text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board of Directors considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, our Chief Financial Officer holds discussions on cybersecurity risks and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM

secItem: Item 1C


text: Given the size of the Company, we do not employ individuals with significant experience and relevant backgrounds in information security, cyber risk management, and cyber incident response. However, we contract with third-party vendors who have these backgrounds. These backgrounds include relevant degrees, certifications, and relevant work experience, including in roles responsible for cybersecurity oversight in entities similar to us, and our Chief Financial Officer relies on the expertise provided by these third-parties in carrying out his cybersecurity responsibilities.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Risk management and strategy Neuphoria recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: Managing Material Risks & Integrated Overall Risk Management Our risk management team has evaluated and addressed cybersecurity risks in alignment with our business objectives and operational needs and have integrated them into our overall risk management system.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Neuphoria has and engaged with a range of external experts, including cybersecurity assessors, consultants, advisors, and auditors in evaluating and testing our risk management systems. These partnerships will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Neuphoria will implement stringent processes to oversee and manage these risks. We will conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats While we have encountered cybersecurity threats, including a breach of an administrative email account, these challenges have not resulted in the loss of any data, materials, or clinical information, and have not materially impaired our operations or financial standing.


text: Board of Directors Oversight The Audit & Risk Management Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit & Risk Management Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Risk Management Personnel Our IT Manager is actively involved in assessing, monitoring and managing our cybersecurity risks. He has over 30 years of experience in the field of cybersecurity, and his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Monitor Cybersecurity Incidents Our IT Manager implements and oversees processes for the regular monitoring of our information systems, which includes having a well-defined incident response plan. In the event of a cybersecurity incident, we can take immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Management and the Board of Directors Our IT Manager will provide regular updates to our CEO, Spyros Papapetropoulos, regarding all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks faced by Neuphoria. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The Company recognizes the critical importance of cybersecurity in safeguarding its operations, assets, and various stakeholders and acknowledges that such risks are becoming more complex and frequent. As part of its enterprise-level risk management assessment process, the Company has implemented a cybersecurity program to identify, mitigate, and respond to risks associated with cyber threats and to protect the confidentiality, integrity and availability of Company computer systems.

companyName: LINDSAY CORP

ticker: LNN


text: The aspects of the Company's risk management approach to cybersecurity include: • Annually reviewing and updating cybersecurity policies to ensure alignment with the latest industry standards and regulatory requirements. The specific aspects of the Company's program are informed by guidelines outlined in various accepted frameworks, including the Cybersecurity Framework issued by the National Institute of Standards and Technology Framework, an agency of the United States Department of Commerce. • Maintaining a dedicated cybersecurity team under the direction of the Company's Chief Information Officer ("CIO"), that has expertise related to data and network security, data governance, and risk management. • Conducting vulnerability assessments to identify and mitigate potential security risks. These assessments include network scans, penetration testing, and security audits performed by internal resources or qualified third-party providers. • Requiring all employees to participate in cybersecurity training and awareness programs including annual cybersecurity training and monthly phishing campaigns. These programs educate employees on how to recognize and respond to cyber threats and develop best practices for maintaining a strong security culture. • Monitoring information channels from trusted security information sources to stay abreast of developing cybersecurity concerns that may affect the Company or its operations. • Reviewing the security protocols of new third-party service providers to ensure acceptable levels of security are documented and maintained. • Maintaining an incident response retainer with a respected cybersecurity firm to ensure timely response and forensic capabilities.


text: Despite the Company's efforts, cyber attacks, unauthorized access, security breaches, ransomware, social engineering attacks or other cyber incidents could materially affect the Company and disrupt its business. Potential consequences of a successful cyber attack or cybersecurity incident could include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. While the Company is regularly exposed to such malicious threats, none of these threats, individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this Annual Report on Form 10-K.


text: Incident Response Procedures The Company's cybersecurity incident response plan is a critical component of the overall cybersecurity strategy. This plan outlines the procedures and actions to be taken in the event of a cybersecurity incident to minimize impact and ensure a swift recovery. Key elements of the Company's incident response plan include: • Incident discovery and confirmation: the Company has established clear protocols for identifying and reporting suspected cybersecurity incidents. Employees are trained to recognize potential incidents and report them immediately to the Company's IT security team. • Incident assessment and classification: upon receiving a report of a potential incident, the Company's IT security team conducts a thorough assessment to determine the nature and severity of the incident. Incidents are classified based on their impact and risk level. • Containment and continuity: once an incident is confirmed, the Company takes immediate steps to contain and mitigate its impact, which may involve isolating affected systems, applying security patches, or implementing other remedial actions. • Eradication and recovery: after containment, the Company works to eradicate the root cause of the incident and restore affected systems to normal operation, which includes evicting threat actors, removing malware, repairing vulnerabilities, and validating system integrity. • Communication and reporting: the Company maintains clear communication channels to keep all relevant stakeholders informed throughout the incident response process, which includes internal communication with employees and external communication with customers, regulators, and other parties as necessary. • Post-incident review and improvement: following the resolution of an incident, the Company conducts a post-incident review to identify lessons learned and areas for improvement, which helps enhance incident response capabilities and prevent future incidents.


text: As part of its oversight responsibilities as it relates to the Company's overall risk management, the Company's Board of Directors has designated cybersecurity oversight as a full board responsibility. The Board of Directors is mindful to have members with cybersecurity expertise represented on the Board of Directors. The CIO provides monthly reports to the Board of Directors regarding cybersecurity related matters and presents cybersecurity updates to the full Board of Directors at each Board meeting. The Board of Directors also participates in regular training and educational efforts to stay current on relevant cybersecurity related topics.


text: The Company's CIO reports directly to the Company's Chief Executive Officer and is responsible for managing, designing, and implementing all aspects of the Company's day-to-day cybersecurity programs and initiatives. The CIO and the dedicated cybersecurity team have appropriate levels of expertise, certifications, and previous work experience to effectively develop and oversee the Company's cybersecurity efforts.


text: Cybersecurity represents an important component of our overall approach to risk management. Our information security risk management (ISRM) policies, standards and practices are integrated into our overall enterprise risk management approach, and cybersecurity risks are one of the business risks that are subject to oversight by our Board of Directors. Our ISRM policies, standards and practices align with National Institute of Standards (NIST) and Technology Cybersecurity Framework and International Organization for Standardization (ISO) 27001.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: Risk Management and Strategy Our cybersecurity program focuses on the following areas: • Vigilance – We maintain cybersecurity threat operations with the goal of proactively identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established cybersecurity incident response procedure plan. We recognize that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence technologies. • Systems Safeguards – We implement layered systems safeguards to enable the protection of our information systems from cybersecurity threats. These safeguards include network security, vulnerability management, and threat detection. • Collaboration – We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management – We actively manage cybersecurity risks posed by third parties and their systems that could impact our operations. We monitor and assess the security posture of our third-party vendors. We require third-party service providers with access to sensitive information to maintain cybersecurity practices aligned with industry standards and applicable laws. In addition, we proactively monitor public information regarding our vendors for security incidents, investigate potential impacts, and take appropriate action to mitigate risk. • Training – We have implemented and maintain a comprehensive cybersecurity training program to educate personnel about evolving threats and reinforce security best practices. This program includes: i. Monthly phishing awareness campaigns with mandatory remedial training for those who fail. ii. Annual security and acceptable use awareness training.


text: iii. Targeted training for high-risk groups such as finance and accounting, including phishing email response checks, to proactively mitigate threats like business email compromise.


text: • Incident Response and Recovery Planning – We have established and maintain a cybersecurity incident response procedure plan that addresses our response to cybersecurity incidents and recovery from such incidents, and such plan is tested and evaluated periodically. • Communication, Coordination and Disclosure – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Audit Committee of the Board of Directors, in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. We have established an Incident Response Committee, which is chaired by our SVP Administration, to quickly organize and execute an effective, productive, timely and compliance-conscious response to cybersecurity threats and incidents, as well as coordinate among the cross-functional groups.


text: We manage risks from cybersecurity threats through the assessment and testing of our processes and practices focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. We maintain cyber risk and related insurance policies as a measure of added protection.


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Audit Committee reviews cybersecurity on a quarterly basis. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board of Directors and the Audit Committee discuss our approach to cybersecurity risk management with the Chief Information Security Officer (CISO) and other cyber team members, as well as senior leadership.


text: The CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO has decades of experience in the cybersecurity and information security fields, including experience with both private and public companies and the military, as well as experience in the transportation and rail industry. The CISO is a Boardroom Certified Qualified Technology Expert (QTE) and holds certifications including Certified Chief Information Security Officer (C|CISO), Certified Internal Auditor (BSI) and is a graduate of the Wounded Warrior Cyber Combat Academy. The CISO has experience with regulatory compliance frameworks including ISO 27001, SOX, NIST and CMMC.


text: The CISO works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal & Compliance Officer across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our cybersecurity incident response procedure plan.


text: To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy is designed to detect, evaluate, and manage risks from cybersecurity threats and incidents. Our program is intended to identify cybersecurity risks facing our organization and inform our risk-based approach to cybersecurity preparedness and incident response procedures.

companyName: UNIFIRST CORP

ticker: UNF


text: Our cybersecurity risk management program is supported by our third-party vendors and service providers, and includes, but is not limited to, periodic penetration testing and endpoint detection, and automated tools to monitor our network and systems to detect vulnerabilities or unusual activity that could lead to unauthorized access to our systems or data. We conduct assessments, as appropriate, of critical third-party service providers, which generally include a cybersecurity questionnaire and a review of security assessments and certifications. We also provide cybersecurity awareness training to employees with access to our network.


text: We also have a policy for responding to and mitigating cybersecurity incidents. Our Chief Information & Technology Officer ("CITO") oversees our incident response procedures, which are reviewed and updated periodically.


text: We have not identified cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see the risk factor titled "If our information technology systems suffer interruptions or failures, including as a result of cyber-attacks, our business operations could be disrupted or other material adverse impacts on our business could result."


text: Cybersecurity Governance Our CITO, who reports to our Chief Executive Officer, is responsible for leading our information security team and overseeing the Company's cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer. Our Chief Information Security Officer supports the program and incident response and reports to the CITO.


text: Our cybersecurity risk management program is overseen by our Board of Directors. Members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.


text: Risk Management and Strategy Our cybersecurity risk management program is designed to monitor and control cybersecurity risk exposure, response, mitigation and protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity policies and processes are fully integrated into the Company's Enterprise Risk Management program. Our cybersecurity program is based on industry recognized best practices, including the ISO 27001 Information Security, Cybersecurity and Privacy protection international best practice standards.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Our cybersecurity risk management program includes: • Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends, internal assessments and engaging third parties to assess the effectiveness of our cybersecurity practices; • The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls; • Mandatory cybersecurity awareness training for employees and simulated phishing attacks; • A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors; • Cybersecurity insurance which is assessed annually; and • Risk management process for service providers, suppliers, and vendors.


text: Cybersecurity risks are monitored on an ongoing basis, and the security program and practices are adjusted as necessary. We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program, including the steps taken to monitor, minimize or control such risks or exposures.


text: The board of directors receives quarterly reports from management regarding the status of the cybersecurity risk management program, current activities, planned projects, and security assessments. In addition, management will update the board of directors, as necessary, regarding any significant cybersecurity incidents that we may experience.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity risk management team is led by our VP IT Security Compliance and our Head of IT. These individuals have collectively over 50 years of experience in both restaurant and technology sectors and have held technology leadership roles at national restaurant companies.


text: Additional information on cybersecurity risks is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely significantly on information technology and cybersecurity, and any material failure, weakness, interruption or breach of security could prevent us from effectively operating our business."


text: Risk Management Strategies Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems. We have developed and implemented a cybersecurity risk management program ("Cybersecurity Program") that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. The Cybersecurity Program is intended to protect the confidentiality, availability, and integrity of our information and critical systems by continually monitoring, assessing, identifying, and mitigating cybersecurity risks. The Cybersecurity Program is part of our integrated risk management process and includes, but is not limited to, the following features: • Regularly simulated phishing attacks and comprehensive cybersecurity training for all employees, with special focus on high-risk individuals using a new security awareness platform. • Cybersecurity insurance coverage to mitigate financial impacts from potential cyber incidents. • Endpoint detection and response technologies (EDR) to monitor systems continuously for malicious activity. • Behavior analytics tools that help track normal behavior patterns and quickly detect any anomalies. • Cloud security measures, offering comprehensive protection and vulnerability management for our cloud environments. • Digital risk protection that includes brand protection, social media monitoring, dark web surveillance, and proactive response to phishing, fraud, and account takeovers. • Zero-day vulnerability management, with third-party monitoring to prioritize critical vulnerabilities based on real-time risk assessments and active exploitation. • Comprehensive vendor risk management program, including penetration tests, Service Organization Control ("SOC") reports, and security architecture reviews, especially for third parties managing sensitive data or accessing internal systems.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: In addition, we have a written cybersecurity incident response plan ("Response Plan") that is reviewed and updated, if necessary, at least annually. The Response Plan includes a cross-functional incident response team comprised of various key executive representatives from different departments in our organization, such as our Chief Information Security Officer ("CISO") and General Counsel, that are tasked with assessing the scope, nature, and potential impact of incidents. Findings are reported to the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), our Board and the Disclosure Committee, the latter of which is comprised of senior representatives from our finance, accounting, internal audit and legal departments under the supervision of the CEO and CFO.


text: We also regularly engage third parties to perform assessments on the Cybersecurity Program, including an annual self-assessed risk review facilitated by an independent third party, where we evaluate various cybersecurity domains and control areas and benchmark our program against industry peers. Additionally, we conduct annual third-party penetration tests focused on our highest-risk areas globally, providing insights into potential vulnerabilities. These assessments are supplemented by red team exercises and real-world incident response simulations to continually improve our security posture.


text: From time to time, we experience cybersecurity threats and incidents. As of the date of this Annual Report, we have not identified any instances that have occurred in the current year, or in prior years, that would have a material impact on our Company or on our results of operations, or financial position. For more information related to our cybersecurity risks, see Item 1A. "Risk Factors–Regulatory, Legal, and Cybersecurity Risks" within this Annual Report.


text: Our Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 25 years of experience in information security, including more than 10 years as a Chief Information Security Officer in the retail industry. With a diverse background in both industry and consulting, our CISO has led major security programs, implementing practical strategies to protect critical data and systems.


text: On at least a quarterly basis, the CISO delivers a detailed report to the full Board on data protection and cybersecurity matters. Topics covered by these reports include, but are not limited to, risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company's ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, updates on annual associate training and other specific training initiatives.


text: Managing risk related to cybersecurity is a top priority for Spire, and the Company remains focused on addressing threats that would jeopardize the confidentiality, integrity and availability of stakeholders' information or the ability to continue providing safe and reliable service to customers. To date, Spire has not experienced any material cybersecurity breach that impacts the Company's business strategy, results of operations, or financial condition.

companyName: SPIRE INC

ticker: SR


text: Enterprise risk management ("ERM") at Spire oversees significant risks to the Company's ability to successfully execute on strategy and achieve corporate objectives. Spire's ERM is based on a structured, comprehensive process that leverages ISO 31000:2018, adopted and customized to the Company's needs, utilizing an ongoing process of risk identification, evaluation, treatment, integration and monitoring. ERM helps assess priorities and facilitate decision-making for resource allocation as it relates to risk management. Two risks prioritized by our Enterprise Risk Oversight Committee related to cybersecurity are cyber threats and vendor management. Additionally, the ERM process is structured to integrate with operational levels, where risk is managed, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 utilized by the Company's Information Security function for managing cybersecurity.


text: Spire's Board of Directors ("Board") recognizes the significance of cybersecurity risk and has therefore retained oversight of cybersecurity rather than delegating this risk to a committee of the Board. Every regular meeting of the Board includes a cybersecurity report provided by the Company's Chief Information Officer and the Chief Information Security Officer. These reports focus on developments within the Company's cybersecurity program and provide an update on any cybersecurity events or concerns. In 2024, the Board added a new director with expertise in cybersecurity to assist the Board to appropriately oversee the Company's efforts.


text: Spire's cybersecurity program is led by the Chief Information Officer and the Chief Information Security Officer, who together have over 40 years of experience in information technology and cybersecurity, along with a cross-functional team of technology, legal, physical security and risk leaders. Internal Audit provides assurances of risk management activities, including certain third-party cybersecurity activities, such as penetration testing.


text: Strategy/Approach Spire's cybersecurity team developed a five-year strategic roadmap in 2020, which is reviewed and updated annually. A NIST-based maturity assessment is also conducted annually to assess Spire's current maturity level and is used to establish initiatives to drive capabilities in key focus areas. Such initiatives were updated to align with federal security directives issued in 2021, with a key focus on increasing overall visibility into the environment to better correlate potential security related items; completing segregation and dependency from the enterprise and industrial control systems environments; and establishing defined policies and procedures to enhance overall governance and risk management. In addition to these strategic efforts, the Company works closely with federal agencies, including the U.S Department of Homeland Security, TSA and the local FBI chapter, and is actively involved in industry information sharing groups.


text: The Company's cybersecurity function is staffed with dedicated professionals who continuously monitor risks and evaluate the resiliency and effectiveness of the architecture and defenses within Spire's systems. The Company also maintains policies, procedures and standards to manage conduct within Spire and to be prepared for new cybersecurity threats and events. The cybersecurity program involves a variety of training and education to increase awareness of cybersecurity threats through mandatory annual security awareness training for all employees, quarterly phishing campaigns, and table-top exercises. The Company also engages third parties to evaluate potential risks through external penetration testing to assess the efficacy of systems.


text: Spire maintains business continuity plans to guide the Company's response to a potential cybersecurity event. These plans are regularly reviewed, tested and updated to ensure they meet the evolving needs of the Company in this area. The Company also conducts annual disaster recovery exercises to test the efficacy of core systems in the event of a catastrophic incident.


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We, directly and through our third-party service providers, maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We and our third-party service providers conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan.

companyName: Salamander Innisbrook, LLC


text: We have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements. We gather information and review security protocols of certain third parties who integrate with our systems, such as our payroll processor, managed solutions provider, and software as a service provider, on an annual basis to identify and manage risk. We regularly seek to improve and mature our cybersecurity processes. We apply lessons learned from our efforts to help prevent attacks and utilize data analytics to detect anomalies and search for cyber threats.


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase generally in business and society. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our finance and IT consultants have oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. They receive updates from management on our cybersecurity risks as may be required or prudent. In addition, management updates the home office executive committee as necessary, regarding any material cybersecurity incidents. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our home office executive committee. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership, as appropriate.


text: Our Chief Financial Officer and Corporate Controller oversees our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. These officers work with other members of management, employees and outside service providers to promote and evolve our cybersecurity protocols and systems. There were no material cybersecurity incidents in 2024 or up to the date of this filing.


text: Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. The Company's Board of Directors (the "Board"), with the input of management, oversees the Company's internal controls and processes, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: MARINEMAX INC

ticker: HZO


text: Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed by such providers. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.


text: Our Executive Vice President and Chief Digital Officer, (the "CDO"), Shawn C. Berg, is responsible for managing the Company's cybersecurity risk and cybersecurity program. Shawn Berg has served as CDO since April 2019 overseeing the Company's Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. He previously served as Vice President of Technology upon joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including experience in multiple officer-level positions, in information technology and security.


text: Our Technology Group, in collaboration with the leading cybersecurity providers, monitors material cybersecurity and overall technology platform risks over time and updates the Company's mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.


text: The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Company has been subject to cybersecurity threats in the past. As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Notwithstanding our vigilant cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factor in this report, titled "Increased cybersecurity requirements, threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, data and our third-party service providers. Our business operations could be negatively impacted by an outage or breach of our informational technology systems or a cybersecurity event".


text: Risk Management and Strategy We recognize the critical importance of effective cyber risk management and response strategies in today's digital landscape. As part of our comprehensive risk management framework, we have developed a cyber crisis and data breach response plan for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. These engagements include routine audits, threat assessments, and consultations aimed at enhancing our security measures. We have incorporated cybersecurity risk management within our comprehensive risk management framework to cultivate responsiveness and a corporate culture that prioritizes cybersecurity risk management. Our cyber risk management team works closely with stakeholders across corporate functions to consistently assess and mitigate cybersecurity risks, aligning with our business goals and operational requirements.

companyName: BrightView Holdings, Inc.

ticker: BV


text: We utilize a range of external experts, including cybersecurity consultants to assist in evaluating and testing our risk management systems, particularly where advanced or specialized expertise may be required.


text: We acknowledge that there are risks associated with third-party service providers that have access to our systems and data, we have implemented processes to oversee and manage these risks. We oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers by reviewing service organization controls reports for key outsourced systems. We also conduct security assessments of certain third-party providers before engagement and monitor such providers to confirm compliance with industry accepted cybersecurity standards and practices. This approach is designed to reduce risks related to data breaches, operational disruptions, or other security incidents originating from third-parties.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.


text: Cybersecurity governance is a priority for both our Board of Directors and management. The Board has delegated primary oversight of cybersecurity risks to the Audit Committee. The Audit Committee monitors the cybersecurity risk management and cyber control functions, including external security audits. The Audit Committee receives periodic updates from experienced senior management of the Company's cyber risk management team knowledgeable about assessing and managing cyber risks, including, as appropriate, updates on the prevention, detection, mitigation, and remediation of cyber incidents.


text: The Company's Chief Technology Officer has been serving in this role for the Company since March 2025 and has over 30 years of experience in various information security and related technology roles. The Chief Technology Officer oversees the information technology and information security functions of the Company which includes our cyber risk management team.


text: The Chief Legal Officer acts as the Company's Data Breach Coordinator and leads our Cyber Crisis and Data Breach Response Committee (the "Committee") which consists of the Company's Chief Technology Officer, Chief Financial Officer and Chief Accounting Officer. Cybersecurity incidents that may significantly impact the confidentiality, integrity, or availability of the Company's data or the reliability of the Company's systems or networks are reported to the Committee. The Committee assesses the materiality of each incident, which is made using both quantitative and qualitative analyses to determine an incident's immediate and reasonably likely future impacts. Such cybersecurity incidents are also reported to the Audit Committee. The Company's Data Governance Committee has oversight of that how the Company's data is handled and shared with third parties and is comprised of the Company's Chief Technology Officer, Chief Legal Officer, Chief Human Resources Officer, Chief Accounting Officer, Vice President of Business Shared Services and Chief Audit Executive.


text: The Company has a cybersecurity training program that requires all employees with access to the Company's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks. Also, the Company regularly tests the efficacy of its training efforts as well as its systems to assess vulnerabilities to cybersecurity risks, including tabletop incident response exercises.


text: Annually we conduct an Enterprise Risk Assessment during which we identify and quantify risks, including cybersecurity risks, which could enhance or impede the Company's ability to achieve current or future strategic objectives. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee.


