text: The CCDC directly oversees information technology and information security risks through regular meetings, reports from management on information technology, cybersecurity, and related risk assessments, and incidents disclosed by third-party service providers as applicable. If a cybersecurity threat is identified, our Vice President of IT or other reporting individuals will immediately inform our IT service desk and notify our CIO and CPO. Once the threat has been analyzed, our CIO and CPO will inform our General Counsel of any security incidents. The General Counsel or her delegate will report on the incident, as appropriate, to the CCDC, our CEO, President, CFO, and to the Board, either at the next scheduled meeting or on a current basis, depending on the severity of the incident. Each quarter, the enterprise CPO presents legal and regulatory updates concerning cybersecurity, security incident response and notification, privacy, and artificial intelligence. A-Mark's CPO is certified by the International Association of Privacy Professionals as an EU, US, and management privacy professional, as well as an artificial intelligence governance professional. Our CPO has over a decade of privacy, data protection, and information management experience.


text: A-Mark's CIO chairs the CCDC. Our CIO brings over 15 years of IT experience to A-Mark. Since joining A-Mark in 2019, he has been pivotal in enhancing our data privacy compliance program, significantly strengthening our data protection and privacy measures, particularly ensuring protection of sensitive data. The co-vice chairs of the CCDC are A-Mark's Vice President of IT and JM Bullion's Vice President of Digital and Technology. Our Vice President of IT has over 25 years of experience in IT working in various industries including ecommerce, health care, and financial industries focusing on IT operations, cybersecurity and compliance. Since joining the company in 2014, he has been instrumental in the creation and growth of our cybersecurity program. Our Vice President of Digital and Technology at JM Bullion has comprehensive experience in the cybersecurity field. He successfully established a 24/7 security operation center (SOC) to continuously detect and respond to security incidents, as well as implemented various advanced services to proactively detect vulnerabilities on potential attack surfaces with high accuracy spanning across assets, applications, data, endpoints and network. He also centralized the workforce identity and access management (IAM) of the various systems for improved administration and control at the subsidiary level. He joined JM Bullion in 2015 and has served in his current role as Vice President of Digital and Technology since 2021.

companyName: Gold.com, Inc.

ticker: GOLD

secItem: Item 1C


text: Other members of the CCDC include top executives and management from the Company and its subsidiaries, including A-Mark's General Counsel and Assistant General Counsel, CPO, President, Chief Financial Officer, Chief Operating Officer, Senior Director of Financial Reporting, Senior Director of Internal Audit, and Director of Enterprise Development and Administration, as well as JM Bullion's President and Chief Executive Officer and its Chief Financial Officer. Finally, the CCDC is assisted by an external compliance consultant with over twenty years of IT experience, and A-Mark's outside legal counsel for privacy and data security.


text: Our cybersecurity risk management program includes a Cyber Security Incident Response Plan ("CSIRP"). Our CSIRP supports the Company in identifying, containing, and tracking cybersecurity incidents experienced by us or our third-party service providers or suppliers. The CSIRP was established to minimize the impact of cybersecurity incidents on our networks, IT systems, users and business processes, and to ensure the timely and accurate reporting of material cybersecurity incidents, should they occur. The execution of our CSIRP is led by our Chief Information Officer and Head of Business Services ("CIO"), with support from a designated IT Incident Response Manager leading an Incident Response Team consisting of subject matter experts, as well as our Executive Response Team when appropriate. In the event of an incident, these individuals work together to assess its severity, notify and brief the appropriate team members, escalate to our Board of Directors as needed, and implement containment procedures. The Company also conducts tabletop exercises to enhance incident response preparedness and engage s third parties, including consultants and other professionals, on an as-needed basis to assess and support our cybersecurity practices and procedures.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Our cybersecurity risk management program is integrated into our operations and is widely communicated to employees through periodic (not less than annual) employee and contractor cybersecurity awareness training, which includes information about how to identify and report cybersecurity concerns and incidents. Our information technology organization also conducts phishing simulations and testing scenarios to help ensure compliance with our cybersecurity policies and procedures. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on a continuous basis through automated tools and 24x7 managed services that detect threats and trigger alerts for assessment, investigation, and remediation by our information technology organization.


text: The CIO is the management position with primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. The CIO has deep experience in information systems and technology, including developing information and cybersecurity programs, roll-outs of new technology, information security audit and assessments, and cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CIO has experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CIO joined the Company in 2020, bringing over 15 years of experience leading IT strategy and change initiatives in the consumer packaged goods industry, and reports directly to our interim CEO.


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. Our cybersecurity and risk management program is developed based on: • Continuous Development: Ongoing refinement of our risk management processes. • Partners and Tools: Leveraging global access control and activity monitoring solutions. • Education and Training: Implementing company-wide policies and proactive user training. • Continuous Monitoring: Regular surveillance of our environment. • Access Management: Ensuring only authorized users have access to our Zero Trust approach network implementation.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Role of Management Management has implemented risk management structures, policies and procedures, and is responsible for day-to-day cybersecurity risk management. Our Information Technology department that is led by our Chief Technology Officer ("CTO") is responsible for the day-to-day assessment and management of cybersecurity risks. Our CTO has led IT departments, including cybersecurity teams, for the past 15 years in worldwide leading logistics companies. We have implemented several processes which allow the management team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Our CTO and his team share such information with our management team and reports information about such risks to our Audit and Executive Oversight Committee ("AEOC").


text: The Board of Directors, both directly and through the delegation of responsibilities to the AEOC, has risk management oversight, which includes the proper functioning of our cybersecurity risk management program. In particular, the AEOC assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: The AEOC regularly discusses with management, including our CTO, our enterprise risk management process, including our cybersecurity exposures, the steps management has taken to monitor and control such exposures and guidelines and policies to govern our risk assessment and risk management processes. The AEOC periodically reports to the Board regarding significant matters identified with respect to the foregoing, including, among others, our risk assessment and risk management approach to cybersecurity.


text: Cybersecurity is a significant and integrated component of Winchester Bancorp's risk management strategy, designed to protect the confidentiality, integrity and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. As a proactive measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, however, such insurance coverage may not be sufficient to cover all losses incurred. During the year ended June 30, 2025, we did not, to our knowledge, experience a cybersecurity incident materially affecting or reasonably likely to materially affect the Company. Risk Management & Strategy (Scope)

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: On a periodic basis, but not less than annually, the Information Security Officer (ISO), in conjunction with the Information Technology department, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Information Security Officer, CIO and IT Department regularly meet to review, monitor and address technology related threats and emerging risks.


text: Additionally, the Company engages third parties to aid in the identification of risks and controls related to technology and technology driven product delivery channels, allowing for an independent opinion. The risk assessment process identifies data sources, threats and vulnerabilities, and ensures awareness, accountability and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). Risk Assessments (Detail)


text: On a periodic basis, but not less than annually, the Information Security Officer (ISO), in conjunction with the Information Technology department, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer records. Risks are identified and mitigations are documented by the ISO, IT staff and business lines responsible for the assessed area. Risks related to the engagement of third-party providers are identified and reviewed by the Risk & Compliance Department, in coordination with Vendors and Business lines that engaged the vendor relationship.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor provided software fixes (patches); • Ensuring that changes to security configurations are documented, approved and tested; • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs; • Updating and monitoring vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities; • Conducting penetration testing and vulnerability assessments as warranted; • Review performance with service providers to ensure that security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit and Testing Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of key controls, systems and procedures. In addition, independent third party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually. Management determines the scope and objectives of the penetration analysis.


text: Aspects of the Information Security program are audited by the Company's Internal Audit provider(s) to ensure aspects are aligned with regulatory expectations.


text: Employee Training Employees are an integral part in the line of defense against cybersecurity risks. Every employee is responsible for protecting Company and client information. Accordingly, employees complete formal training, including regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. Our employees are supported by solutions designed to identify, prevent, detect, respond to and recover from incidents. Technologies include firewalls, intrusion detection systems, managed endpoint security automation and response capabilities, encryption, data backups and multi-factor authentication when available. Notable services include 24/7 security monitoring and response, real time vulnerability scanning, third party monitoring and threat intelligence.


text: Service Providers The company relies on third party vendor services and solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a "Third Party" Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The program is audited as part of the Company's internal audit program.


text: Program Adjustments The ISO monitors, evaluates and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements and changes to customer information systems.


text: Incident Response Plan The Company has implemented an Incident Response Plan (IRP) to provide structure and a systematic incident response process for information security incidents that may affect any of the information technology systems, network or data. The Company's business continuity program provides a coordinated response when responding to incidents. The IRP is implemented and maintained by the ISO and is subject to annual review and approval by the IT Steering Committee and the Board of Directors. Cybersecurity metrics are reported to the Audit Committee quarterly.


text: The IRP includes: • Identifying the Incident Response Team (IRT); • Coordinating IRT activities, including developing, maintaining and following appropriate procedures to respond to and document identified information security incidents; • Conducting post-incident reviews to gather feedback on information security incident response procedures and to address any identified gaps in security measures; • Provide training and conduct periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; • Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Governance & Reporting The Board of Directors has designated the Vice President of Information Security as Information Security Officer (ISO). The ISO reports directly to the Senior Vice President of Risk & Compliance and works in tandem with the Chief Information Officer.


text: On a quarterly basis, the ISO presents risks and metrics related to cyber and information security efforts to the IT Steering Committee and then to the Board's Audit Committee.


text: At least annually, the ISO reports to the Board of Directors the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed, as are management responses and any recommendations for program changes.


text: The Board of Directors designated the Chief Information Officer as the Information Security Officer (the "ISO") and for oversight, the full Board receives threat intelligence reports and a Cybersecurity Executive Dashboard from the ISO each month. The ISO has more than thirty years' experience with the Company and meets with full Board of Directors in person at least annually. The ISO works with the Company's third-party Security Operations Center and the Company's Compliance/Enterprise Risk Management ("ERM") Team to identify, assess, and manage material risks from cybersecurity threats. The ISO also oversees the Company's Information Security Program, which governs various information security and cybersecurity processes, systems development, change control, disaster recovery/business continuity, physical asset classification and control policies. The Information Security Program identifies data sources, threats, and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The ISO is a member of various management committees, including the quarterly Management Control meetings which serve as the Company's IT Steering Committee.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: On a periodic basis, but not less than annually, the ISO in conjunction with the Compliance/ERM Team, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Compliance/ERM Team reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: The IRP includes: • Identifying the incident response team (the "IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP. • Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: The Audit Committee of our Board of Directors oversees and reviews the Company's cybersecurity risks and the steps management has taken to protect against threats to the Company's information systems and security. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board and the Audit Committee, as applicable.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: We have implemented cybersecurity practices appropriate for the size and complexity of our operations. Our IT systems are professionally managed, and access to Company data is restricted to authorized personnel using secure access protocols.

companyName: Paramount Gold Nevada Corp.

ticker: PZG


text: We take a proactive approach to managing cybersecurity risks. This includes regular updates to our systems, access controls, and training programs to help employees recognize and avoid phishing, spam, and other common cyber threats.


text: To date, we have no t experienced any material cybersecurity incidents. We continue to monitor evolving threats and adjust our practices as necessary to help protect our systems, data, and operations.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within these systems.

companyName: Lite Strategy, Inc.

ticker: LITS


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks and the sufficiency of existing policies, procedures, systems and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Director, Information Security and Infrastructure who reports to our Acting Chief Executive Officer and Chief Financial Officer to manage the risk assessment and mitigation process.


text: If required, we engage consultants, or other third parties in connection with our risk assessment processes. These service providers, where appropriate, assist us in the assessment, testing or other aspects of our security controls to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment, as well as assist us in designing and implementing our cybersecurity policies and procedures.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program and is responsible for monitoring and assessing strategic risk exposure, while our management team is responsible for the day-to-day operations over the material risks we face. Our management team, including our Acting Chief Executive Officer and Chief Financial Officer and Senior Director, Information Security and Infrastructure, provide periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if applicable.


text: Our Acting Chief Executive Officer, CFO and Senior Director, Information Security and Infrastructure, are responsible for assessing and managing our material risks from cybersecurity threats and have decades of experience in overseeing operations, including information technology functions, in the public company environment. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants as needed.


text: Our management team supervises cybersecurity risk management efforts to prevent, detect, mitigate,and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment. The cybersecurity risk management program also includes tools and activities to prevent, detect and analyze current and emerging cybersecurity threats and plans and strategies to address threats and incidents.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A “Risk Factors – Risks Related to Units – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”

companyName: MARINE PETROLEUM TRUST

ticker: MARPS


text: Our Board of Directors, along with our Information Technology Committee, which is comprised of key members of senior management, are actively involved in providing oversight of our cybersecurity program. Monthly updates are provided to our Board regarding the status of our program, including key monitoring metrics and trends noted both internally and within our industry. Our Board reviews and approves all cybersecurity-related risk assessments, polices and formalized reviews performed throughout the year.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: Cybersecurity Governance The Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company's cybersecurity, information security, and information technology risks. Periodically, the Audit Committee reviews and discusses with the Chief Financial Officer, who leads our cybersecurity program, the Company's policies, procedures, and practices with respect to cybersecurity, information security and information and operational technology, including related risks.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Risk management and strategy Neuphoria recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: Managing Material Risks & Integrated Overall Risk Management Our risk management team has evaluated and addressed cybersecurity risks in alignment with our business objectives and operational needs and have integrated them into our overall risk management system.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Neuphoria has and engaged with a range of external experts, including cybersecurity assessors, consultants, advisors, and auditors in evaluating and testing our risk management systems. These partnerships will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Neuphoria will implement stringent processes to oversee and manage these risks. We will conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats While we have encountered cybersecurity threats, including a breach of an administrative email account, these challenges have not resulted in the loss of any data, materials, or clinical information, and have not materially impaired our operations or financial standing.


text: Board of Directors Oversight The Audit & Risk Management Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit & Risk Management Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Risk Management Personnel Our IT Manager is actively involved in assessing, monitoring and managing our cybersecurity risks. He has over 30 years of experience in the field of cybersecurity, and his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Monitor Cybersecurity Incidents Our IT Manager implements and oversees processes for the regular monitoring of our information systems, which includes having a well-defined incident response plan. In the event of a cybersecurity incident, we can take immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Management and the Board of Directors Our IT Manager will provide regular updates to our CEO, Spyros Papapetropoulos, regarding all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks faced by Neuphoria. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The aspects of the Company's risk management approach to cybersecurity include: • Annually reviewing and updating cybersecurity policies to ensure alignment with the latest industry standards and regulatory requirements. The specific aspects of the Company's program are informed by guidelines outlined in various accepted frameworks, including the Cybersecurity Framework issued by the National Institute of Standards and Technology Framework, an agency of the United States Department of Commerce. • Maintaining a dedicated cybersecurity team under the direction of the Company's Chief Information Officer ("CIO"), that has expertise related to data and network security, data governance, and risk management. • Conducting vulnerability assessments to identify and mitigate potential security risks. These assessments include network scans, penetration testing, and security audits performed by internal resources or qualified third-party providers. • Requiring all employees to participate in cybersecurity training and awareness programs including annual cybersecurity training and monthly phishing campaigns. These programs educate employees on how to recognize and respond to cyber threats and develop best practices for maintaining a strong security culture. • Monitoring information channels from trusted security information sources to stay abreast of developing cybersecurity concerns that may affect the Company or its operations. • Reviewing the security protocols of new third-party service providers to ensure acceptable levels of security are documented and maintained. • Maintaining an incident response retainer with a respected cybersecurity firm to ensure timely response and forensic capabilities.

companyName: LINDSAY CORP

ticker: LNN


text: Despite the Company's efforts, cyber attacks, unauthorized access, security breaches, ransomware, social engineering attacks or other cyber incidents could materially affect the Company and disrupt its business. Potential consequences of a successful cyber attack or cybersecurity incident could include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. While the Company is regularly exposed to such malicious threats, none of these threats, individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this Annual Report on Form 10-K.


text: Incident Response Procedures The Company's cybersecurity incident response plan is a critical component of the overall cybersecurity strategy. This plan outlines the procedures and actions to be taken in the event of a cybersecurity incident to minimize impact and ensure a swift recovery. Key elements of the Company's incident response plan include: • Incident discovery and confirmation: the Company has established clear protocols for identifying and reporting suspected cybersecurity incidents. Employees are trained to recognize potential incidents and report them immediately to the Company's IT security team. • Incident assessment and classification: upon receiving a report of a potential incident, the Company's IT security team conducts a thorough assessment to determine the nature and severity of the incident. Incidents are classified based on their impact and risk level. • Containment and continuity: once an incident is confirmed, the Company takes immediate steps to contain and mitigate its impact, which may involve isolating affected systems, applying security patches, or implementing other remedial actions. • Eradication and recovery: after containment, the Company works to eradicate the root cause of the incident and restore affected systems to normal operation, which includes evicting threat actors, removing malware, repairing vulnerabilities, and validating system integrity. • Communication and reporting: the Company maintains clear communication channels to keep all relevant stakeholders informed throughout the incident response process, which includes internal communication with employees and external communication with customers, regulators, and other parties as necessary. • Post-incident review and improvement: following the resolution of an incident, the Company conducts a post-incident review to identify lessons learned and areas for improvement, which helps enhance incident response capabilities and prevent future incidents.


text: The Company's CIO reports directly to the Company's Chief Executive Officer and is responsible for managing, designing, and implementing all aspects of the Company's day-to-day cybersecurity programs and initiatives. The CIO and the dedicated cybersecurity team have appropriate levels of expertise, certifications, and previous work experience to effectively develop and oversee the Company's cybersecurity efforts.


text: Cybersecurity represents an important component of our overall approach to risk management. Our information security risk management (ISRM) policies, standards and practices are integrated into our overall enterprise risk management approach, and cybersecurity risks are one of the business risks that are subject to oversight by our Board of Directors. Our ISRM policies, standards and practices align with National Institute of Standards (NIST) and Technology Cybersecurity Framework and International Organization for Standardization (ISO) 27001.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: • Incident Response and Recovery Planning – We have established and maintain a cybersecurity incident response procedure plan that addresses our response to cybersecurity incidents and recovery from such incidents, and such plan is tested and evaluated periodically. • Communication, Coordination and Disclosure – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Audit Committee of the Board of Directors, in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. We have established an Incident Response Committee, which is chaired by our SVP Administration, to quickly organize and execute an effective, productive, timely and compliance-conscious response to cybersecurity threats and incidents, as well as coordinate among the cross-functional groups.


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Audit Committee reviews cybersecurity on a quarterly basis. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board of Directors and the Audit Committee discuss our approach to cybersecurity risk management with the Chief Information Security Officer (CISO) and other cyber team members, as well as senior leadership.


text: The CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO has decades of experience in the cybersecurity and information security fields, including experience with both private and public companies and the military, as well as experience in the transportation and rail industry. The CISO is a Boardroom Certified Qualified Technology Expert (QTE) and holds certifications including Certified Chief Information Security Officer (C|CISO), Certified Internal Auditor (BSI) and is a graduate of the Wounded Warrior Cyber Combat Academy. The CISO has experience with regulatory compliance frameworks including ISO 27001, SOX, NIST and CMMC.


text: The CISO works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal & Compliance Officer across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our cybersecurity incident response procedure plan.


text: We also have a policy for responding to and mitigating cybersecurity incidents. Our Chief Information & Technology Officer ("CITO") oversees our incident response procedures, which are reviewed and updated periodically.

companyName: UNIFIRST CORP

ticker: UNF


text: Cybersecurity Governance Our CITO, who reports to our Chief Executive Officer, is responsible for leading our information security team and overseeing the Company's cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer. Our Chief Information Security Officer supports the program and incident response and reports to the CITO.


text: Our cybersecurity risk management program is overseen by our Board of Directors. Members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.


text: Risk Management and Strategy Our cybersecurity risk management program is designed to monitor and control cybersecurity risk exposure, response, mitigation and protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity policies and processes are fully integrated into the Company's Enterprise Risk Management program. Our cybersecurity program is based on industry recognized best practices, including the ISO 27001 Information Security, Cybersecurity and Privacy protection international best practice standards.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Our cybersecurity risk management program includes: • Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends, internal assessments and engaging third parties to assess the effectiveness of our cybersecurity practices; • The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls; • Mandatory cybersecurity awareness training for employees and simulated phishing attacks; • A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors; • Cybersecurity insurance which is assessed annually; and • Risk management process for service providers, suppliers, and vendors.


text: The board of directors receives quarterly reports from management regarding the status of the cybersecurity risk management program, current activities, planned projects, and security assessments. In addition, management will update the board of directors, as necessary, regarding any significant cybersecurity incidents that we may experience.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity risk management team is led by our VP IT Security Compliance and our Head of IT. These individuals have collectively over 50 years of experience in both restaurant and technology sectors and have held technology leadership roles at national restaurant companies.


text: From time to time, we experience cybersecurity threats and incidents. As of the date of this Annual Report, we have not identified any instances that have occurred in the current year, or in prior years, that would have a material impact on our Company or on our results of operations, or financial position. For more information related to our cybersecurity risks, see Item 1A. "Risk Factors–Regulatory, Legal, and Cybersecurity Risks" within this Annual Report.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: Our Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 25 years of experience in information security, including more than 10 years as a Chief Information Security Officer in the retail industry. With a diverse background in both industry and consulting, our CISO has led major security programs, implementing practical strategies to protect critical data and systems.


text: On at least a quarterly basis, the CISO delivers a detailed report to the full Board on data protection and cybersecurity matters. Topics covered by these reports include, but are not limited to, risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company's ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, updates on annual associate training and other specific training initiatives.


text: Managing risk related to cybersecurity is a top priority for Spire, and the Company remains focused on addressing threats that would jeopardize the confidentiality, integrity and availability of stakeholders' information or the ability to continue providing safe and reliable service to customers. To date, Spire has not experienced any material cybersecurity breach that impacts the Company's business strategy, results of operations, or financial condition.

companyName: SPIRE INC

ticker: SR


text: Enterprise risk management ("ERM") at Spire oversees significant risks to the Company's ability to successfully execute on strategy and achieve corporate objectives. Spire's ERM is based on a structured, comprehensive process that leverages ISO 31000:2018, adopted and customized to the Company's needs, utilizing an ongoing process of risk identification, evaluation, treatment, integration and monitoring. ERM helps assess priorities and facilitate decision-making for resource allocation as it relates to risk management. Two risks prioritized by our Enterprise Risk Oversight Committee related to cybersecurity are cyber threats and vendor management. Additionally, the ERM process is structured to integrate with operational levels, where risk is managed, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 utilized by the Company's Information Security function for managing cybersecurity.


text: Spire's Board of Directors ("Board") recognizes the significance of cybersecurity risk and has therefore retained oversight of cybersecurity rather than delegating this risk to a committee of the Board. Every regular meeting of the Board includes a cybersecurity report provided by the Company's Chief Information Officer and the Chief Information Security Officer. These reports focus on developments within the Company's cybersecurity program and provide an update on any cybersecurity events or concerns. In 2024, the Board added a new director with expertise in cybersecurity to assist the Board to appropriately oversee the Company's efforts.


text: Spire's cybersecurity program is led by the Chief Information Officer and the Chief Information Security Officer, who together have over 40 years of experience in information technology and cybersecurity, along with a cross-functional team of technology, legal, physical security and risk leaders. Internal Audit provides assurances of risk management activities, including certain third-party cybersecurity activities, such as penetration testing.


text: Strategy/Approach Spire's cybersecurity team developed a five-year strategic roadmap in 2020, which is reviewed and updated annually. A NIST-based maturity assessment is also conducted annually to assess Spire's current maturity level and is used to establish initiatives to drive capabilities in key focus areas. Such initiatives were updated to align with federal security directives issued in 2021, with a key focus on increasing overall visibility into the environment to better correlate potential security related items; completing segregation and dependency from the enterprise and industrial control systems environments; and establishing defined policies and procedures to enhance overall governance and risk management. In addition to these strategic efforts, the Company works closely with federal agencies, including the U.S Department of Homeland Security, TSA and the local FBI chapter, and is actively involved in industry information sharing groups.


text: The Company's cybersecurity function is staffed with dedicated professionals who continuously monitor risks and evaluate the resiliency and effectiveness of the architecture and defenses within Spire's systems. The Company also maintains policies, procedures and standards to manage conduct within Spire and to be prepared for new cybersecurity threats and events. The cybersecurity program involves a variety of training and education to increase awareness of cybersecurity threats through mandatory annual security awareness training for all employees, quarterly phishing campaigns, and table-top exercises. The Company also engages third parties to evaluate potential risks through external penetration testing to assess the efficacy of systems.


text: Spire maintains business continuity plans to guide the Company's response to a potential cybersecurity event. These plans are regularly reviewed, tested and updated to ensure they meet the evolving needs of the Company in this area. The Company also conducts annual disaster recovery exercises to test the efficacy of core systems in the event of a catastrophic incident.


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase generally in business and society. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Salamander Innisbrook, LLC


text: Our Chief Financial Officer and Corporate Controller oversees our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. These officers work with other members of management, employees and outside service providers to promote and evolve our cybersecurity protocols and systems. There were no material cybersecurity incidents in 2024 or up to the date of this filing.


text: Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed by such providers. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.

companyName: MARINEMAX INC

ticker: HZO


text: Our Executive Vice President and Chief Digital Officer, (the "CDO"), Shawn C. Berg, is responsible for managing the Company's cybersecurity risk and cybersecurity program. Shawn Berg has served as CDO since April 2019 overseeing the Company's Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. He previously served as Vice President of Technology upon joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including experience in multiple officer-level positions, in information technology and security.


text: Our Technology Group, in collaboration with the leading cybersecurity providers, monitors material cybersecurity and overall technology platform risks over time and updates the Company's mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.


text: The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Company has been subject to cybersecurity threats in the past. As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company's Chief Technology Officer has been serving in this role for the Company since March 2025 and has over 30 years of experience in various information security and related technology roles. The Chief Technology Officer oversees the information technology and information security functions of the Company which includes our cyber risk management team.

companyName: BrightView Holdings, Inc.

ticker: BV


text: The Chief Legal Officer acts as the Company's Data Breach Coordinator and leads our Cyber Crisis and Data Breach Response Committee (the "Committee") which consists of the Company's Chief Technology Officer, Chief Financial Officer and Chief Accounting Officer. Cybersecurity incidents that may significantly impact the confidentiality, integrity, or availability of the Company's data or the reliability of the Company's systems or networks are reported to the Committee. The Committee assesses the materiality of each incident, which is made using both quantitative and qualitative analyses to determine an incident's immediate and reasonably likely future impacts. Such cybersecurity incidents are also reported to the Audit Committee. The Company's Data Governance Committee has oversight of that how the Company's data is handled and shared with third parties and is comprised of the Company's Chief Technology Officer, Chief Legal Officer, Chief Human Resources Officer, Chief Accounting Officer, Vice President of Business Shared Services and Chief Audit Executive.


text: We have retained an industry expert to be our virtual Information Security Officer ("vISO") to assist and guide our IT organization in maintaining and evolving a comprehensive and robust cyber security environment. Monthly meetings review all facets of our current status against appropriate NIST standards, review any incidents, and review the results of ongoing simulated phishing exercises to identify certain users who may need extended training. In addition, as part of our annual security review, we hire a third-party network penetration testing firm to provide simulated probing and subsequent reporting. We use the results of these annual tests to improve the strength and flexibility of our network's security.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: Our Incident Response Plan ("IRP") has evolved with our cyber environment and consists of a set of state-of-the-art-tools capable of monitoring, reporting and alerting, as well as regular reviews. The IRP also sets forth guidelines on how to triage, assess the severity and materiality of findings, and remediate and escalate findings to upper management in a timely manner, as necessary. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. However, such insurance may not be sufficient to cover us against all possible claims related to security breaches, cyber-attacks and other related breaches. As of the date of this report, we have not identified cybersecurity threats that we believe are reasonably likely to materially affect us. However, cybersecurity risk is dynamic, and future incidents could materially affect our operations, financial condition, or reputation.


text: Cybersecurity Governance and Oversight The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any material incidents to upper management in a timely manner whenever they occur.


text: Risk Management and Strategy The protection of our clients' data, our brand, and our systems is of utmost importance. We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security. We have implemented comprehensive cybersecurity and data privacy programs, fostering a culture of awareness across all employee groups and systems. In 2025, we achieved SOC2 Type 2 certification, reflecting our commitment to supporting our clients by aligning our controls and processes with the System and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA). This achievement builds on our previous SOC2 Type 1 certification and complements our ongoing TX Ramp compliance.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: We developed our cybersecurity program by integrating proactive training, vulnerability management, and system design with active threat defense mechanisms. Our marketplace services are protected by multiple layers of security including firewalls, endpoint protection, WAF and Bot mitigation. Our "defense in depth" approach to asset protection is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals. We maintain a formal incident response plan, which is regularly tested and updated to ensure prompt detection, reporting, and mitigation of cybersecurity incidents.


text: Cybersecurity Governance Board and Committee Oversight. Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk identification, mitigation strategy and efforts, and resources and receives quarterly updates on cybersecurity risks and mitigation efforts from management, including our Chief Technology Officer (CTO). The Audit Committee of the Board of Directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules. We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employs dedicated resources to protect our systems.


text: Risk Management and Strategy Ashland recognizes the importance of cybersecurity in safeguarding sensitive information and maintaining operational integrity. To that end, Ashland maintains an information security program as part of its overall Enterprise Risk Management ("ERM") program. The Company's information security program includes an incident response plan, which has been reviewed by third-party consultants and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0. The information security program, overseen by the Company's Vice President of Information Technology and Chief Information Officer, is designed to provide a framework for assessing, identifying, managing, mitigating and responding to cybersecurity threats and incidents and to facilitate cross-functional coordination within Ashland.

companyName: ASHLAND INC.

ticker: ASH


text: Ashland maintains a similar risk-based approach to its third-party vendor management program including identifying and overseeing cybersecurity risks that such third parties may present. As part of this program, the Company, imposes additional scrutiny for vendors that may handle personally identifiable information data or trade secrets.


text: Ashland's information security program is led by the Company's Cyber Security Director who has more than 25 years of experience in information technology and 5 years of experience serving in a deputy chief information security officer role or top executive leader in cyber. Our Cyber Security Director is primarily responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy. In addition, other members of the Company's information security team also have significant experience in information security.


text: As noted above, management of Ashland's cybersecurity risks is part of the Company's overall ERM program, which is overseen by the Board. The Board's Audit Committee has primary responsibility for the oversight of the Company's information and cybersecurity risks and the programs established to manage such risks. The Audit Committee fulfills this oversight responsibility through receiving regular (and as needed) reports and updates from the Company's Cyber Security Director and Ashland's Board also receives periodic reports updates from the Cyber Security Director and the Audit Committee regarding information and cybersecurity matters.


text: The Company maintains a risk-based cybersecurity program designed to protect the confidentiality, integrity, and availability of our networks and systems that we own or are in our care. Our program is aligned to U.S. National Institute for Standards and Technology (“NIST”) standards and other applicable industry frameworks. We document our compliance efforts with regulations and standards that govern our business, including the Sarbanes-Oxley Act, the Family Educational Rights and Privacy Act (“FERPA”), the Gramm-Leach-Bliley Act Safeguards Rule, and the Payment Card Industry Data Security Standard (“PCI-DSS”).

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: Our program is designed to identify, assess, and manage material risks from cybersecurity threats through practices that include: • required information security and privacy training supported by periodic phishing simulation exercises to reinforce awareness and enhance cybersecurity practices; • monitoring of network and system activity to detect unusual or suspicious behavior; • access management and access controls which aim to implement “least privilege” access; • multifactor authentication and encryption of sensitive data through “at rest” and “in transit” where feasible; • deployment of industry-standard security monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • business continuity and disaster recovery planning; and • a documented Incident Response Plan (“IRP”) that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents in coordination with our Legal and the Ethics, Compliance, and Data Privacy (“ECDP”) department.


text: The Company’s cybersecurity program is integrated within the Company’s enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks. The Company also engages third party experts to assist with compliance and maturity assessments and penetration testing, as appropriate.


text: The Company maintains arrangements with third party information infrastructure or IT vendors, including “cloud computing” vendors. All potential vendors are evaluated through the Company’s third-party due diligence process, which includes conducting cybersecurity risk assessments prior to integration into the Company’s networks and additional assessments prior to contract renewals or extensions. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.


text: To date, the Company’s business strategy, operating results, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior incidents. Our program is designed to identify, prevent, and mitigate cybersecurity events that would have a material adverse effect on the Company; however, the nature and sophistication of cybersecurity risks continue to evolve. No security framework, system, or control environment can fully eliminate the risk of a cyberattack or unauthorized access. Despite the Company’s safeguards to protect its systems, intellectual property, and confidential and personal information, vulnerabilities may persist that could be exploited by threat actors. See Item 1A, “Risk Factors—Risks Related to our Business.”


text: The Company’s Chief Information Security Officer (“CISO”) is responsible for cybersecurity at the executive level and oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with and reports to the Chief Information Officer. Our CISO has over two decades of cybersecurity experience, including responsibilities in technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains relevant industry credentials.


text: The CISO also leads a cross-functional Incident Response Team (“IRT”) responsible for responding to and managing cybersecurity incidents in coordination with our Legal department and ECDP department. The IRT consists of professionals from various departments, including Information Technology and Security, Legal, ECDP, Finance, Public Relations, and other key business areas as needed. The IRP is tested annually via a tabletop exercise, focused on executive strategy and communication processes during an incident.


text: The Audit Committee of the Company’s Board of Directors is tasked with oversight of the Company’s cybersecurity, information and technology security and data privacy strategies and policies. The Chief Information Officer and/or CISO provide regular updates to the Audit Committee on cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries.


text: We are subject to various cybersecurity risks in connection with our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors, I. Risks Related to Our Business Operations and Industry of this Annual Report.

companyName: PTC INC.

ticker: PTC


text: We take a holistic, multi-layered approach to cybersecurity and privacy that combines traditional Defense-in-Depth methods with next-generation Zero Trust principles. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST") and the Software Assurance Maturity Model developed by the OWASP (the "OWASP SAMM"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II and FedRAMP, for certain of our products and services.


text: People. Recognizing that technology alone cannot mitigate all security threats, we focus on developing our most critical resource: our people. Our corporate cybersecurity awareness activities are combined with enterprise-wide and department-specific tools and mandatory employee training, providing our employees with knowledge and resources to support our efforts to mitigate security threats.


text: Process. We maintain processes and policies to try to anticipate security risks and facilitate compliance with applicable contractual obligations, regulations, and standards, as well as address any incidents or violations. We focus on continuous improvement and constantly mature our processes to keep pace with the rapidly evolving cybersecurity threat landscape.


text: Technology. We seek to automate processes and remove the potential for human error to the extent feasible by implementing technology solutions. From fundamental IT security to development of our software products and keeping our customers' data safe, we aim to maintain a secure infrastructure that is appropriately monitored for possible threats.


text: These three key elements of people, process, and technology are tightly interwoven to support our aim to secure our environments and the data for which we are a custodian.


text: Cybersecurity is a risk area with oversight at the highest levels of the organization, including the Executive and Board Level. The overall operational program is led by the Cybersecurity Strategy Council, a cross-functional team of executives and subject matter experts, led by our Chief Product Security Officer, Chief Information Security Officer and Chief Compliance Officer. The Cybersecurity Strategy Council oversees a "Three Lines Model" of Operations, Risk Monitoring and Oversight, and Audit, to effectively address cybersecurity, risk management, and control. All Cybersecurity, Risk, and Internal Audit functions report to the PTC Executive Leadership Team.


text: We provide regular updates on our cybersecurity strategic plans, programs, and initiatives to the Cybersecurity Committee of the Board of Directors at its four regularly scheduled meetings per year. Our Incident Response Plans provide for notice, and continued updates, to the Cybersecurity Committee of applicable incidents on a timely basis.


text: We conduct an annual cybersecurity maturity assessment. Periodically, we engage a third-party security consulting firm to conduct an Enterprise Security Maturity Assessment. This independent assessment provides a mechanism to benchmark our current risk profile and enables us to measure progress as we make program improvements. Identified cybersecurity risks are reviewed by the Cybersecurity Strategy Council, which ensures that risk tolerances are established and used to appropriately manage risks and address the risks identified.


text: Third-Party Vendor Risk Management Our Vendor Risk Management (VRM) program is designed to meet cybersecurity, privacy, regulatory and compliance obligations, by managing risk associated with third-party vendors who have access to PTC IT systems and data. Prior to outsourcing or allowing third-party access to PTC or customer systems, IP, or data; risks associated with such activity are identified and documented. The process of selecting a third-party vendor includes due diligence of the vendor service or product in question. Third-party companies using PTC facilities or accessing PTC's IT Systems are subject to PTC's VRM review and must demonstrate that proper security measures are in place before they have access to any PTC IT systems or data. All such vendors are to be approved by PTC's VRM process and contractually bound to maintain appropriate cybersecurity technical and organization measures and to protect PTC's data to which they may have access.


text: Incident Response We maintain an Enterprise Cybersecurity Incident Response Policy to address cybersecurity incidents. The Policy is tested on a periodic basis, including an ongoing improvement program involving periodic tabletop exercises. Cybersecurity incident handling is managed by individual organizations with cybersecurity responsibility and monitored/guided by applicable corporate functions. All Cybersecurity Incident Response Plans under the Policy are based on industry standards, such as the NIST Computer Security Incident Handling Guide – Special Publication 800-61.


text: Management's Role in Assessing and Managing Our Risks from Cybersecurity Threats Our Cybersecurity Program is overseen by executives on our Executive Leadership Team and managed by our Cybersecurity Strategy Council, including our Senior Vice President, Chief Information Security Officer (CISO), who reports to our Executive Vice President, Chief Digital and Information Officer (CDO). Our CISO is responsible for day-to-day risk management activities, including staying informed about and monitoring prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, and the use of technological tools and software. Our CDO is responsible for our broader IT program, which includes our ability to remediate and recover from a cybersecurity incident while reducing impacts to the business and operations. Our CDO and CISO regularly report directly to the Cybersecurity Committee of the Board of Directors on our Cybersecurity Program and efforts to prevent, detect, mitigate, and remediate issues. In addition, we have an escalation process in place to inform senior management and the Cybersecurity Committee and the Board of Directors of material issues.


text: Management Experience Our CDO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CDO joined PTC as Chief Digital and Information Officer in January 2022 and is responsible for PTC's global information technology (IT) team, overseeing PTC's digital infrastructure and working with business leaders to guide PTC's digital process optimization strategy. He has more than two decades of IT and operations leadership. Before joining PTC, he served as Global Vice President and Chief Information Officer for Avaya, where he led a globally-dispersed team of 1,200 IT professionals to support the entire global Avaya enterprise. Prior to Avaya, he held technology leadership roles at Arise Virtual Solutions Inc., Oracle, and Colorado College.


text: Risk Management and Strategy As noted in Part I, Item IA, Risk Factors, Cabot recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we have taken measures to protect Company data and the continuing operation of our information technology and communications systems. Our cybersecurity program includes information technology ("IT") policies and standards and an IT risk management program. Our cybersecurity risk management program leverages standards established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which provides guidance to organizations on how to identify, prevent, detect, respond and recover from cybersecurity threats.

companyName: CABOT CORP

ticker: CBT


text: Further, cybersecurity risk is integrated into our enterprise risk management ("ERM") approach and is among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. We use several tools and controls designed to manage IT risk, including, but not limited to, controls for the management of privileged access, anti-malware tools, simulated email phishing attacks, and other email security tools intended to detect and prevent intrusions as well as monitor risks. All Cabot employees participate in monitored cyber security training and have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. We have a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engage in response planning, simulations, trainings, tabletop exercises, and other efforts to prepare for any incidents should they occur.


text: We periodically engage assessors, consultants, auditors, and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. These assessments provide insight into areas of future improvement in risk mitigation and further program development. In addition, we rely on third parties for various business functions and oversee such third-party service providers by conducting vendor diligence upon onboarding as well as ongoing monitoring.


text: Governance and Oversight Management Oversight in Cybersecurity Governance Cabot's Cyber Risk Steering Committee is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Our Chief Digital Information Officer (the "CDIO") is the member of the Company's management principally responsible for overseeing the Company's cybersecurity risk management programs in partnership with business and functional leaders across the Company as well as a managed security service provider that provides threat intelligence, global infrastructure monitoring and threat detection and response to cyber events. The CDIO has held various positions within Cabot's IT department over his 20-year tenure with the Company, and contributes technical expertise to the Company's management team. The CDIO leverages extensive industry, IT and cybersecurity expertise to make strategic and operations decisions for Cabot's information security program. The CDIO collaborates with Cabot's Management Executive Committee to manage cyber risk and enhance the cyber program and reports directly to a member of our Management Executive Committee who has executive responsibility for Digital matters.


text: As of the date of this report, we have not experienced a cybersecurity incident that has resulted in a material effect on our business strategy, results of operations or financial condition. Despite our efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of the Company's or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm; damage to our brand; lost sales; physical damage to facilities; physical harm to individuals; reduced demand; loss of intellectual property rights; significant costs; or the Company being subject to government investigations, litigation, fines or damages. For additional information, see Part I, Item 1A, "Risk Factors—Operational Risks—Information technology systems failures, data security breaches, cybersecurity attacks or network disruptions have harmed us in the past and could compromise our information, disrupt our operations and expose us to liability, which may adversely impact our operations."


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving as CCO since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: PENNANTPARK INVESTMENT CORP

ticker: PNNT


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care and is integrated into our overall enterprise risk management program.

companyName: Woodward, Inc.

ticker: WWD


text: We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. We periodically send "Test" phishing assessments to our members. Any failures trigger a retraining exercise. Also, we have specific and regular training for our IT and finance members, as well as our system administrators.


text: In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes, as applicable and appropriate based on risk profile and criticality, a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and/or Cybersecurity Maturity Model Certifications, as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this Form 10-K, including the risk factor entitled "Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions."


text: Cybersecurity Governance Our cybersecurity program is ultimately overseen by the Board of Directors (the "Board"). The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry, monitor various security tools deployed in the IT environment and review threat intelligence and other information from various public and private sources. The team has decades of experience with varied certifications and is led by our Chief Information Security Officer ("CISO"), who reports to our Vice President of IT, has over 18 years of experience as an IT professional and in cybersecurity, including experience leading cybersecurity programs protecting high value assets and critical infrastructure, including in high-risk locations. Our Vice President of IT has been a key leader in our IT group for more than 25 years, including the last seven in his current role leading our IT function. He plays an integral role in cybersecurity risk assessment and mitigation in all corporate acquisitions, and he participated in the development and implementation of our initial cybersecurity program more than 20 years ago.


text: Our CISO and Vice President of IT are primarily responsible for assessing and managing risks from cybersecurity threats to the Company. The CISO and Vice President of IT make regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. The senior management team, including the CISO and Vice President of IT, provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.


text: Risk Management and Strategy We maintain a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: We use third-party security vendors to further strengthen our cybersecurity posture. These partners provide advanced monitoring, detection, and response capabilities that complement our internal controls and staff expertise. Their services include continuous threat intelligence, vulnerability management, and incident response support, which are integrated into our cybersecurity program. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also key components of our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.


text: We have implemented a third-party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third-party vendors. As part of communicating the importance of cybersecurity at an enterprise-wide level, we require that all company employees participate in annual cybersecurity training.


text: Our IT Steering and Risk Committee ("ITSRC") has been delegated the responsibility for managing cybersecurity risk for the company by the Board of Directors (the "Board"). This committee is chaired by our Chief Technology Officer & Chief Operating Officer and includes a diverse cross section of company stakeholders including the CFO, Director of IT, SVP of Security, and our General Counsel. On May 1, 2025, we added an outsourced virtual CISO who is a key advisor to the ITSRC, bringing over a decade of expertise in managing and maturing cybersecurity program that includes mitigation, incident prevention, detection and remediation disciplines. The ITSRC is also responsible for maintaining and monitoring legal and regulatory requirements and compliance as well as oversight of the adequacy of company cyber insurance. Our third-party security vendors, in collaboration with our Director of IT, keep the ITSRC apprised of efforts surrounding the prevention, detection, mitigation and remediation of any cyber threats or cybersecurity incidents.


text: The Board is entrusted with the oversight of the management of cybersecurity risk and our cybersecurity program. The Board administers this oversight through its audit committee and the ITSRC. The ITSRC committee chair is responsible for reporting to the Board's audit committee with respect to cybersecurity at least twice per calendar year. The audit committee, as necessary, reports any findings and recommendations to the Board. As cyber threats evolve and as our cybersecurity program matures, the Board will consider further developing specific cybersecurity oversight functions and protocols. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are assessed for risk and may additionally be required to adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2025. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The S ponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.

companyName: Grayscale Horizen Trust (ZEN)

ticker: HZEN


text: Cybersecurity Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents. Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the NIST Cybersecurity Framework. Our program is comprehensive in scope and covers all of our general corporate IT systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers. Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives. Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH