text: The Audit Committee of our board of directors is charged with oversight of data privacy and cybersecurity risks. Our CISO provide annual updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full board of directors at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the board of directors on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CISO discusses and presents strategies to address technological changes, such as AI. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. Outside counsel advises the board of directors on best practices for cybersecurity oversight by the board of directors, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including those associated with the use of third-party services and service providers. This framework includes steps for assessing a cybersecurity threat's severity and source, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and threat mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. To prevent and detect material cybersecurity incidents, our framework further includes, among other things, ongoing security awareness training for employees, regular cybersecurity risk and vulnerability assessments, and mechanisms to detect and monitor unusual network activity. We recognize the complex and evolving nature of cybersecurity threats and engage with various third-party service providers, including cybersecurity assessors and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size. Additionally, we maintain industry-standard cybersecurity insurance to provide further protection against cybersecurity risk.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM

secItem: Item 1C


text: Our Board is ultimately responsible for overseeing our risk management, including cybersecurity risk management. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Financial Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to our independent Audit Committee and ultimately to our Board. There were no such cybersecurity incidents or threats that have materially impacted our business or operations. Management presents an assessment of our cybersecurity processes, procedures, and testing results to the Audit Committee at least annually.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats nor provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see discussion captioned "Our business could be negatively affected by security threats. A cyber-attack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation, and/or financial loss." in Item 1A. Risk Factors.


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Rezolute, Inc.

ticker: RZLT


text: We have engaged external parties, including risk management consultants and computer security firms, to enhance our cybersecurity oversight. In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.


text: Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we did not have any cybersecurity incidents in fiscal year 2025.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management and governance.

companyName: Research Solutions, Inc.

ticker: RSSS


text: We are committed to protecting the confidentiality and integrity of our data, as well as the data of our customers. The mission of our cybersecurity program is to protect the assets used to generate revenue and serve customers while complying with industry frameworks and best practices. Our cybersecurity program consists of cyber defense, governance and compliance, and risk management. Each area has tools, controls, and processes aligned with the National Institute of Standards and Technology Cyber Security Framework.


text: Managing cybersecurity risk and maintaining secure, reliable, and functional systems are among our highest priorities. Therefore, we have implemented tools, procedures, processes, and management mechanisms to help us achieve a robust cybersecurity environment, and a reliable cybersecurity posture.


text: We maintain an information security program comprised of policies and controls designed to reduce our cybersecurity attack surface and to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.


text: Risk Management and Strategy Our cyber defense practices prioritize protection against cyber threats. We have operationalized tools and processes designed to educate, assess, identify, address, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems. We routinely perform cybersecurity assessments, including with the assistance of external third parties, to identify, assess, and prioritize potential risks that could affect our information and data assets and infrastructure. Once identified, the mitigation of these risks is given our highest priority.


text: In addition, we use a threat intelligence platform to routinely monitor risks specific to both our organization and third parties. Risks we identify are assessed based on severity and are addressed as appropriate through both tactical and strategic plans. Our governance and compliance practice focuses on cybersecurity and data privacy policy taxonomy and policy compliance.


text: We have implemented a number of measures to enhance the security and resiliency of our information and data systems. These measures include, but are not limited to: (i) user access control management; (ii) intrusion detection and prevention systems; (iii) information security continuity measures, including redundant systems and information backups; (iv) system segmentation; (v) encryption of critical information and data; (vi) event logging; (vii) implementation of an application patching and update cadence; and (viii) incident response planning and least privilege access methodology.


text: Cybersecurity Governance Our board of directors delegates to the Audit Committee the oversight of our programs, policies, and procedures related to cybersecurity, information asset security, and data privacy and protection. Broad oversight is maintained by our full Board, which receives a report from the Audit Committee at least annually.


text: Our CTO oversees our cybersecurity matters and reports to both the Audit Committee and the Board at least once a year, or more frequently as needed. The Audit Committee reviews and discusses with Company management key processes and risk indicators, progress on plans to address key risks, and any material changes in threat landscapes or risk posture which could negatively affect our business.


text: Training and Awareness Our Company's employees are a critical part of our defense against potential cybersecurity incident exposure. All of our associates and contractors have a responsibility and a role to play by complying with our cybersecurity operational practices and reporting any potential cybersecurity incidents or exposures to our cybersecurity team.


text: To ensure that associates can play their part in protecting our networks and data from cybersecurity incident exposure, all of our associates receive cybersecurity training in the form of online modules on an annual basis, routine simulations to assess risk, and retraining where necessary.


text: Material Cybersecurity Risks, Threats & Incidents We are not aware of any cyber events that have had a material effect on our business. However, we cannot ensure that we will not experience any such event in the future. Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. In addition, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, results of operations and financial condition. See Item 1A. Risk Factors for further details on risks related to potential breaches of our information technology systems.