text: We have continued to invest in an evolving state-of-the-art cybersecurity framework of tools, processes, training, and people designed to efficiently assess, identify, and remediate material risks that could affect business operations, financials, or public reputation. Our multi-layered approach to cybersecurity involves regular network monitoring, vulnerability scanning, advanced threat detection, and incident response capabilities against recognized cyber threats to our business and stakeholders, including ransomware, data breaches and insider threats. We regularly update our security measures, as necessary, to ensure we address all new threats and technologies, using the National Institute of Standards and Technology ("NIST") Framework as a guide, when appropriate and relevant to our business.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: As further protections, we utilize encryption, access control mechanisms and secure cloud infrastructures, and we invest in extensive user training. All users regularly undergo updated cybersecurity awareness training in an ongoing effort to reduce the risk of human error contributing to any potential security incidents. All users are also subject to simulated phishing emails with real time feedback for a more continuous layer of training.


text: We have retained an industry expert to be our virtual Information Security Officer ("vISO") to assist and guide our IT organization in maintaining and evolving a comprehensive and robust cyber security environment. Monthly meetings review all facets of our current status against appropriate NIST standards, review any incidents, and review the results of ongoing simulated phishing exercises to identify certain users who may need extended training. In addition, as part of our annual security review, we hire a third-party network penetration testing firm to provide simulated probing and subsequent reporting. We use the results of these annual tests to improve the strength and flexibility of our network's security.


text: Our Incident Response Plan ("IRP") has evolved with our cyber environment and consists of a set of state-of-the-art-tools capable of monitoring, reporting and alerting, as well as regular reviews. The IRP also sets forth guidelines on how to triage, assess the severity and materiality of findings, and remediate and escalate findings to upper management in a timely manner, as necessary. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. However, such insurance may not be sufficient to cover us against all possible claims related to security breaches, cyber-attacks and other related breaches. As of the date of this report, we have not identified cybersecurity threats that we believe are reasonably likely to materially affect us. However, cybersecurity risk is dynamic, and future incidents could materially affect our operations, financial condition, or reputation.


text: Cybersecurity Governance and Oversight The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any material incidents to upper management in a timely manner whenever they occur.


text: We have also formed a steering committee, composed of IT staff and relevant business leaders responsible for the Company's material information, including commercially sensitive data. The goals of this steering committee include overseeing our annual material risk assessment and documenting and reporting to senior management. The steering committee also reviews changes to procedural and other controls. We have also formed a risk register subcommittee to review and formally discuss any critical risks identified during our vISO annual assessment of our cyber environment.


text: Risk Management and Strategy The protection of our clients' data, our brand, and our systems is of utmost importance. We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security. We have implemented comprehensive cybersecurity and data privacy programs, fostering a culture of awareness across all employee groups and systems. In 2025, we achieved SOC2 Type 2 certification, reflecting our commitment to supporting our clients by aligning our controls and processes with the System and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA). This achievement builds on our previous SOC2 Type 1 certification and complements our ongoing TX Ramp compliance.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Our process to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third-party service providers, including cloud-based platforms. On an annual basis, we review the SOC2 (or equivalent) attestation of controls for material third-party service providers, coupled with monitoring industry notices and threat intelligence regarding potential vulnerabilities or threats targeting these third-party services.


text: We developed our cybersecurity program by integrating proactive training, vulnerability management, and system design with active threat defense mechanisms. Our marketplace services are protected by multiple layers of security including firewalls, endpoint protection, WAF and Bot mitigation. Our "defense in depth" approach to asset protection is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals. We maintain a formal incident response plan, which is regularly tested and updated to ensure prompt detection, reporting, and mitigation of cybersecurity incidents.


text: In addition, we undertake integrated planning activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including active Disaster Recovery production environment tests, tabletop exercises, continuous vulnerability tests, and annual penetration testing. We conduct company-wide mandatory cybersecurity training as well as periodic employee education exercises, such as phishing simulation email campaigns designed to emulate real-world attacks.


text: We view cybersecurity protection and data privacy as a shared responsibility in which all employees are active participants. Each employee undergoes annual cybersecurity training with supplemental training disseminated throughout the year. This continual education helps promote a culture that understands the critical role cybersecurity and data privacy play in protecting our clients' assets. Furthermore, our computing environments, products, and services are reviewed by our internal security team and our controls are tested regularly by independent third-party assessors as part of our annual SOC2 and SOX re-certifications.


text: Cybersecurity Governance Board and Committee Oversight. Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk identification, mitigation strategy and efforts, and resources and receives quarterly updates on cybersecurity risks and mitigation efforts from management, including our Chief Technology Officer (CTO). The Audit Committee of the Board of Directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules. We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employs dedicated resources to protect our systems.


text: Management's Role. Our internal security team in conjunction with the Chief Technology Officer (CTO) reviews current risks with a cross-functional leadership committee on a quarterly basis.


text: We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding cybersecurity risks, see the risk factor in Part I, Item 1A. Risk Factors captioned: "We are required to maintain the privacy and security of personal and business information amidst multiplying threat landscapes and in compliance with privacy and data protection regulations globally. Failure to do so could damage our business, including our reputation with sellers, buyers, and employees, cause us to incur substantial additional costs, and make us subject to litigation and regulatory action."


text: Risk Management and Strategy Ashland recognizes the importance of cybersecurity in safeguarding sensitive information and maintaining operational integrity. To that end, Ashland maintains an information security program as part of its overall Enterprise Risk Management ("ERM") program. The Company's information security program includes an incident response plan, which has been reviewed by third-party consultants and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0. The information security program, overseen by the Company's Vice President of Information Technology and Chief Information Officer, is designed to provide a framework for assessing, identifying, managing, mitigating and responding to cybersecurity threats and incidents and to facilitate cross-functional coordination within Ashland.

companyName: ASHLAND INC.

ticker: ASH


text: Ashland's information security program also includes policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies. This includes the use of a 24/7 Security Operations Center as well as an in-house, dedicated threat hunting team. Additional safeguards also include employee training and awareness programs around phishing, malware, and other cybersecurity risks. In addition, the Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems and regularly engages consultants and other expert third parties to assist the Company in the identification and assessment of risks.


text: Ashland maintains a similar risk-based approach to its third-party vendor management program including identifying and overseeing cybersecurity risks that such third parties may present. As part of this program, the Company, imposes additional scrutiny for vendors that may handle personally identifiable information data or trade secrets.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business, results of operations or financial condition. However, despite the Company's best efforts, it cannot eliminate all risks from cybersecurity threats or provide assurances that undetected cybersecurity incidents have not occurred. See the "Risk Factors" in Item 1A of this Annual Report on Form 10-K for further information.


text: Ashland's information security program is led by the Company's Cyber Security Director who has more than 25 years of experience in information technology and 5 years of experience serving in a deputy chief information security officer role or top executive leader in cyber. Our Cyber Security Director is primarily responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy. In addition, other members of the Company's information security team also have significant experience in information security.


text: As noted above, management of Ashland's cybersecurity risks is part of the Company's overall ERM program, which is overseen by the Board. The Board's Audit Committee has primary responsibility for the oversight of the Company's information and cybersecurity risks and the programs established to manage such risks. The Audit Committee fulfills this oversight responsibility through receiving regular (and as needed) reports and updates from the Company's Cyber Security Director and Ashland's Board also receives periodic reports updates from the Cyber Security Director and the Audit Committee regarding information and cybersecurity matters.


text: The Company maintains a risk-based cybersecurity program designed to protect the confidentiality, integrity, and availability of our networks and systems that we own or are in our care. Our program is aligned to U.S. National Institute for Standards and Technology (“NIST”) standards and other applicable industry frameworks. We document our compliance efforts with regulations and standards that govern our business, including the Sarbanes-Oxley Act, the Family Educational Rights and Privacy Act (“FERPA”), the Gramm-Leach-Bliley Act Safeguards Rule, and the Payment Card Industry Data Security Standard (“PCI-DSS”).

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: Our program is designed to identify, assess, and manage material risks from cybersecurity threats through practices that include: • required information security and privacy training supported by periodic phishing simulation exercises to reinforce awareness and enhance cybersecurity practices; • monitoring of network and system activity to detect unusual or suspicious behavior; • access management and access controls which aim to implement “least privilege” access; • multifactor authentication and encryption of sensitive data through “at rest” and “in transit” where feasible; • deployment of industry-standard security monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • business continuity and disaster recovery planning; and • a documented Incident Response Plan (“IRP”) that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents in coordination with our Legal and the Ethics, Compliance, and Data Privacy (“ECDP”) department.


text: The Company’s cybersecurity program is integrated within the Company’s enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks. The Company also engages third party experts to assist with compliance and maturity assessments and penetration testing, as appropriate.


text: The Company maintains arrangements with third party information infrastructure or IT vendors, including “cloud computing” vendors. All potential vendors are evaluated through the Company’s third-party due diligence process, which includes conducting cybersecurity risk assessments prior to integration into the Company’s networks and additional assessments prior to contract renewals or extensions. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.


text: To date, the Company’s business strategy, operating results, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior incidents. Our program is designed to identify, prevent, and mitigate cybersecurity events that would have a material adverse effect on the Company; however, the nature and sophistication of cybersecurity risks continue to evolve. No security framework, system, or control environment can fully eliminate the risk of a cyberattack or unauthorized access. Despite the Company’s safeguards to protect its systems, intellectual property, and confidential and personal information, vulnerabilities may persist that could be exploited by threat actors. See Item 1A, “Risk Factors—Risks Related to our Business.”


text: We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: The Company’s Chief Information Security Officer (“CISO”) is responsible for cybersecurity at the executive level and oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with and reports to the Chief Information Officer. Our CISO has over two decades of cybersecurity experience, including responsibilities in technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains relevant industry credentials.


text: The CISO also leads a cross-functional Incident Response Team (“IRT”) responsible for responding to and managing cybersecurity incidents in coordination with our Legal department and ECDP department. The IRT consists of professionals from various departments, including Information Technology and Security, Legal, ECDP, Finance, Public Relations, and other key business areas as needed. The IRP is tested annually via a tabletop exercise, focused on executive strategy and communication processes during an incident.


text: The Audit Committee of the Company’s Board of Directors is tasked with oversight of the Company’s cybersecurity, information and technology security and data privacy strategies and policies. The Chief Information Officer and/or CISO provide regular updates to the Audit Committee on cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries.


text: We are subject to various cybersecurity risks in connection with our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors, I. Risks Related to Our Business Operations and Industry of this Annual Report.

companyName: PTC INC.

ticker: PTC


text: We take a holistic, multi-layered approach to cybersecurity and privacy that combines traditional Defense-in-Depth methods with next-generation Zero Trust principles. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST") and the Software Assurance Maturity Model developed by the OWASP (the "OWASP SAMM"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II and FedRAMP, for certain of our products and services.


text: People. Recognizing that technology alone cannot mitigate all security threats, we focus on developing our most critical resource: our people. Our corporate cybersecurity awareness activities are combined with enterprise-wide and department-specific tools and mandatory employee training, providing our employees with knowledge and resources to support our efforts to mitigate security threats.


text: Process. We maintain processes and policies to try to anticipate security risks and facilitate compliance with applicable contractual obligations, regulations, and standards, as well as address any incidents or violations. We focus on continuous improvement and constantly mature our processes to keep pace with the rapidly evolving cybersecurity threat landscape.


text: Technology. We seek to automate processes and remove the potential for human error to the extent feasible by implementing technology solutions. From fundamental IT security to development of our software products and keeping our customers' data safe, we aim to maintain a secure infrastructure that is appropriately monitored for possible threats.


text: These three key elements of people, process, and technology are tightly interwoven to support our aim to secure our environments and the data for which we are a custodian.


text: Cybersecurity is a risk area with oversight at the highest levels of the organization, including the Executive and Board Level. The overall operational program is led by the Cybersecurity Strategy Council, a cross-functional team of executives and subject matter experts, led by our Chief Product Security Officer, Chief Information Security Officer and Chief Compliance Officer. The Cybersecurity Strategy Council oversees a "Three Lines Model" of Operations, Risk Monitoring and Oversight, and Audit, to effectively address cybersecurity, risk management, and control. All Cybersecurity, Risk, and Internal Audit functions report to the PTC Executive Leadership Team.


text: We provide regular updates on our cybersecurity strategic plans, programs, and initiatives to the Cybersecurity Committee of the Board of Directors at its four regularly scheduled meetings per year. Our Incident Response Plans provide for notice, and continued updates, to the Cybersecurity Committee of applicable incidents on a timely basis.


text: We conduct an annual cybersecurity maturity assessment. Periodically, we engage a third-party security consulting firm to conduct an Enterprise Security Maturity Assessment. This independent assessment provides a mechanism to benchmark our current risk profile and enables us to measure progress as we make program improvements. Identified cybersecurity risks are reviewed by the Cybersecurity Strategy Council, which ensures that risk tolerances are established and used to appropriately manage risks and address the risks identified.


text: Third-Party Vendor Risk Management Our Vendor Risk Management (VRM) program is designed to meet cybersecurity, privacy, regulatory and compliance obligations, by managing risk associated with third-party vendors who have access to PTC IT systems and data. Prior to outsourcing or allowing third-party access to PTC or customer systems, IP, or data; risks associated with such activity are identified and documented. The process of selecting a third-party vendor includes due diligence of the vendor service or product in question. Third-party companies using PTC facilities or accessing PTC's IT Systems are subject to PTC's VRM review and must demonstrate that proper security measures are in place before they have access to any PTC IT systems or data. All such vendors are to be approved by PTC's VRM process and contractually bound to maintain appropriate cybersecurity technical and organization measures and to protect PTC's data to which they may have access.


text: Incident Response We maintain an Enterprise Cybersecurity Incident Response Policy to address cybersecurity incidents. The Policy is tested on a periodic basis, including an ongoing improvement program involving periodic tabletop exercises. Cybersecurity incident handling is managed by individual organizations with cybersecurity responsibility and monitored/guided by applicable corporate functions. All Cybersecurity Incident Response Plans under the Policy are based on industry standards, such as the NIST Computer Security Incident Handling Guide – Special Publication 800-61.


text: Management's Role in Assessing and Managing Our Risks from Cybersecurity Threats Our Cybersecurity Program is overseen by executives on our Executive Leadership Team and managed by our Cybersecurity Strategy Council, including our Senior Vice President, Chief Information Security Officer (CISO), who reports to our Executive Vice President, Chief Digital and Information Officer (CDO). Our CISO is responsible for day-to-day risk management activities, including staying informed about and monitoring prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, and the use of technological tools and software. Our CDO is responsible for our broader IT program, which includes our ability to remediate and recover from a cybersecurity incident while reducing impacts to the business and operations. Our CDO and CISO regularly report directly to the Cybersecurity Committee of the Board of Directors on our Cybersecurity Program and efforts to prevent, detect, mitigate, and remediate issues. In addition, we have an escalation process in place to inform senior management and the Cybersecurity Committee and the Board of Directors of material issues.


text: Management Experience Our CDO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CDO joined PTC as Chief Digital and Information Officer in January 2022 and is responsible for PTC's global information technology (IT) team, overseeing PTC's digital infrastructure and working with business leaders to guide PTC's digital process optimization strategy. He has more than two decades of IT and operations leadership. Before joining PTC, he served as Global Vice President and Chief Information Officer for Avaya, where he led a globally-dispersed team of 1,200 IT professionals to support the entire global Avaya enterprise. Prior to Avaya, he held technology leadership roles at Arise Virtual Solutions Inc., Oracle, and Colorado College.


text: Our CISO joined PTC as Cyber Information Security Officer in April 2022 and, before joining PTC, was the Vice President, Information Technology, North America and Europe for Alorica, where he led Alorica's transformation to a secure endpoint architecture for 90,000 global remote and hybrid employees.


text: Risk Management and Strategy As noted in Part I, Item IA, Risk Factors, Cabot recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we have taken measures to protect Company data and the continuing operation of our information technology and communications systems. Our cybersecurity program includes information technology ("IT") policies and standards and an IT risk management program. Our cybersecurity risk management program leverages standards established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which provides guidance to organizations on how to identify, prevent, detect, respond and recover from cybersecurity threats.

companyName: CABOT CORP

ticker: CBT


text: Further, cybersecurity risk is integrated into our enterprise risk management ("ERM") approach and is among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. We use several tools and controls designed to manage IT risk, including, but not limited to, controls for the management of privileged access, anti-malware tools, simulated email phishing attacks, and other email security tools intended to detect and prevent intrusions as well as monitor risks. All Cabot employees participate in monitored cyber security training and have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. We have a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engage in response planning, simulations, trainings, tabletop exercises, and other efforts to prepare for any incidents should they occur.


text: We periodically engage assessors, consultants, auditors, and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. These assessments provide insight into areas of future improvement in risk mitigation and further program development. In addition, we rely on third parties for various business functions and oversee such third-party service providers by conducting vendor diligence upon onboarding as well as ongoing monitoring.


text: Governance and Oversight Management Oversight in Cybersecurity Governance Cabot's Cyber Risk Steering Committee is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Our Chief Digital Information Officer (the "CDIO") is the member of the Company's management principally responsible for overseeing the Company's cybersecurity risk management programs in partnership with business and functional leaders across the Company as well as a managed security service provider that provides threat intelligence, global infrastructure monitoring and threat detection and response to cyber events. The CDIO has held various positions within Cabot's IT department over his 20-year tenure with the Company, and contributes technical expertise to the Company's management team. The CDIO leverages extensive industry, IT and cybersecurity expertise to make strategic and operations decisions for Cabot's information security program. The CDIO collaborates with Cabot's Management Executive Committee to manage cyber risk and enhance the cyber program and reports directly to a member of our Management Executive Committee who has executive responsibility for Digital matters.


text: We have established a process to assess the nature, scope and timing of a cyber incident and, as appropriate, communicate the facts of an incident to management and the Board of Directors and, as appropriate, investors. In the event of a cybersecurity incident, the incident response team is responsible for notifying senior management in a timely manner, to the extent that the facts and circumstances of a particular incident warrant such notification. If it is determined that the event is material to the Company, the matter will be escalated to the Board. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations.


text: Board of Directors Oversight in Cybersecurity Governance Cabot's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which comprises independent directors. Company executives along with external and internal cybersecurity personnel update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic assessments of the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. Relevant matters are also reviewed with the full Board on at least an annual basis.


text: As of the date of this report, we have not experienced a cybersecurity incident that has resulted in a material effect on our business strategy, results of operations or financial condition. Despite our efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of the Company's or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm; damage to our brand; lost sales; physical damage to facilities; physical harm to individuals; reduced demand; loss of intellectual property rights; significant costs; or the Company being subject to government investigations, litigation, fines or damages. For additional information, see Part I, Item 1A, "Risk Factors—Operational Risks—Information technology systems failures, data security breaches, cybersecurity attacks or network disruptions have harmed us in the past and could compromise our information, disrupt our operations and expose us to liability, which may adversely impact our operations."


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company, including the CCO, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser. The Company also relies on the communications and systems of other third-party service providers.

companyName: PENNANTPARK INVESTMENT CORP

ticker: PNNT


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving as CCO since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care and is integrated into our overall enterprise risk management program.

companyName: Woodward, Inc.

ticker: WWD


text: We have established processes to evaluate and address cybersecurity risks on an ongoing basis. As part of our risk management program, we engage with external third parties to measure the effectiveness of our cybersecurity program through penetration tests, control assessments, tabletop exercises, and other related activities. Further, we have implemented a defense-in-depth strategy in which we utilize real-time 24/7 monitoring to identify anomalies, potential threats, and alerts. This cybersecurity strategy incorporates frameworks, policies, and practices designed to protect the privacy and security of our sensitive information, backed by a suite of security technologies and tools to implement and automate select security protections. We maintain cyber risk and related insurance policies as a measure of added protection.


text: We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. We periodically send "Test" phishing assessments to our members. Any failures trigger a retraining exercise. Also, we have specific and regular training for our IT and finance members, as well as our system administrators.


text: In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes, as applicable and appropriate based on risk profile and criticality, a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and/or Cybersecurity Maturity Model Certifications, as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this Form 10-K, including the risk factor entitled "Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions."


text: Cybersecurity Governance Our cybersecurity program is ultimately overseen by the Board of Directors (the "Board"). The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry, monitor various security tools deployed in the IT environment and review threat intelligence and other information from various public and private sources. The team has decades of experience with varied certifications and is led by our Chief Information Security Officer ("CISO"), who reports to our Vice President of IT, has over 18 years of experience as an IT professional and in cybersecurity, including experience leading cybersecurity programs protecting high value assets and critical infrastructure, including in high-risk locations. Our Vice President of IT has been a key leader in our IT group for more than 25 years, including the last seven in his current role leading our IT function. He plays an integral role in cybersecurity risk assessment and mitigation in all corporate acquisitions, and he participated in the development and implementation of our initial cybersecurity program more than 20 years ago.


text: Our CISO and Vice President of IT are primarily responsible for assessing and managing risks from cybersecurity threats to the Company. The CISO and Vice President of IT make regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. The senior management team, including the CISO and Vice President of IT, provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.


text: Cybersecurity risk may adversely impact our business. The impact could include weakened financial condition, litigation risk, degrading mining operations, loss of competitiveness, fraud, extortion, harm to employees, violation of applicable privacy or other regulations that could result in regulatory action and fines.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: Risk Management and Strategy We maintain a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.


text: We use third-party security vendors to further strengthen our cybersecurity posture. These partners provide advanced monitoring, detection, and response capabilities that complement our internal controls and staff expertise. Their services include continuous threat intelligence, vulnerability management, and incident response support, which are integrated into our cybersecurity program. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also key components of our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.


text: We have implemented a third-party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third-party vendors. As part of communicating the importance of cybersecurity at an enterprise-wide level, we require that all company employees participate in annual cybersecurity training.


text: Our IT Steering and Risk Committee ("ITSRC") has been delegated the responsibility for managing cybersecurity risk for the company by the Board of Directors (the "Board"). This committee is chaired by our Chief Technology Officer & Chief Operating Officer and includes a diverse cross section of company stakeholders including the CFO, Director of IT, SVP of Security, and our General Counsel. On May 1, 2025, we added an outsourced virtual CISO who is a key advisor to the ITSRC, bringing over a decade of expertise in managing and maturing cybersecurity program that includes mitigation, incident prevention, detection and remediation disciplines. The ITSRC is also responsible for maintaining and monitoring legal and regulatory requirements and compliance as well as oversight of the adequacy of company cyber insurance. Our third-party security vendors, in collaboration with our Director of IT, keep the ITSRC apprised of efforts surrounding the prevention, detection, mitigation and remediation of any cyber threats or cybersecurity incidents.


text: The Board is entrusted with the oversight of the management of cybersecurity risk and our cybersecurity program. The Board administers this oversight through its audit committee and the ITSRC. The ITSRC committee chair is responsible for reporting to the Board's audit committee with respect to cybersecurity at least twice per calendar year. The audit committee, as necessary, reports any findings and recommendations to the Board. As cyber threats evolve and as our cybersecurity program matures, the Board will consider further developing specific cybersecurity oversight functions and protocols. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM