel to be held liable or suffer harm to its reputation" and "—Our inability to successfully recover should we experience a catastrophic event, disaster or other business continuity problem could cause material financial loss, loss of human capital, regulatory actions, reputational harm or legal liability."


text: The Board of Directors maintains oversight of cybersecurity risk primarily through its Audit Committee. The Audit Committee receives regular updates from management on cybersecurity risks and incidents and the overall effectiveness of our cybersecurity programs.


text: The Company's cybersecurity program is led by the Company's Chief Information Officer (the "CIO"), who has served in such role since October 2018. Our CIO has over 25 years of experience in the technology industry, which includes experience in data security and cybersecurity. Prior to joining the Company, our CIO ran a web tech consulting company serving small- and medium- sized businesses in healthcare and other industries.


text: The Company conducts quarterly meetings of the IT and financial leadership of the Company's segments, including the CIO, and information from those meetings is provided to the Company's Audit Committee, which typically meets on a quarterly basis. At each Audit Committee meeting, the CIO and Chief Financial Officer provide an update to the Audit Committee on any relevant current and new IT risks and the general health of the IT risk management program, including cybersecurity risks. They also provide the Audit Committee with a quarterly written cybersecurity brief from IT leadership, including an incident reporting log, a review of emerging cybersecurity risks and developments, an assessment of the overall effectiveness of our cybersecurity programs and recommended updates to our cybersecurity risk assessment program. Management, along with our CIO, is responsible for developing the cybersecurity strategy and supervising our cybersecurity risk management program. Our IT team supports these efforts by managing day-to-day operations, including threat detection, incident response and system monitoring. Our cybersecurity incident reporting and escalation plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior Company management and our Audit Committee and/or Board of Directors, as applicable.


text: Risk Management and Strategy We take cybersecurity threats seriously. We have developed and implemented processes to assess, identify and manage material risks from cybersecurity threats. These cybersecurity processes are a part of our overall enterprise risk management system, sharing governance processes and reporting structures with other components of our enterprise-wide risk management system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, we will activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we may engage third-party cybersecurity consultants to assist with our cyber incident procedure. Risks from cybersecurity threats have the potential to materially affect us, including our results of operations and financial condition.

companyName: JOHNSON OUTDOORS INC

ticker: JOUT


text: The Company has established an Enterprise Risk Committee, which is co-chaired by the Company's Chief Financial Officer and Chief Legal Officer, and under that framework has chartered a Cybersecurity Sub-Committee, chaired by the Chief Technology Officer. Both committees include various other members of key senior management. Our Board of Directors (including our Audit Committee through delegation as described below), along with our Enterprise Risk Committee and Cybersecurity Sub-Committee, are actively involved in providing oversight of our cybersecurity program. The role of the Board of Directors in the Company's risk oversight process includes receiving reports and presentations from the Enterprise Risk Committee or other senior management leaders on areas of material risk to the Company, including operational, financial, legal and regulatory, strategic, reputational, cybersecurity and Environmental, Social and Governance ("ESG") related risks and any measures taken to mitigate such risks. In addition, the Board of Directors regularly reviews and discusses areas of material risk at its meetings. In essence, the Board of Directors oversees a company-wide approach to risk management, carried out by Company management. With respect to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to the Company's cybersecurity and data-protection, including related to monitoring, controlling and mitigating against such risks, and the entire Board receives periodic updates on the Company's cybersecurity risk management processes. There have been no material cybersecurity incidents in the periods presented in this Report.


text: Risk Management Strategy Securing the Company's business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework. We rely on certain key information technology systems, some of which are dependent on services provided by third parties, including cloud vendors, for various business functions necessary to operate and manage our business. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1 reports on an annual basis.

companyName: PHOTRONICS INC

ticker: PLAB


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. In addition, we have implemented procedures over certain areas such as access on/off boarding and account management to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See " Item 1A. Risk Factors " for more information.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has responsibility for the oversight of risk management, including risks from cybersecurity threats. The cybersecurity program is led by the Company's Global VP of Data Operations and Information Technology, who provides periodic updates to the Cyber Security Risk Management Committee of our Board of Directors about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. Our Board of Directors engages in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives. The Cyber Security Risk Management Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.


text: During fiscal 2024, the Audit Committee received regular briefings regarding cybersecurity matters from the Chief Information Officer, who has primary management oversight of cybersecurity matters. The topics reported by the Chief Information Officer include updates on cybersecurity threats, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party and internal assessments conducted. Through the completion of the Transactions, the topics reported included matters relating to the operation of the Company's business as appropriate.

companyName: Treasure Holdco, Inc.


text: Global cybersecurity threats and targeted attacks are an evolving risk to data, infrastructure, and overall operations. These risks were addressed through a comprehensive, cross-functional approach that reduced security risks, helped ensure business and stakeholder information is handled securely, and effectively responded to cybersecurity incidents when they occur.


text: Cybersecurity Assessments Targeted security assessments were conducted and penetration tests throughout the year by internal teams as well as through engagement with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.


text: Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company's cybersecurity related risks, see the risk factors titled " We depend on information technology systems and infrastructure to operate our business, and increased cybersecurity threats, system inadequacies, and failures could disrupt our operations, compromise customer, employee, vendor and other data which could negatively affect our business " and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K.


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Our cybersecurity risk management activities and outcomes are guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and assessed by a third party. We follow the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We engage in the following key elements to assess, prioritize and manage risk and compliance: Assessments to help identify material cybersecurity risks to our critical systems, information, services and broader enterprise IT environments;


text: The use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;


text: A cybersecurity incident response plan, and incident response policy to respond to cybersecurity incidents; and We mandate that all employees, including corporate personnel with access to information systems, undergo annual data protection and cybersecurity training as well as compliance programs.


text: TMTG has also implemented controls designed to identify and mitigate cybersecurity risk associated with our use of third-party service providers.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical and delegates cybersecurity risk oversight to the Audit Committee. Our CTO and Senior leadership, as part of our enterprise risk assessments, thoroughly evaluates our cybersecurity program, risks and corresponding mitigations, and reports to the Audit Committee, at least annually.


text: Management's Role Our Technology organization, led by our Chief Technology Officer, is accountable for our overall cybersecurity program in partnership with other business leaders. Our Chief Technology Officer has extensive experience leading global technology and IT organizations. Team members and outside experts supporting our program have relevant education and information security experience, including security for large multi-national, publicly traded companies. Our CTO has a master's degree in Software Engineering, and expertise in both private and public companies within the technology sector. Our information security team remains abreast of the latest cybersecurity advancements, staying informed about potential threats and emerging risk management strategies. This continuous learning is vital for proactively preventing, detecting, mitigating, and remediating cybersecurity incidents. Our information security team is responsible for implementing and supervising processes for ongoing monitoring of our information systems, incorporating advanced security measures and regular system audits to pinpoint vulnerabilities. In the event of a cybersecurity incident, our information security team employs a well-defined incident response plan, comprising immediate actions to minimize impact and long-term strategies for remediation and prevention of future incidents.


text: Our information security team consistently updates the General Counsel, CFO and CEO on all cybersecurity risks and incidents to ensure top management stays informed about our cybersecurity posture and potential risks. Additionally, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, granting them comprehensive oversight and the ability to provide guidance on critical cybersecurity issues.


text: To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our company is exposed to a variety of evolving cybersecurity risks. We invest in our cybersecurity program to manage and mitigate these risks. On an annual basis, we utilize our Enterprise Risk Management ("ERM") program to estimate our annual loss potential based on our defined control framework and its overall effectiveness. In conjunction with our ERM program, the cybersecurity program references the CIS Critical Security Controls and the NIST Cybersecurity Framework (CSF) to guide our organization's risk identification and mitigation procedures. In addition, we undergo an annual third-party external PCI penetration test, as well as third-party attack-surface monitoring to understand our potential vulnerabilities, threat vectors, and additional impacts to critical assets and operations. In addition, our cybersecurity team performs procedures to identify risks that inform our annual security roadmap. We also periodically review our cybersecurity policies and require cybersecurity training for our employees.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: We periodically engage third-party cybersecurity experts to provide independent assessments of our cybersecurity readiness and control effectiveness. Our goal in collaborating with external cybersecurity firms is to gain insights and knowledge into emerging threats and vulnerabilities, industry trends and best practices to inform our risk remediation efforts. Additionally, we engage with our internal teams to perform tabletop exercises that inform our cybersecurity response capabilities and resilience.


text: At the Board of Directors level, our Audit Committee oversees our risks related to information security and privacy. To accomplish this responsibility, the Audit Committee meets quarterly with our CTO and CISO to receive and discuss updates on our cybersecurity program. Top risks, key initiatives, any material cyber incidents, remediation activity and security metrics are shared to report the overall loss potential, program effectiveness, risk management conditions and current threat landscape.


text: Our Board of Directors is committed to maintaining a well-informed and security-aware business by regularly engaging through updates on the organization's roadmap and evolving threat landscape.


text: From time to time, we experience cybersecurity incidents and threats to our systems and information. Through the date hereof, no risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, and we do not believe are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity threats rapidly evolve and are complex, so we must continually adapt and enhance our processes. As we do this, we must make judgments about where and how to invest resources to most effectively protect ourselves from threats. These are inherently challenging processes, and we can provide no assurance that the processes that we implement will be effective. For more information regarding cybersecurity risks that could impact the Company, see our risk factor disclosures at Item 1A of this Annual Report Governance

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer, our Director of Information Security, and our Director of Infrastructure. These individuals collectively have over 88 years of prior work experience in various roles in the information security field, including managing and implementing effective information technology and cybersecurity programs, as well as relevant degrees and certifications, including a Certified Information Systems Security Professional certification. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Chief Information Officer reports to the entire Board about cybersecurity threat risks, among other cybersecurity matters, at least twice annually or more frequently as circumstances may require.


text: Cybersecurity Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company's information security program is managed by its Vice President, Technology, whose team is responsible for leading Company-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: Cybersecurity Governance The Company's Board of Directors oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually if material. In the event of a cybersecurity incident determined to be significant, management will notify the Board.


text: referenced in the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included in this Form 10-K, our organization may be materially affected by cybersecurity threats and incidents that target its internally managed information technology systems or our critical vendor systems.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: institution utilizes industry standard and regulatory approved assessment tools to identify cybersecurity risks and measure preparedness. The tools provide a repeatable and measurable framework for our organization to measure its cybersecurity preparedness over time.


text: The assessment process spans over five domains of interest: (1) cyber risk management and oversight, (2) threat intelligence and collaboration, (3)


text: cybersecurity controls, (4) external dependencies, and (5) cyber incident management and resilience. All domains are currently assessed at an evolving maturity level which is in line with our organizations inherent risk assessment score.


text: institution has purchased and is using best of breed tools in the areas of endpoint security, Security Information Event Management ("SIEM"), Privileged Access Management ("PAM"), email and web browsing filtering and management, and user analytics. We also use a comprehensive third party 24-by-7 Security Operations Center ("SOC") that monitors, detects, and remediates cybersecurity threats adhering to strict service response levels.


text: internal assessment process and internal tools and SOC related key indicators are reported on a quarterly basis to the Security and Information Security Committee and the Enterprise-wide Risk Management Committee and annually to the Board of Directors.


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management processes. Our internal audit program executes a comprehensive and layered auditing approach including people, processes and technology in order to evaluate the effectiveness of existing controls and ensure that cybersecurity risk has been adequately mitigated within our institution. Periodic phishing tests, network and application security reviews, third-party vulnerability assessments and penetration testing are used to gauge the overall effectiveness of our cybersecurity defenses. The audit program and cybersecurity defense evaluations are key parts of our overall risk management processes.


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our processes and policies related to cybersecurity are focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv)


text: responding to a cybersecurity incident, and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall enterprise risk management systems and processes. For example, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection.


text: Monitoring external and internal threats and events, managing access, facilitating use of appropriate authentication options, validating controls and programs by internal teams and independent third parties and testing various compromise scenarios that are overseen by our information security team;


text: Investing in threat intelligence platforms and participating in financial services industry and government forums which track and report on cyber and other information security threats; Routinely performing vulnerability tests;


text: Engaging independent consultants and other third-parties to assist CTBI in establishing and improving its policies; and Conducting "tabletop" exercises at least annually to test CTBI's processes and policies and using feedback from those exercises to further improve our processes. CTBI also maintains insurance coverage for cybersecurity incidents as part of its overall insurance portfolio.


text: of a cybersecurity incident, CTBI maintains incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level t o each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) determined to be at a critical threat level is escalated to a group consisting of CTBI's Chief Executive Officer and certain other officers, including the Chief Legal Officer, Executive Vice President/Operations, Chief Risk Officer, and Chief Financial Officer for review.


text: an effort to continually share threat intelligence and increase awareness of cybersecurity threats, routine communication to employees is conducted to highlight internal control requirements, common cybersecurity threats and schemes. Our incident response team members also participate in the annual Financial Services Information Sharing and Analysis Center tabletop cybersecurity tabletop exercises.


text: comprehensive vendor management program and processes assess all new vendors and segments them into criticality tiers. Our most critical vendors (tiers 1 and 2) are evaluated annually based on requested vendor documents, such as Statements on Standards Attestation Engagements No. 18 (SSAE 18), financial statements, insurance, and due diligence questionnaires. The vendor management team also monitors all news alerts related to all critical vendors.


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect CTBI. However, future incidents could have a material impact on CTBI's business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included Management


text: receives information on cyber activities, incidents, and risk assessments quarterly from the VP/Corporate Information Security, Resilience and Data Officer (CISRDO), the SVP/Manager Application Systems, and the EVP/Operations during the Security and Information Security Committee and the Information Technology Steering Committee meetings. This information is also shared and discussed quarterly with the Enterprise-wide Risk Management Committee. Various key risk measures related to cyber risk are tracked and reported quarterly to the Enterprise-wide Risk Management Committee. Our VP/CISRDO has been with CTBI for six years and has extensive 30+ years of experience in information technology management roles in various industries. At December 31, 2024, our SVP/Manager Application Systems had been with CTBI for 33 years and held various information technology leadership roles, and our EVP/Operations had been with the company for 31 years, leading and guiding our technology teams. Effective January 31, 2025, our EVP/Operations retired, and our SVP/Manager Application Systems was promoted to EVP/Operations. The Board of Directors monitors cyber risk through quarterly reports from the Board's Risk and Compliance Committee.


text: This Board committee meets quarterly and receives information concerning cyber risk activities, including cyber risk assessments and incident reporting. The Board also receives an annual report covering cyber risk from the Chief Information Technology Officer. Controls over cyber risk are reviewed throughout the year by internal audit activities and third-party assessments whose reports are reviewed by the Board's Audit Committee.


text: Risk Management and Strategy In line with our commitment to strong corporate governance and the security of our operations, we continuously assess and mitigate cybersecurity risks that could impact our business, stakeholders, and the integrity of our systems.

companyName: NBT BANCORP INC

ticker: NBTB


text: Using comprehensive risk assessment methodologies, we diligently identify and evaluate potential cybersecurity threats and vulnerabilities across our systems, networks, and data assets. This process includes regular reviews of emerging threats, penetration testing, vulnerability scanning, and thorough analysis of industry-specific risks. We actively participate in industry forums and information-sharing initiatives and collaborate with relevant stakeholders to exchange threat intelligence and best practices.


text: We emphasize continuous training for our staff to enhance their ability to identify and respond to cybersecurity threats. To support this effort, we invest in cybersecurity technology and talent. Additionally, we conduct rigorous vendor assessments and require specific security standards for third-party providers. Our comprehensive policies and procedures are designed to safeguard the integrity and security of information collected by us and our service providers. We have also implemented security measures to prevent unauthorized access to personal data and mitigate potential incidents. Furthermore, we learn from any past incidents and near misses to strengthen our resilience.


text: NBT collaborates with external experts to conduct audits, assessments, and validations of our cybersecurity controls, aligning them with established frameworks such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We adapt our cybersecurity policies, standards, processes, and practices based on insights from these reviews.


text: The Board considers cybersecurity as part of its broader consideration of business strategy and enterprise risk management. It is the responsibility of the Risk Management Committee ("RMC"), a committee of the Board, to oversee efforts to develop and formally approve the written Information Security Program ("ISP"), implement, maintain and monitor the program, and review management reports and policies related to cyber incidents. The RMC is led by our Chief Risk Officer and comprised of Board members as well as the Chief Executive Officer. Cybersecurity risks are reported to the RMC at least quarterly and those reports include key performance indicators, test results, recent threats and how the Company is managing those threats, along with the effectiveness of the ISP. The RMC receives briefings from executive management on activities, including those related to cybersecurity risk oversight. The Board reviews the overall ISP at least annually.


text: NBT has appointed the Senior Director of Information Security ("DISO") to oversee the implementation, coordination, and maintenance of the ISP. The DISO's responsibilities include:


text: Leading the initial implementation of the ISP, including assessing internal and external risks to institutional data and documenting findings through risk assessment reports and remediation plans. Coordinating the development, distribution, and maintenance of information security policies and procedures. Designing and implementing administrative, technical, and physical safeguards to protect institutional data across the company.


text: The DISO reports to the Chief Risk Officer and has expertise in cybercrime prevention, social engineering, identity theft, and fraud prevention, gained through prior roles within the organization.


text: The DISO also supervises the Incident Response Team ("IRT"), which consists of senior executives, including the Chief Audit Officer, Chief Risk Officer, General Counsel, and representatives from Operations, Accounting, and Communications. Upon detecting an incident, the IRT promptly convenes to assess its severity, categorizing it as low, medium, or high. The response protocol follows the Cybersecurity and Infrastructure Security Agency ("CISA") Cybersecurity Incident and Vulnerability Response Playbook (November 2021) and incorporates best practices outlined in the NIST Special Publication (SP) 800-61 Rev. 2: Computer Security Incident Handling Guide. The IRT has procedures and escalation protocols to escalate significant cybersecurity matters to the Executive Committee, the RMC and/or full Board, as deemed necessary.


text: During the incident review process, senior management, in collaboration with relevant personnel from information technology, data security, and external cybersecurity firms specializing in forensic investigations, when necessary, assesses the materiality of the breach alongside the severity scale. This evaluation aims to accurately identify risks and potential operational and business impacts. Materiality determination involves an objective analysis of both quantitative and qualitative factors, including an evaluation of impact and reasonably likely impacts.


text: We have purchased cybersecurity insurance, but there are no assurances that the coverage would be adequate in relation to any incurred losses. As of December 31, 2024 we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company. However, we cannot guarantee that we will remain unaffected in the future.


text: For further discussion of such risks, see the section entitled "Risks Related to Information Technology, Cybersecurity and Data Privacy" in Item 1A. Risk Factors of this Form 10-K.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Chadd Pence. With over 25 years of experience in the field of IT and cybersecurity, Mr. Pence brings a wealth of expertise to his role. His background includes experience as an enterprise CISO and his knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Our CISO oversees our cybersecurity efforts and governance programs, tests our compliance with standards, remediates known risks, and provides regular guidance to management and the Board on these areas. In addition, to supplement this expertise, we periodically engage external experts, including cybersecurity consultants, to help us evaluate our risk management related policies and to help us to review and remediate cybersecurity incidents.


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of a variety of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs our Chief Financial Officer, President, and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Compliance Committee and the full Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity / information security program. The Information Security Officer reports directly to the Chief Operating Officer, and periodically reports to the Audit and Examination Committee of our board of directors.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: We employ a layered defensive strategy when designing our cybersecurity controls. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations, and tabletop exercises. We engage in regular monitoring and assessments of our technology infrastructure using internal staff and third-party specialists.


text: We conduct ongoing social engineering testing and training across our entire employee base. We maintain a vendor management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Our independent auditors periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: Our Information Security Officer is responsible for managing our information security program, inclusive of cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business continuity. Some of these responsibilities are carried out in collaboration with other internal departments, such as the information technology department. In any case, the Information Security Officer provides guidance, oversight, and monitoring of the information security program, and acts in an independent role, reporting directly to the Chief Operating Officer and subsequently to the Audit and Examination Committee of the board of directors. Our Information Security Officer has extensive bank operations experience, has attained Certified Banking Security Manager certification with the banking industry, and attends relevant cybersecurity training sessions on a regular basis. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats.


text: The Company's information security program is designed to protect the security, confidentiality, integrity and availability of the Company's sensitive and personal information and client information. Employing a risk-based approach, the program systematically identifies, assesses and implements safeguards that seek to mitigate cybersecurity threats and secure the Company's information assets, including those of our sub-servicers. The program is informed by the National Institute of Standards and Technology Cybersecurity Framework and is shaped by the legal requirements derived from authoritative sources such as the Gramm-Leach-Bliley Act and its implementing regulations and guidelines, as well as Freddie Mac's mandates from the office of Federal Housing Enterprise Oversight. Additionally, the program is guided by relevant state laws and regulations.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: Periodically, the Company, as it reasonably deems necessary, will identify and categorize potential cybersecurity threats and vulnerabilities, determine acceptable risk tolerance for each such threat and vulnerability and implement adequate mitigation controls. At the senior executive level, the CFO is entrusted with the day-to-day oversight of the program's development, implementation, and maintenance. To help facilitate Company-wide compliance with the plan, the Company, as well as its subservicers, provide ongoing training to the appropriate employees.


text: Our board of directors is responsible for understanding the primary risks to our business. The board is also tasked with developing and advancing our cybersecurity strategy, as well as evaluating the adequacy of our programs and policies. The CFO is responsible for ensuring that the board of directors comprehends the Company's cybersecurity risk profile and receives updates on the program and its policies on a quarterly basis or as necessary. Our current CFO is Michael Hutchby. Mr. Hutchby has a B.A. in Economics from The Johns Hopkins University and an M.B.A. from the Stern School of Business at New York University. Mr. Hutchby was appointed the Company's CFO, Treasurer and Secretary in June 2019 and previously served as the Company's Controller from October 2013 to June 2019.


text: As mentioned above, the CFO is responsible for the initial assessment and management of potential incidents. Furthermore, the Company has established a response plan that serves as the foundation for addressing unauthorized cybersecurity occurrences from both a technical and regulatory perspective. The Cybersecurity Response Team ("CRT"), comprised of the CFO, Manager of Information Technology ("MIT") and other personnel, as each may designate, are responsible for leading all incident management and response activities. The MIT assumes a crucial role in overseeing and managing the technical facets of the CRT while the CFO provides strategic direction and decision-making, facilitating communication with other members of senior management, and disseminating pertinent information to the board of directors. The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College. Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network security, user and email administration, data governance, threat management, and endpoint security.


text: In conjunction with the aforementioned plans, the Company conducts an annual business impact analysis to identify the critical business functions that are required by the Company to sustain business operations and potential impacts to the Company if any those critical functions are disrupted. Deriving from the analysis, the Company maintains a business continuity and disaster recovery plan to coordinate business recovery to resume any disrupted critical business operations. In the event of a critical cybersecurity business disruption, the President of the Company may activate the business continuity plan to implement risk-based strategies devised to maintain business continuity against distributed denial of service attacks or malware.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company.


text: Please refer to "Item 1A. Risk Factors – Risks Related to Our Business – We are highly dependent on information systems and third parties, and systems failures or cybersecurity incidents could disrupt our business."


text: Cybersecurity Risk Management and Strategy Cybersecurity threats have the potential to negatively impact companies of all sizes and complexities. Our normal business operations could be severely disrupted by cyberattacks, both against our own information systems as well as those hosted and managed by our third-party partners. The loss or disclosure of sensitive data as a result of cyberattacks could have a material impact on our business. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors of this Form 10-K.

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: We have implemented a comprehensive Information Security and Risk Management Program that is designed and maintained to be compliant with all applicable federal and state regulations, and is regularly audited by independent experts to ensure continuous effectiveness and compliance. Key elements of this program include: a comprehensive risk management process, integrated with the Enterprise Risk Management system, that continuously assesses, identifies, and manages current and emerging cybersecurity threats and risks, evaluates the effectiveness of information security controls, and reports the overall risk posture to Executive Management and the Board of Directors. assessment of daily cyber threat intelligence from multiple sources; the use of third-party information security services for continuous monitoring and alerting of information systems, network. and user activity;


text: a Vulnerability Management Program that scans networks, devices, and information systems for known cyber vulnerabilities, and initiates processes to mitigate them;


text: a third-party risk management program that evaluates and ensures our key partners adhere to the same level of information security posture as we do internally;


text: Business Continuity and Incident Response plans that are designed and tested for anticipated operational failures, natural disasters, cyberattacks, and other disruptive events; and an Information Security Awareness program to ensure employees and customers maintain an awareness of information security threats and best practices to prevent them.


text: Information Security Governance The Chief Information Security Officer is primarily responsible for the Information Security and Cyber Risk Management programs, and reports to the Chief Risk Officer. The Chief Technology Officer that oversees the Information Technology Department plays a key role in cybersecurity, ensuring that information systems, networks, and endpoints are configured and operated according to the requirements of the Information Security Program and related policies and standards. Both the current Chief Information Security Officer and Chief Technology Officer have over 20 years of experience in Information Technology and Information Security.


text: The Information Security Committee, consisting of senior management and analysts from Information Security and Information Technology, monitors and assesses cyber threat intelligence, responds to cyber incidents at a technical level, and determines whether new controls are needed to address emerging risks or active cyber exploits. Key Risk Indicators for Information Security and Information Technology are reported to the Operations and Information Technology Steering Committees. Key risks and other relevant information are further summarized for the Board Risk and Audit Committees. The Board also receives a full report on the Information Security Program and its effectiveness annually. Other cyber related issues are brought to the attention of the Board as needed.