text: We are committed to securing and strengthening our information systems against cybersecurity threats and protecting the privacy and security of our customer, employee, and company data. However, as outlined in "Item 1A. Risk Factors — Risks Related to IT Systems, Cybersecurity and Data Privacy" of this Annual Report on Form 10-K, we are acutely aware that cybersecurity threats are a persistent concern in today's digital world. Despite our investments in securing our information systems, we understand that cybersecurity incidents can still occur, potentially causing material harm to our brand, business, operations, and financial condition. In light of this, we have developed a cybersecurity risk management program to identify, assess, monitor and manage cybersecurity risk.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our Board of Directors oversees cybersecurity risk as part of its risk management function and has delegated oversight of cybersecurity risk to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management and outside consultants regarding our information systems and procedures and overseeing our cybersecurity risk management processes.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks and is updated on any cybersecurity incidents as necessary. The Audit Committee reports on cybersecurity matters to the full Board on a regular basis. Additionally, the full Board regularly receives presentations from management and third-parties on cybersecurity topics as part of the Board's ongoing education on issues that affect public companies.


text: As a critical component of our cybersecurity risk management program, we have strategically integrated cybersecurity risk management into our broader enterprise risk management function to cultivate a company-wide culture of cybersecurity risk management. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). We use the NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. Additionally, given that we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards (PCI DSS) as part of our cybersecurity risk management program.


text: We place a high priority on cybersecurity within our organization. This includes regular cybersecurity training for employees, focusing on relevant risks to their job duties (e.g., social engineering, ransomware, denial of service, and other risks). As part of our cybersecurity risk management program, we conduct internal tests to identify potential vulnerabilities. Additionally, we organize annual tabletop exercises led by third-party consultants to enhance our readiness for different scenarios, assess our core information systems and cybersecurity practices, improve decision-making and prioritization, and promote monitoring and reporting across business functions.


text: We regularly engage third parties to perform cybersecurity audits to identify opportunities and enhancements to strengthen our policies and practices. We also annually engage an independent third party to perform internal and external penetration testing of our systems.


text: As part of our overall cybersecurity risk management program, the Company maintains cyber insurance coverage, and we periodically meet with our insurer to discuss emerging trends in cybersecurity. While we believe our cyber insurance coverage provides commercially reasonable levels of coverage, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: With respect to third-party service providers, our cybersecurity risk management program includes conducting due diligence of relevant service providers' information security programs prior to onboarding, reassessing vendors using a risk-based approach, and performing off-boarding activities as relevant. We also customarily require our financially significant third-party service providers and those third parties with access to sensitive data to promptly notify us of any actual or suspected breach impacting our data or operations. Additionally, we perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers.


text: We continuously monitor cybersecurity risks and adjust our cybersecurity risk management program and practices as needed. As part of our program, we occasionally identify risks or threats to our systems, including ransomware and attempts to obtain team member credentials through both phishing attacks or social engineering. While these risks and threats require active and ongoing efforts to mitigate, we have not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our operations, business strategy, or financial condition.


text: Our Chief Information Officer ("CIO") is directly responsible for the implementation of our cybersecurity risk management program, and our Senior Director of Information Security reports directly to the CIO. Our CIO is additionally primarily responsible for our overall information security, strategy, policy, security engineering, architecture, operations and cybersecurity threat detection and the management of cybersecurity risk. Our CIO has over 30 years of experience in the fields of finance, technology and cybersecurity, including relevant prior senior leadership positions held with Marriott International, where he served as Global Chief Information Officer. The CIO meets with our Chief Executive Officer ("CEO") on a weekly basis and regularly reports to our senior management, as well as directly to our Board of Directors and the Audit Committee, regarding our cybersecurity risk and risk management.


text: As a part of our cybersecurity risk management program, our cybersecurity team meets regularly to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. In the event of a cybersecurity incident, we have a Cyber Incident Response Plan ("CIRP") that governs our immediate response, including detection, escalation, assessment, management, and remediation. As part of the CIRP response, the cybersecurity team will coordinate with external advisors and other senior management as needed. The cybersecurity team routinely tests the CIRP across the organization to validate the procedures for appropriately escalating potentially material cybersecurity risks and incidents.


text: In the event of a cybersecurity incident, senior management, including our General Counsel, CIO, and Chief Financial Officer ("CFO"), are tasked with assessing the incident. This assessment involves evaluating relevant quantitative and qualitative factors as well as considering SEC guidance. Depending on the assessment results, the cybersecurity event may be escalated to involve our CEO, Board of Directors, and law enforcement. Additionally, the Board of Directors in consultation with senior management will decide, based on the assessment, whether the cybersecurity incident requires disclosure in a filing with the SEC.


text: Board of Directors Oversight Our board of directors, as a whole and through its committees, holds oversight responsibility for our risk management processes, including risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risk. The audit committee is comprised of board members with diverse expertise including risk management and technology, which we believe enables the board to oversee cybersecurity risks.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: Management's Role Our management is responsible for day-to-day administration and management of our cybersecurity program and for informing the audit committee of cybersecurity risks. We may also work with external security service providers to support our security monitoring and threat detection capabilities. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our information technology team overseen by the Executive Chairman. With over twenty-five years of technology development experience in the financial services industry, our Executive Chairman is familiar with our technology infrastructure and risk profile. Our information technology team tests our infrastructure for known cybersecurity risks and leads our employee training program on matters related to cybersecurity. The Executive Chairman and information technology team seek to implement and oversee processes for monitoring our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. If a potential breach is identified, it is raised to the attention of senior management to help mitigate any further vulnerabilities.


text: Cybersecurity Risk Management and Strategy The goal of our cybersecurity program is to establish processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, if needed, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct security testing and have established a vulnerability detection process, supported by security testing, that is designed to address the treatment of identified security risks based on severity. Our risk assessments include, but are not limited to: Interfaces Storage security Applications Hardware security Remote access security IT architecture Information flow Risks from Cybersecurity Threats Some potential cybersecurity threats include, but are not limited to:


text: Human errors or sabotage: Company employees or a third-party having access to the system could cause errors or allow for sabotage that may cause company losses. Our procedures seek to identify the risks that can be caused by human error or intent and includes processes to mitigate with a particular focus on training employees to avoid human errors.


text: Data leaks: Data leaks could result in a breach of our privacy policies for customers sensitive data, resulting in potential regulatory violations or commercial litigation. Our processes aim to restrict access and monitor for leaks of internal and/or external data.


text: Unauthorized access: Unauthorized access could be due to password theft, malware attacks, employee involvement, or hackers. Preventing unauthorized access is a top priority within our cybersecurity protocols.


text: Natural or man-made disasters: Data can be threatened by natural or human disasters. Lightning strikes, fire, floods, hurricanes, bombings, etc. Without proper data backup, all company data could be compromised in one incident. Backups, co-location of servers and data is regularly monitored and adjusted as needed with a goal of insulating the Company from this type of risk.


text: Failed system: Our cybersecurity policies contemplate enterprise system failures due to cyber-attacks, network connections, hardware challenges, bottleneck problems and other issues. We seek to mitigate these potential vulnerabilities through monitoring and redundancy.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see " Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, services, and data " in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company has cybersecurity risk management processes in place intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. Our cybersecurity risk management is integrated into the Company's enterprise risk management strategy. Our information technology security team works in partnership with internal auditors and external consultants in the identification, evaluation, and management of cybersecurity risks. We also have processes in place designed to evaluate potential risks associated with third-party service providers. Our cybersecurity program is aligned with the National Institute of Standards and Technology Cybersecurity Framework and includes an incident response plan. Additionally, we have business continuity and disaster recovery plans in place to prepare for any potential disruptions. With respect to our employees, we provide training for personnel regarding cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: FERRELLGAS PARTNERS FINANCE CORP


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information on cybersecurity-related risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our executive management team, including our Chief Executive Officer and Chief Financial Officer, works with our information technology security team to assess and manage our overall risk exposure. The Audit Committee of our Board of Directors oversees those efforts and receives reports from the executive management team periodically, as appropriate.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats and have implemented various processes and safeguards to aid in such efforts. Our program encompasses people, processes, and technologies to safeguard our systems, data, and business from cybersecurity threats. Our program prioritizes threat mitigation and risk management, while focusing on maintaining the integrity and resilience of our systems.

companyName: AUTOZONE INC

ticker: AZO


text: Our program is informed by industry standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), the American National Standards Institute encryption standards and the Payment Card Industry Data Security Standard, among others. As part of our cybersecurity strategy, we regularly engage independent, outside expertise to assess and benchmark our overall program against these industry standards.


text: AutoZone, with the assistance of our managed security service provider, continuously monitors our threat intelligence and events within our digital environments. We employ a variety of methods designed to test and improve our controls, including vulnerability scanning, penetration testing, and attack simulation testing. We have an incident response plan which sets forth procedures to investigate, respond to, contain, and remediate incidents with the support of a cross-functional team. The incident response plan also outlines a process for escalating and communicating incidents to members of management.


text: During the contract review and vendor engagement process, we assess vendors' adherence to appropriate security practices, requirements, and expectations, including compliance with industry standards and applicable laws and regulations. We also engage a third-party to monitor certain service providers so that we may be alerted of important events that would impact such party's risk profile. We have an Information Security Awareness program which seeks to educate our employees on security risks and best practices through training, internal communications, and security awareness campaigns. We maintain cybersecurity insurance coverage that may protect us from losses in connection with certain cybersecurity incidents.


text: Cybersecurity Risks While we have not experienced a material breach of our information systems or data to date, unauthorized parties have in the past gained access and exfiltrated data. Any future incident could significantly disrupt our operations and key business processes, result in the impairment, loss, unauthorized access of critical or sensitive data, be costly and resource-intensive to remedy; harm our reputation and relationship with customers, AutoZoners, vendors and other stakeholders; and have a material adverse impact on our business and operating results. See "Information Technology, Cybersecurity and Data Privacy Risks" in Item 1.A., Risk Factors for additional information related to cybersecurity risks.


text: The cybersecurity risk management program is integrated into our broader enterprise risk management framework, which allows our senior management team, with oversight from our Board, to develop a more holistic view of our risk exposure and prioritize and manage such risks accordingly.


text: AutoZone's Chief Information Security Officer ( CISO) reports directly to our Chief Information Officer and Senior Vice President of Information Technology. Our CISO has over 25 years' experience in IT, with over 20 years in dedicated Information Security leadership roles. He has experience across a broad range of industries and holds credentials including the Certified Information Systems Security Professional and the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.


text: The Audit Committee is responsible for overseeing the Company's enterprise risk management program, including cybersecurity risks. At its quarterly committee meetings, the Audit Committee reviews and discusses cybersecurity matters directly with our CISO, including relevant cybersecurity risks, changes to AutoZone's threat landscape, risk mitigation strategies, cybersecurity program assessments and results, and cybersecurity roadmap and progress.


text: Risk Management and Strategy In the ordinary course of our business, the Company is subject to cybersecurity threats and risks which it manages as an important component of its overall enterprise risk management strategy. To identify, assess, and manage cybersecurity threats and risks to our business, the Company has made significant investments in its processes, control environment, and technology solutions to help prevent and mitigate the impact of any such threats and risks. These processes include the use of sophisticated third-party software for continuous monitoring, the use of expert outside consultants, ongoing training and educational programs, regular and periodic updates on new cybersecurity threats and risks, incident response procedures, and the implementation of other cybersecurity best practices wherever possible. These processes also cover risks from cybersecurity threats associated with our use of information technology systems of third-parties upon which we rely.

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: The day-to-day management of the Company's cybersecurity framework is managed by the Company's information technology team while operational oversight of its design and function are managed by the Company's management team including, but not limited to, its Chief Operating Officer (COO), Chief Financial Officer (CFO), Vice President Implementation and Launch, and Director of Information Technology, all of whom have substantial experience managing enterprise risk, including cybersecurity risks. Our management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our incident response procedures.


text: The Company's Board of Directors, working in conjunction with its Audit and Corporate Governance Committees, oversees the Company's overall enterprise risk management program, including the evaluation of cybersecurity related risks. Our Board receives periodic updates from the Company's management team regarding technology matters including its cybersecurity framework, and the notification of any material cybersecurity events and/or risks.


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not impact the Company's business in a material manner. At the effective date of this report filing, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on risks related to the Company's information technology systems, including cybersecurity threats that may materially affect the Company's business, see the risk factors included under Item 1A of this Annual Report on Form 10-K ("We Rely Heavily on Information Technology Systems to Operate Our Business and Any Disruptions to or Data Breach of These Technology Systems or if These Systems were Made Unavailable for Use, May Have a Material Adverse Effect on Our Business").


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy and processes are designed to identify, assess, and manage risks to the confidentiality, integrity, and availability of our information technology environment, systems, and information. The cybersecurity risk management process is managed centrally and is led by our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer. Our cybersecurity program takes a risk-based approach and is integrated with our global enterprise risk management program. Our cybersecurity risk strategy is aligned with cyber/information security frameworks and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: TE Connectivity plc

ticker: TEL


text: Our cybersecurity program includes the following risk management practices: a formal cybersecurity risk assessment is performed annually in collaboration with our enterprise risk management function, resulting in updates to plans and actions that are incorporated into improvement projects;


text: our cybersecurity program maturity is benchmarked annually against global industry standards and norms. The result serves as a guide to identifying evolving risks, prioritizing improvements, and enhancing the program;


text: cybersecurity threats are evaluated throughout the year by our around-the-clock security operations center, utilizing a variety of third-party subscription and threat intelligence data sources, and data collected via internal monitoring and scanning processes;


text: annual security awareness trainings are required to be completed by employees, and monthly phishing campaigns and additional function-specific cybersecurity trainings are also conducted; security and risk metrics are reviewed monthly and reported to leadership regularly; external penetration tests are conducted annually by independent third parties and appropriate actions are taken to strengthen controls;


text: a cybersecurity incident response plan and governance charter are maintained by the cybersecurity incident response team. The cybersecurity incident response plan and supporting playbooks are utilized during table-top exercises and trainings. Participants may include information technology, business, corporate function, and external resources depending on the table-top scenario; and third-party supplier security reviews are conducted based on risk. Reviews may include the assessment of security architecture, connections between our systems and the third party, data security controls, and user access controls.


text: To date, we do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, the sophistication of cybersecurity threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity incidents and protect our systems and information may not successfully protect against future cybersecurity incidents, which could materially affect our business strategy, results of operations, or financial condition. For additional information on certain risks associated with cybersecurity, refer to the risk factors related to cybersecurity and information technology systems in "Part I, Item 1A. Risk Factors."


text: Cybersecurity Program Governance Our cybersecurity program is governed by the information security committee ("ISC"), composed of our leaders from information technology, enterprise risk, legal, compliance, strategy, human resources, finance, internal audit, and various business units. On a quarterly basis, the CISO reports to the ISC on topics such as risk mitigation project status, audit results, security metrics, cyber incidents investigated and impact, if any, and significant changes that contribute toward protecting the enterprise from cybersecurity threats.


text: Our CISO has over 20 years of experience in information security leadership roles and over 9 years as our CISO. He holds many industry certifications, including Certified Information Systems Security Professional ("CISSP"), and is an active member in professional organizations. Also, certain members of our board of directors have completed cybersecurity program trainings, or have relevant industry experience.


text: Cybersecurity incidents are evaluated by a cross-functional team based on defined criteria and regularly communicated to leadership pursuant to criteria set forth in our incident response plan and related processes. We have engaged cybersecurity and information technology third-party consultants to assist in cybersecurity incident response including forensics and technical analysis.


text: The cybersecurity committee of our board of directors has oversight responsibility for cybersecurity risks. The CISO provides updates at least twice a year to the cybersecurity committee regarding matters related to information technology and cybersecurity risks including the state of our cybersecurity programs, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risk. Additionally, the full board of directors receives updates on cybersecurity risks twice a year as part of the enterprise risk management meetings.


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: PURE CYCLE CORP

ticker: PCYO


text: We have engaged external parties, including risk management consultants and computer security firms, to enhance our cybersecurity oversight. In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.


text: Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had a material cybersecurity incidents in fiscal 2025 or 2026 through the date of filing of this Form 10-K.


text: Cybersecurity Risk Management and Strategy Our cybersecurity policies and processes are fully integrated into our Risk Management procedures and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is reinforced with our employees through education and periodic testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. Management also periodically briefs the Board of Directors on our strategy and roadmap in alignment with the NIST Cybersecurity Framework and we plan to continue providing the Board with regular updates regarding cybersecurity risks, threat landscape and overall program progress.

companyName: EACO CORP

ticker: EACO


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business, including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Part I, Item 1A. " Risk Factors," of this Annual Report.


text: Education and Awareness We provide required security awareness education and training to our employees and contractors with system access that focuses on various aspects of the cybersecurity world. Users of our internal systems are required to complete an annual cybersecurity awareness training and are tested for awareness on a regular basis. We also provide tailored training courses to functional technology employees and employees who process personal or sensitive information.


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors 24/7 to monitor and respond to security threats. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.


text: Data and Consumer Privacy Our data and consumer privacy program monitors, adapts to and works diligently to comply with changes in global privacy legislation. We have implemented technical, procedural and organizational measures designed to comply with applicable data protection and consumer privacy laws. We conduct external benchmarking, as well as privacy compliance audits, to stay abreast of developing privacy laws and understand developing risks, best practices and industry trends.


text: Third-Party Risk Management We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems. The Company has processes in place to oversee and manage these risks. We have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to our use of key third-party service providers.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, our cybersecurity program is led by the Director of Information Technology (" Director of IT "), who reports to the President and COO. Our Director of IT has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint and attends training in cybersecurity and risk mitigation.


text: We provide our Board of Directors with a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the President also will report to the Board of Directors on various metrics on threat management, incident response and recovery planning, along with industry benchmarks.


text: We are a smaller reporting company. While management monitors our exposure to cybersecurity risk, as a whole, CONX Corp. has not adopted specific processes for assessing and managing such risk. The audit committee is responsible to discuss with management any significant risks or exposures, and as necessary report such risks or exposures to our board of directors. While to date we have not encountered any cybersecurity incidents, any sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure could lead to corruption or misappropriation of proprietary information and sensitive or confidential data.

companyName: CONX Corp.


text: RED Technologies has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of RED Technologies' critical systems and information. RED Technologies' cybersecurity risk management program includes a cybersecurity incident response plan. RED Technologies designs and assesses its program based on ISO 27002 standards. This does not imply that RED Technologies meets any particular technical standards, specifications, or requirements, only that it uses the ISO 27002 as a guide to help it identify, assess, and manage cybersecurity risks relevant to its business. RED Technologies uses established processes designed to identify, assess, and manage third-party service provider risks when third parties handle, possess, process, and store RED Technologies' material information. RED Technologies' cybersecurity risk management program includes (i) a policy designed to help identify material cybersecurity risks to its critical systems, information, products, services, and its broader enterprise information technology environment and (ii) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. RED Technologies has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect RED Technologies, including its operations, business strategy, results of operations, or financial condition. However, there can be no assurance that RED Technologies' cybersecurity prevention and mitigation efforts will always be successful, and it is possible that cybersecurity threats could have a material adverse effect on our business, operations, or financial condition in the future.


text: As a smaller reporting company with cybersecurity processes centered on RED Technologies, we may not be sufficiently protected against such occurrences. See Item 1A. Risk Factors, " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss " of this Annual Report for a discussion of cybersecurity-related risks.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology (NIST) Cybersecurity framework and the Cybersecurity Maturity Model Certification (CMMC) program to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. In the event of an incident, we intend to follow our detailed incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with NIST and CMMC standards and industry best practices.


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors."


text: Cybersecurity Governance Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Senior Director of IT who has over 25 years of experience as an IT professional engaged in network cybersecurity. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.


text: Annual risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. Management regularly provides data protection and cybersecurity reports to the Audit Committee and the Board of Directors, which includes updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company in which cybersecurity is a critical component. Our Chief Information Officer and Information Security Officer are primarily responsible for the cybersecurity program. The Chief Information Officer reports directly to the CEO and the Information Security Officer reports directly to the Chief Risk Officer to maintain independence. Our Information Security Officer provides periodic reports to the Board Audit Committee, the Enterprise Risk Management Committee, Operational Risk Committee and Information Security Committee regarding the Cybersecurity/Information Security Program.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: We engage in regular monitoring and assessments of our technology infrastructure utilizing our internal staff and third-party specialist. Our independent auditors periodically review our processes, systems and controls related to our information security program to ensure they are operating effectively.


text: Measures Taken to Mitigate Cybersecurity Risks To mitigate the risk of cyber threats, we have implemented a comprehensive set of technical, organizational, and procedural safeguards that are designed utilizing the Cybersecurity Framework of the National Institute and Standards and Technology (U.S. Department of Commerce), industry standards and regulatory guidance that include the following:


text: Governance and Oversight: A dedicated Information Security Committee oversees our cybersecurity strategy, with executive leadership providing strategic direction. The Information Security Committee reports up to our Operational Risk Committee comprised of Executive Management and subsequently reports up to the Board Audit Committee.


text: Data Protection: We utilize advanced encryption and access controls to protect sensitive data both in transit and at rest. Regular audits are conducted to identify and address any vulnerabilities in our data storage and transmission practices.


text: Employee Training and Awareness: We conduct regular cybersecurity training and awareness programs for employees at all levels to ensure they understand and follow best practices in identifying and reporting potential cyber threats, including phishing attacks and social engineering tactics.


text: Third-Party Risk Management: We assess the cybersecurity practices of third-party vendors and partners, particularly those with access to sensitive information or critical systems and require them to adhere to security standards that align with our own policies.


text: Incident Response: We have a detailed Incident Response Plan that outlines how we would respond to an actual or potential cybersecurity incident. The plan includes the appropriate notification and escalation requirements including timely reporting to our CEO and Board of Directors and engagement of appropriate third parties such as insurance providers and incident response professionals.


text: Resilience and Recovery: We have developed and regularly test our business continuity and disaster recovery plans to ensure a swift recovery in the event of a cybersecurity incident. This includes regular backups, redundant systems, and an established communication protocol.


text: Ongoing Efforts and Improvements We continue to enhance our cybersecurity posture by investing in the latest technologies and partnering with leading cybersecurity experts. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats. Our Information Security Officer has extensive bank operations experience, has attained Certified Information Security Manager certification with the Information Systems Audit and Control Association, and attends relevant cybersecurity training sessions on a regular basis. Our CIO brings over 25 years of extensive experience in the banking industry, encompassing a diverse range of expertise, including software development, managed services and support, independent consulting, penetration testing, and bank management. This multifaceted background equips them with a unique perspective and deep understanding of both the technical and operational aspects of the financial sector. We remain committed to continually improving our cybersecurity infrastructure and to monitoring for new and evolving threats.


text: Risk Management and Strategy The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for the Board of Directors (the "Board"), through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework. The Cybersecurity Program is developed and reviewed by the Company's executive leadership alongside the Company's Audit Committee and carried out and overseen by the senior person in charge of IT at the Company, currently our Chief Compliance Officer ("CCO").

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board through its Audit Committee.


text: The Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We continuously monitor threats and unauthorized access to our information security network.


text: We have developed incident response plans by using the information gained through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. Such plans set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.


text: We review our cybersecurity risk framework and related policies annually with our senior management to help identify areas for continued focus and improvement. We also engage third parties to review and assess our processes annually.


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. discussing issues to be addressed and recommending securities measures to be improved where possible. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: Although in the last three fiscal years we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including financial losses, penalties, and settlements, were immaterial, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, may materially affect or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled " Quipt's business depends on its information systems, including software licensed from or hosted by third parties, and any failure or significant disruption or effective cyber-attack on any of these systems, security breaches or improper disclosure of or loss of data could materially affect our business, results of operations and financial condition. " and " Quipt currently outsources, and from time to time in the future may outsource, a portion of its internal business functions to third-party providers, which has significant risks, and Quipt's failure to manage these risks successfully could materially adversely affect its business, results of operations, and financial condition." in Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: Role of the Board of Directors and the Audit Committee As part of the Board's role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Role of Management Our CCO is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CCO works to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: In the event of a material cybersecurity incident or investigation, management will, in compliance with escalation protocols in place, promptly report to the Audit Committee and the Board, as appropriate, in accordance with the Company's incident response plan, and other policies and determine the timing of action, and necessary response.


text: Our CCO has over 20 years of experience in various roles in information technology and information security. He holds a degree in Legal Studies and holds several relevant certifications, including Certified HIPAA Professional ("CHP").


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that generally aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage these material risks, safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners, and employees.

companyName: Energy Services of America CORP

ticker: ESOA


text: Risk Management and Strategy The Board of Directors is actively involved in oversight of the Company's risk management framework. The Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity awareness. This integration ensures cybersecurity considerations are an integral part of decision-making processes across the organization.


text: The Company's risk management team collaborates closely with its internal IT team to evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures to ensure the prompt escalation of cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive timely and appropriate information.


text: Given the complexity and evolving nature of cybersecurity threats, the Company engages external experts, such as cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. These engagements include audits, threat assessments, and consultations on security enhancements. Such collaboration ensures the Company leverages specialized knowledge to maintain cybersecurity practices aligned with industry standards. Utilizes advanced technology solutions, such as proactive detection tools, to safeguard its assets and identify threats within its environment.


text: Conducts cyber education and awareness training sessions to equip employees with the necessary knowledge and foster a strong security culture. Analyzes internal and external cybersecurity incidents and threat intelligence to assess relevance to its environment and industry. Performs recovery testing to ensure the resilience of critical systems and support business continuity.


text: Implements stringent oversight of third-party service providers, including conducting security reviews before engagement and ongoing monitoring to ensure compliance with the Company's cybersecurity standards.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. As discussed below, members of management advise the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.


text: The Board of Directors and the Audit Committee receive briefings from the Company's Chief Information Officer (" CIO "), Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and recommendations from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity. The Board conducts an annual review of the Company's cybersecurity posture and risk management strategies to identify areas for improvement and maintain alignment with the Company's overall risk management framework.


text: The Company's CIO has over 20 years of experience in the field of technology and security and is instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies. The internal IT team is responsible for the day-to-day implementation of the Company's cybersecurity risk management programs, testing compliance with standards, remediating known risks, and leading employee training programs. The team monitors the latest developments in cybersecurity, including potential threats and risk management techniques, to help prevent, detect, and mitigate cybersecurity incidents.


text: In the event of a cybersecurity incident, the IT team implements the Company's incident response plan to mitigate immediate impacts, implement remediation strategies, and prevent future incidents. The team also ensures that senior management is regularly informed about material cybersecurity risks and incidents to maintain alignment with organizational priorities.


text: As of September 30, 2025, the Company has not encountered cybersecurity incidents that the Company believes to have materially affected or are reasonably likely to materially affect the Company taken as a whole, including its business strategy, results of operations or financial condition.


text: Cybersecurity is an integral part of our overall risk management efforts and is integrated with John Deere's overall risk management framework. We take a comprehensive approach by incorporating industry best practices to guide and evaluate our cybersecurity strategy and posture, involving key stakeholders in oversight and decision making, and assessing the program regularly within a dynamically changing environment. We leverage a multifaceted approach to cybersecurity including measures designed to prevent, detect, and respond to cyberthreats while monitoring and adapting to the evolving threat and technology landscapes.

companyName: DEERE JOHN CAPITAL CORP


text: At the management level, John Deere and we jointly maintain a dedicated global team of cybersecurity professionals (Cybersecurity Team) led and managed by John Deere's Chief Information Security Officer (CISO). The Cybersecurity Team is responsible for overseeing John Deere's and our cybersecurity program, including the assessment and management of risks. The Cybersecurity Team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing, and cyber incident management. John Deere's CISO holds a degree in Management Information Systems and has been with John Deere for over ten years. He has over two decades of extensive experience in information technology and cybersecurity and reports directly to John Deere's Chief Information Officer.


text: In addition, a cross-functional team of senior executives from across the John Deere enterprise known as the Digital Risk Governance Council (DRGC) provides oversight at the management level of our and John Deere's structures for managing digital risk, including the Cybersecurity Team. The Audit Review Committee (ARC) of the Deere & Company Board of Directors (Board) shares oversight responsibilities of our cybersecurity program, including oversight of related risks, with the full Board. Information on trends, strategic initiatives, and metrics is presented quarterly to the ARC by the CISO and/or members of the Cybersecurity Team. The ARC also receives periodic updates and information from subject matter experts in areas such as risk management, identity and access management, product security, and information technology.


text: Risk Management and Strategy Our and John Deere's cybersecurity program is designed to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents with the goal of protecting the confidentiality, integrity, and availability of our critical systems and information. We use a risk-based, multi-layered information security strategy to assess, identify, and manage risks from cybersecurity threats. The Cybersecurity Team meets frequently to monitor, assess, and address cybersecurity threats and incidents. John Deere and we also work with third parties to assess the maturity of our cybersecurity program, leveraging the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).


text: We also utilize third-party service providers as a normal part of our business operations. We have established processes to support us in identifying and managing cybersecurity risks associated with the use of third parties, which include the completion of due diligence before engaging with a third-party, controls for response to mitigate any significant risks, and assessments and reviews throughout the relationship. Monitoring such risks and threats is integrated into our overall risk management program.


text: Also, as part of the program, we periodically conduct cybersecurity awareness training including phishing simulations as well as e-learning for employees. We maintain cybersecurity policies, standards, and procedures, which include a cyber incident response plan. These policies and procedures are regularly evaluated and refined with strategies and protocols designed to adapt to changing regulations and emerging security risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities and improve decision-making, prioritization, monitoring, and overall response effectiveness. As part of our incident response plan, the Cybersecurity Team uses an established protocol to assess the severity of cybersecurity incidents. In addition, a cross-functional Cybersecurity Incident Response Team is responsible for cybersecurity incident oversight and response, as needed, depending on incident severity. Our cyber incident response plan also includes an escalation process to relevant senior management and/or members of the Board if a cybersecurity incident meets specific rating criteria to prompt response to attempt to minimize potential disruptions and protect the integrity of our operations.


text: Based on the information available as of the date of this Annual Report on Form 10-K, cybersecurity risks, including as a result of any previous cybersecurity incident, have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we have seen an increase in cyberattack volume, frequency, and sophistication in the digital environment and future incidents could have a material impact on our business, operations, or financial condition.


text: Cybersecurity Risk Management and Strategy The Company regards information and data as valuable assets. As a result, we have implemented safeguards to protect corporate informational and data assets. Associated and established technology resources maintain the integrity, availability, and privacy of confidential information of the respective assets. Additionally, we maintain a similar risk-based approach to our third-party vendors including identifying and overseeing cybersecurity risks they present.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Integration into Overall Risk Management System The Company employs comprehensive methodologies for risk assessment and diligently identifies and evaluates potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks.


text: The Company continues to expand investments in information technology security, including continuous end-user training, layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting.


text: The Company's Information Technology Technician (the "IT Technician") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.


text: The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network or ransomware. Cybersecurity threats that are identified and deemed material are escalated and communicated directly to the board of directors, in collaboration with relevant information technology personnel, insurance providers, legal counsel and, when necessary, external cybersecurity firms specializing in forensic investigations.


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Training sessions are held regularly at the senior and executive management levels to validate roles and responsibilities, and response protocols respective to cybersecurity threats.


text: Third-Party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor and its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended September 30, 2025. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.


text: Cybersecurity Governance The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has oversight responsibilities to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.


text: Board of Directors Oversight The board of directors is responsible for the oversight of cybersecurity risk management and is composed of members with expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.


text: Management's Role in Managing Risk The IT Technician plays a pivotal role in informing the board of directors on cybersecurity risks. The IT Technician and members of senior management meet regularly and provide comprehensive briefings to the board of directors. These briefings encompass a broad range of topics, including: the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies;


text: incident reports and issued identified from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our regularly scheduled board meetings, the IT Technician regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the board, ensures the board's oversight is proactive and responsive. The board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Cyber Risk Management Personnel The IT Technician directly reports to senior management. The IT Technician regularly meets with senior management to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the board of directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with senior management, supported by the Company's IT Technician. The IT Technician, who has prior experience in the banking industry, works with senior management to implement and maintain processes designed to protect the Company's information systems and data. This collaborative approach helps ensure that our cybersecurity strategies are aligned with the Company's overall risk management framework.


text: Monitoring Cybersecurity Incidents The IT Technician and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Technician provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.


text: We are a special purpose acquisition company with no business operations and therefore, prior to the completion of a business combination, do not have any operations of our own that face cybersecurity threats. Since our initial public offering, our sole business activity has been identifying and evaluating suitable targets for a business combination. Therefore, the Company does not consider itself subject to significant cybersecurity risk and has not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing the Company's risk management activities in general and will be informed, promptly and as deemed necessary by our management team, of any cybersecurity threats or risks that may arise, cyber incidents and industry trends, including regarding the appropriate disclosure, mitigation, or other response or actions that our board deems appropriate to take. As of the date of this Report, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy and results of operations. However, any such attack could adversely affect our business. We depend on the digital technologies of third parties and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. A penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss. " in " Item 1A. Risk Factors—General Risk Factors. "

companyName: Rithm Acquisition Corp.

ticker: RAC


text: Risk management and strategy We depend on the functioning, availability and security of our information systems, including financial, data processing, communications and operating systems. Several information systems, such as software applications and cloud platforms, are provided by third parties. Our cybersecurirty risk framework is designed to allow us to identify, assess and manage the cybersecurity risks we face in relation to, our systems and the information we process.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the board as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant enviornements. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Executive VP and Chief Financial Officer evaluates material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who has more than two decades of information technology and information technology leadership experience. Our Director of Information Technology, under the supervision of our Executive VP and Chief Financial Officer, manages and monitors our cybersecurity risk (including that presented by our information technology service providers). Our Director of Information Technology is responsible for informing our Executive VP and Chief Financial Officer of relevant cybersecurity risks including, as relevant, the prevent, detection, mitigation and remediation of cybersecurity incidents. Our Executive VP and Chief Financial Officer has over two decades of management experience, including oversight over information technology and cybersecurity matters.


text: Our Board of Directors, with the assistance of the Audit Committee, has oversight for the cybersecurity risks facing us and for our processes designed to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures (including, as relevant, those stemming from certain cybersecurity incidents) from our Executive VP and Chief Financial Officer.


text: The Company operates in blockchain and digital asset technology sector and the biotechnology sector, which are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including the loss or theft of private keys or breaches of our digital wallets; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We conduct periodic risk assessments using various tools and methodologies to identify and manage the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests, and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: BNB PLUS CORP.

ticker: BNBX


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.


text: Our Chief Executive Officer ( "CEO") conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third party providers. All employees and consultants are directed to report to senior management with any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards. These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: INNOVATIVE SOLUTIONS & SUPPORT INC

ticker: ISSC


text: Management reviews the Company's IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; and (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and its other assets or assets of its customers or other third parties in the Company's possession or custody.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected it or are reasonably likely to materially affect it, including its operations, business strategy, results of operations, or financial condition.


text: The Company 's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.