text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM

secItem: Item 1C


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

stage1Category: Strategy Integration

stage1Method: unanimous


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Horizen Trust (ZEN)

ticker: HZEN


text: Security Policy and Requirements We have an Information Security Policy that details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources, including third parties we engage.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by, and incorporates, elements of recognized industry standards. We leverage the support of third-party information technology and security providers, including for cybersecurity audits and risk assessments. We implement technical controls, such as multi-factor authentication and we deploy cybersecurity tools through a leading third-party cybersecurity firm to protect our systems from cybersecurity related risks. We have an enterprise risk management program and we maintain written information security policies, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents. We test this incident response plan on an annual basis. Finally, we have implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see Item 1A - Risk Factors.

companyName: Cerence Inc.

ticker: CRNC

stage1Category: Risk Management Process


text: Governance Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee. Led by our Chief Information Security Officer ("CISO"), the Information Security Management Committee is made up of cross-functional members of company management and works closely with our third-party information technology and security providers to develop and implement our cybersecurity strategy. Our CISO is responsible for the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has over 20 years of experience in information security. Our audit committee has oversight over cybersecurity risks. The audit committee reviews the enterprise risk management program quarterly, which includes the cybersecurity risk management program and any identified cybersecurity risks. With the input of the Information Security Management Committee and our information technology providers, the CISO regularly reports to the audit committee on our cybersecurity risk management process, including updates related to security testing, assessments, cyber risk and related cyber strategy, as applicable. In addition, the CISO makes annual cybersecurity reports to our board of directors.

stage1Category: Management Role


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.

stage1Method: majority


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

stage1Category: Board Governance


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for two years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for two years, serving as CCO since May 2023 and has worked in the financial services industry for more than 27 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser. The Company also relies on the communications and systems of other third-party service providers.

companyName: PENNANTPARK INVESTMENT CORP

ticker: PNNT


text: Management of the Company, including the CCO, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity risk management program based upon the National Institute of Standards and Technology Cybersecurity framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care, and is integrated into our overall enterprise risk management program.

companyName: Woodward, Inc.

ticker: WWD


text: We have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements. We gather information and review security protocols of certain third parties who integrate with our systems, such as our payroll processor, managed solutions provider, and software as a service provider, on an annual basis to identify and manage risk. We regularly seek to improve and mature our cybersecurity processes. We apply lessons learned from our efforts to help prevent attacks and utilize data analytics to detect anomalies and search for cyber threats.

companyName: Salamander Innisbrook, LLC


text: We have established processes to evaluate and address cybersecurity risks on an ongoing basis. As part of our risk management program, we engage with external third parties to measure the effectiveness of our cybersecurity program through penetration tests, control assessments, tabletop exercises, and other related activities. Further, we have implemented a defense-in-depth strategy in which we utilize real-time 24/7 monitoring to identify anomalies, potential threats, and alerts. This cybersecurity strategy incorporates frameworks, policies, and practices designed to protect the privacy and security of our sensitive information, backed by a suite of security technologies and tools to implement and automate select security protections. We maintain cyber risk and related insurance policies as a measure of added protection.


text: We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. "Test" phishing assessments are periodically sent to our members. Any failures trigger a retraining exercise if not properly reported. Also, we have specific and regular training for our IT and finance members, as well as our system administrators.


text: In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and Cybersecurity Maturity Model Certifications ("CMMC"), as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments.

stage1Category: Third-Party Risk


text: We are not aware of having experienced risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain potentially vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions."


text: Cybersecurity Governance Our cybersecurity program is ultimately overseen by the Board of Directors. The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry. The team has decades of experience with varied certifications and is led by our Chief Information Officer ("CISO"), who has over 17 years of experience as an IT professional and in cybersecurity and reports to our Vice President of IT. The CISO makes regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. Management provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.


text: Risk Management and Strategy We have dedicated to advance our cybersecurity risk management and integrated it into our overall risk management program, which program manages cybersecurity, financial, operational and compliance risks. To access, identify and manage cybersecurity threats, we implemented a cybersecurity risk management program with oversight by our Board of Directors ("Board"). Our management, led by an experienced information security team, continually monitors cybersecurity risk incidents.

companyName: SemiLEDs Corp

ticker: LEDS


text: Our cybersecurity risk management program sets forth a framework provided by our information security team to identify and mitigate vulnerabilities and risks in our information systems. Elements of the program include, among the other things, penetration tests on our networks and engaging in annual employee cybersecurity training.


text: We have engaged a third-party service provider periodically to review and improve our cybersecurity risk management framework, including by identifying third-parties information systems that could cause cybersecurity incidents to our business.


text: Our information security team, including our system engineering department leader who manages our information technology, is responsible for accessing and managing cybersecurity operations and incident response, reports cybersecurity incidents to management and, if the incidents are material, our audit committee. The members of our information security team each have over 10 years of experience and extensive knowledge in managing cybersecurity programs.


text: We have continued to invest in an evolving state-of-the-art cybersecurity framework of tools, processes, training, and people designed to efficiently assess, identify, and remediate material risks that could affect business operations, financials, or public reputation. Our multi-layered approach to cybersecurity involves regular network monitoring, vulnerability scanning, advanced threat detection, and incident response capabilities against recognized cyber threats to our business and stakeholders, including ransomware, data breaches and insider threats. We regularly update our security measures, as necessary, to ensure we address all new threats and technologies, using the National Institute of Standards and Technology ("NIST") Framework as a guide, when appropriate and relevant to our business.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: As further protections, we utilize encryption, access control mechanisms and secure cloud infrastructures, and we invest in extensive user training. All users regularly undergo updated cybersecurity awareness training in an ongoing effort to reduce the risk of human error contributing to any potential security incidents. All users are also subject to simulated phishing emails with real time feedback for a more continuous layer of training.


text: We have retained a seasoned virtual Information Security Officer ("vISO") to assist and guide our IT organization in maintaining and evolving a comprehensive and robust cyber security environment. Monthly meetings review all facets of our current status against appropriate NIST standards, review any incidents, and review the results of ongoing simulated phishing exercises to identify certain users who may need extended training. In addition, as part of our annual security review, we hire a third-party network penetration testing firm to provide simulated probing and subsequent reporting. We use the results of these annual tests to improve the strength and flexibility of our network's security.


text: Our Incident Response Plan ("IRP") has evolved with our cyber environment and consists of a set of state-of-the-art-tools capable of monitoring, reporting and alerting, as well as regular reviews. The IRP also sets forth guidelines on how to triage, assess the severity and materiality of findings, and remediate and escalate findings to upper management in a timely manner, as necessary. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. However, such insurance may not be sufficient to cover us against all possible claims related to security breaches, cyber-attacks and other related breaches. Our current environment contains no known risks from cybersecurity threats that could materially impact our business operations, financials, or public reputation.


text: Cybersecurity Governance and Oversight The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any necessary incidents to upper management in a timely manner whenever they occur.


text: We have also formed a steering committee, composed of IT staff and relevant business leaders responsible for the Company's material information, including commercially sensitive data. The goals of this steering committee include overseeing our annual material risk assessment and documenting and reporting to senior management. The steering committee also reviews changes to procedural and other controls. We have also formed a risk register subcommittee to review and formally discuss any critical risks identified during our vISO annual assessment of our cyber environment.


text: Cybersecurity Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents. Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards of Technology ("NIST") Cybersecurity Framework. Our program is comprehensive in scope and covers all of our general corporate Information Technology ("IT") systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers. Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives. Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: Our cybersecurity risk management program includes an incident response plan ("IRP"). Our IRP provides us with a plan for identifying, responding to, reporting and remediating cybersecurity incidents. Our IRP has been established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. Our Information Services Breach Response Team ("ISBRT") takes a central role in developing and maintaining our incident response framework in coordination with our Cybersecurity Response Team ("CRT") that is dedicated to proactively addressing and managing potential breaches and incidents to ensure that our cybersecurity defenses are well designed and managed. Our Incident Management Team ("IMT") handles the response process for all cybersecurity incidents.


text: Our cybersecurity risk management program and strategy also includes: • a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information protection and broader enterprise IT environment; • the use of reputable cybersecurity consultants and other experienced third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so we can maintain a posture of continual enhancement of our cybersecurity risk management program and strategy; • continuous and updated cybersecurity awareness training for our employees, incident response personnel and senior management; and • a risk management process for critical third-party service providers and vendors that includes due diligence in the selection of third-parties and vendors and the periodic monitoring thereof to ensure that they adhere to applicable cybersecurity standards.


text: Cybersecurity Governance Our Board of Supervisors is responsible for overseeing our enterprise risk relative to cybersecurity governance through the Audit Committee of the Board, with specific responsibility for overseeing cybersecurity threats, among other things. Our CRT is led by the Senior Vice President of Information Services ("SVP, Information Services"), who reports to the Partnership's CEO and is responsible for assessing and managing material cybersecurity risks and threats, in coordination with the ISBRT and the IMT, and regularly reports to the Audit Committee with regard to the Partnership's cybersecurity governance efforts. The SVP, Information Services has served in this role since 2014, and has more than 27 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance.


text: The ISBRT, CRT, IMT and the Audit Committee of the Board all play a role in the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents through their management and oversight of, and participation in, the cybersecurity risk management and strategy processes described above. As of the date of this Annual Report, we are not aware of any risks of, or actual, cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in the section entitled "Item 1A. Risk Factors" in this Annual Report.


text: We have implemented and maintain a robust cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Leslie's, Inc.

ticker: LESL


text: Our board of directors, with assistance from the audit committee, oversees the Company's management of risks arising from cybersecurity threats. The audit committee regularly reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the audit committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including certain IT leadership and our legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The audit committee also reports to the board of directors at least annually on cybersecurity matters.


text: We have an incident response plan under which certain cybersecurity incidents are escalated within the Company to senior executives on the cybersecurity risk management committee, and, where appropriate, reported to the Board and Audit Committee in a timely manner. At the management level, our cybersecurity risk management committee, comprised of senior executives representing functional and business areas, including our legal team, has broad oversight of the Company's risk management processes. Members of the Company's cybersecurity risk management committee includes certain IT leadership and the General Counsel. The committee meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cyber security risks. Certain IT leadership and the General Counsel attend each cybersecurity risk management committee meeting to report on ongoing cybersecurity matters. Our IT leadership also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: Our Vice President of Security and Compliance, who has cybersecurity knowledge and skills gained from work experience at the Company, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The cybersecurity team receives reports on cybersecurity threats from a number of experienced information security team members responsible for various parts of the business periodically and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Management's Role. Our Internal security team in conjunction with the Chief Technology Officer (CTO) reviews current risks with a cross-functional leadership committee on a quarterly basis.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly conduct penetration and vulnerability testing, security audits, and tabletop exercises. We conduct regular employee training on cybersecurity. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer that otherwise implicates third-party technology and systems we use. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cyber incidents. We consider cybersecurity threats, along with other significant risks that we face within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that if realized, are reasonably likely to materially affect us.


text: Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report.

stage1Category: None/Other


text: Cybersecurity risk may adversely impact our business. The impact could include weakened financial condition, litigation risk, degrading mining operations, loss of competitiveness, fraud, extortion, harm to employees, violation of applicable privacy or other regulations that could result in regulatory action and fines.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: We have developed and implemented a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.


text: We use third party providers to help us consistently monitor and evaluate our cybersecurity program and performance through actions that include hiring a contract Chief Information Security Officer ("CISO") with decades of cybersecurity experience to help manage our program. We also use industry standard technology tools including vulnerability scans, penetration tests, firewalls, endpoint detection and threat intelligence. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also important pillars in our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.


text: We have implemented a third party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third party vendors. As part of communicating the importance of cybersecurity at an enterprise wide level, we require that all company employees participate in annual cybersecurity training.


text: Our IT Steering and Risk Committee ("ITSRC") has been delegated the responsibility for managing cybersecurity risk for the company. This committee is chaired by our Chief Technology Officer and includes a diverse cross section of company stakeholders including the Senior IT Manager, General Counsel, VP of Organizational Development and a member of our Third Party Audit team. As of July 1, 2024, we added an outsourced virtual CISO who is a key advisor to the ITSRC, specifically for his decades of expertise in managing and maturing a cybersecurity program that includes mitigation, incident prevention, detection and remediation disciplines. The ITSRC meets at least semi-annually to assess our approach to evolving cybersecurity threats and its impact on our cybersecurity program. The ITSRC is also responsible for maintaining and monitoring legal and regulatory requirements and compliance as well as oversight of the adequacy of company cyber insurance. Our third party security vendors, in collaboration with our Senior IT Manager, keep the ITSRC apprised of efforts surrounding the prevention, detection, mitigation and remediation of any cyber threats or cybersecurity incidents.


text: Cyber partners are a key part of SLB's cybersecurity infrastructure. SLB partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. SLB engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in SLB's environment as well as, if necessary, assist in responding to cyber attacks.

companyName: SLB LIMITED/NV

ticker: SLB


text: The Board of Directors (the "Board") is entrusted with the oversight of the management of cybersecurity risk and our cybersecurity program. The Board administers this oversight through its audit committee and the ITSRC. The ITSRC committee chair is responsible for reporting to the Board's audit committee with respect to cybersecurity at least twice per calendar year. The audit committee, as necessary, reports any findings and recommendations to the Board. As cyber threats evolve and as our cybersecurity program matures, the Board will consider further developing specific cybersecurity oversight functions and protocols. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: Risk Management and Strategy We have implemented a comprehensive information security program to assess, identify, and manage material risks from cybersecurity threats. This program includes policies and procedures that guide the development, implementation, and maintenance of security measures and controls. We utilize industry-standard metrics to evaluate the criticality of software, data assets, and operational technology. Our cybersecurity efforts align with the Center for Internet Security (CIS) Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, with annual assessments to ensure compliance.

companyName: STAR GROUP, L.P.

ticker: SGU


text: Given our reliance on third-party software, service providers, and applications to support various business functions and security measures, we regularly conduct security audits and vendor management reviews. These processes are intended to ensure that third-party systems and services comply with our cybersecurity program.


text: Periodic cyber risk assessments of our operational technology network help us identify risks, which we address using risk-based analysis and judgment. We also conduct internal and external testing of software, hardware, and defensive systems in our efforts to uncover potential vulnerabilities. Third-party security firms are employed for certain controls and technology operations, including vulnerability scans and penetration testing. Our approach to managing third-party cybersecurity threats includes pre-acquisition due diligence, contractual obligations, and ongoing performance monitoring.


text: We employ governance, risk, and compliance (GRC) tools to manage cybersecurity risks and maintain business continuity and disaster recovery plans to prepare for potential disruptions. Our employees receive cybersecurity awareness training upon hiring, with additional training provided on a regular basis.


text: The Vice President of Information Technology (IT) and the Director of IT Security are responsible for overseeing our cybersecurity risk management program. This includes managing internal cybersecurity staff, consulting with external cybersecurity experts, and staying informed through governmental and private sources. They report regularly to executive management on cybersecurity threats, resources, and program updates.


text: Cybersecurity risk management is integrated into our overall risk management processes. The program monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of IT presents updates on IT projects, including cybersecurity policies and programs, to executive management at least quarterly.


text: The Board of Directors has overall oversight of key risks, with strategic oversight of cybersecurity risk management delegated to the Audit Committee. Annually, the Audit Committee reviews the Company's enterprise risk management, which includes cybersecurity. In fiscal year 2024, the Audit Committee established an IT Audit Subcommittee to enhance focus on IT-related internal controls and cybersecurity. The Board and Audit Committee have appointed one of its independent directors and members of the Audit Committee to sit on the IT Subcommittee. This subcommittee meets quarterly with key company leaders to review cybersecurity risks and audit findings and reports regularly to the Audit Committee.


text: Impacts from Cybersecurity Threats Although we have experienced cybersecurity incidents, we do not believe they have, or are likely to have, a material impact on the business. However, we recognize that cybersecurity threats are constantly evolving, and future incidents remain a possibility. Despite our security measures and IT controls, we cannot guarantee that future cybersecurity incidents will be prevented. A successful attack could have significant consequences for the business. For more information on the risks associated with cybersecurity threats, see "Item 1A, Risk Factors."


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We, directly and through our third-party service providers, maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We and our third-party service providers conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan.


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase generally in business and society. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our finance and IT consultants have oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. They receive updates from management on our cybersecurity risks as may be required or prudent. In addition, management updates the home office executive committee as necessary, regarding any material cybersecurity incidents. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our home office executive committee. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership, as appropriate.


text: Our Chief Financial Officer and Corporate Controller oversees our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. These officers work with other members of management, employees and outside service providers to promote and evolve our cybersecurity protocols and systems. There were no material cybersecurity incidents in 2023 or up to the date of this filing.


text: Risk Management and Strategy The Company maintains a cybersecurity risk management program that is led by our Chief Information Officer ("CIO") and our Senior Director of IT - Security and Compliance ("Senior Director of IT"). Our CIO has over 25 years of experience in information technology and cybersecurity and reports to our President and CEO. Our Senior Director of IT has over 20 years of experience in information technology and cybersecurity, holds several industry certifications including CISSP and CISA, and reports to the CIO. The Company's CEO, Chief Financial Officer ("CFO") and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies, including risks arising from cybersecurity threats.

companyName: REV Group, Inc.


text: The program is aligned with industry frameworks and controls from the National Institute of Standards and Technology, including NIST Cybersecurity Framework, v2.0. Leveraging these frameworks and controls allows the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain and enhance cybersecurity, including threat intelligence, penetration testing, multi-factor authentication, and endpoint detection and response. The Company maintains a cyber incident response plan, which is tested periodically. The Company maintains a cybersecurity insurance policy, which gives us access to expert forensic and legal experts to help manage a major incident or a data breach. We have rolled out a formal cybersecurity awareness training program to our entire workforce as part of our annual ethics and compliance training. Additionally, the Company conducts ongoing phishing and social engineering simulations that are tied to our cybersecurity awareness training program, and our workforce is encouraged to report any suspicious activities to our cybersecurity team. The Company also has processes in place to oversee and identify risks from cybersecurity associated with the use of third-party service providers that could impact our business. We review available data related to our third-party service providers and assess the appropriateness of our service providers' cybersecurity programs and practices to ensure risks are properly mitigated.


text: Assessing, identifying and managing cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") program. Cybersecurity-related risks fall within the scope of risks that the ERM program evaluates to assess top risks to the enterprise. Such risks are directly communicated to the Audit Committee on a bi-annual basis, or more frequently as needed. The Audit Committee reports the results of their bi-annual meetings to the Board of Directors at the succeeding Board meeting. To the extent the ERM process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. We have a formal process to annually assess the feasibility, validity and effectiveness of our incident response plans including information technology recovery and business continuity procedures.


text: We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding cybersecurity risks, see the risk factor in Part I, Item 1A. Risk Factors captioned: "We are required to maintain the privacy and security of personal and business information amidst multiplying threat landscapes and in compliance with privacy and data protection regulations globally. Failure to do so could damage our business, including our reputation with sellers, buyers, and employees, cause us to incur substantial additional costs, and make us subject to litigation and regulatory action."


text: The Company did not experience a material cybersecurity incident in fiscal year 2024. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and, if deemed necessary, the Board of Directors. Additionally, we plan to consult with outside counsel, as appropriate, on our materiality determinations, our disclosure requirements, and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents, as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks applicable to the Company.


text: The Company maintains a formal Information Security Steering Committee comprised of a cross-functional group of business leaders. This committee meets at least quarterly to discuss performance of the prevention, detection, and mitigation plans that are being carried out by the Company's information security function, as well as the identification of any material new or heightened cybersecurity risks or incidents not already communicated by the CIO and Senior Director of IT.


text: The Board of Directors is responsible for the overall oversight of risk at the Company and has delegated to the Audit Committee the oversight of the risk management strategy specific to cybersecurity. Bi-annual reports regarding cybersecurity are provided to the Audit Committee by the CIO. These reports include information about the prevention, detection, mitigation, and remediation activities related to cybersecurity, any updates to internal processes surrounding cybersecurity, and any other relevant topics or information that allow the Audit Committee to provide proper oversight into cybersecurity risks. Additionally, the Board of Directors receives an annual update on cybersecurity from the CIO, which includes updates on any material cybersecurity incidents, and updates on topics related to cybersecurity both on a broad and company-specific level.


text: Risk Management and Strategy The protection of our clients' data, our brand, and our systems is of utmost importance. We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security. We have developed comprehensive cybersecurity and data privacy programs across our employee groups and systems, building a culture of cybersecurity and data privacy awareness throughout the organization. In 2024, we achieved both SOC2 Type 1 and TX-Ramp certifications, reflecting our commitment to supporting our clients by aligning our controls and processes with the System and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA).


text: Our process to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third-party service providers, including cloud-based platforms. On an annual basis, we review the SOC2 (or equivalent) attestation of controls for material third-party service providers, coupled with monitoring industry notices and threat intelligence regarding potential vulnerabilities or threats targeting these third-party services.


text: We developed our cybersecurity program by integrating proactive training, vulnerability management, and system design with active threat defense mechanisms. Our marketplace services are protected by multiple layers of security, employing a "defense in depth"


text: approach to asset protection that is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals. This same organization provides proactive notification and consultation on emerging threats and potential mitigation.


text: In addition, we undertake integrated planning activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including active Disaster Recovery production environment tests, tabletop exercises, continuous vulnerability tests, and annual penetration testing. We conduct company-wide mandatory cybersecurity training as well as periodic employee education exercises, such as phishing simulation email campaigns designed to emulate real-world attacks.


text: We view cybersecurity protection and data privacy as a shared responsibility in which all employees are active participants. Each employee undergoes annual cybersecurity training with supplemental training disseminated throughout the year. This continual education helps promote a culture that understands the critical role cybersecurity and data privacy play in protecting our clients' assets. Furthermore, our computing environments, products, and services are reviewed by our internal security team and our controls are tested regularly by independent third-party assessors as part of our annual SOC2 and SOX re-certifications.


text: Cybersecurity Governance Board and Committee Oversight. Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk identification, mitigation strategy and efforts, and resources. The Audit Committee of the Board of Directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules. We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employ dedicated resources to protect our systems.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our IT Director, who reports to our Chief Financial Officer and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our IT Director leads our information technology team and regularly reports to our Audit Committee.


text: Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We work with third-party firms to monitor our cybersecurity environment and report findings to executive leadership, internal audit and the Audit Committee regularly.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, certifications, audits and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our IT Director based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.


text: SLB maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services.


text: Our Audit Committee, in connection with management led by our Chief Financial Officer, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our IT Director has served in various roles in technology leadership for more than 20 years, including cybersecurity. With an undergraduate degree in Information Systems, an MBA, and certification as a Certified Information Systems Security Professional (CISSP) from ISC2, the IT Director plays a key role in managing risks at our company. This includes risks arising from cybersecurity threats, drawing on extensive experience gained from similar companies and leadership positions across the technology sector. Although the Company does not have both a Chief Technology Officer or a Vice President of Security, the IT Director's expertise ensures robust risk management practices are in place. Our Chief Executive Officer, Chief Financial Officer and IT Director each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.


text: ESSA Bank and Trust has adopted an Incident Response Plan (the "IR PPlan") for responding to cybersecurity incidents. This IR Plan applies to both potential and actual incidents. The IR Plan should be invoked in any context where the Bank believes that an incident may have occurred. The IR Plan applies to all employees, contractors, and third parties. The objectives of the IR Plan are to ensure the protection of customer data and all organization assets from security incidents and ensure timely detection, mitigation, and communication of security incidents to appropriate parties.

companyName: ESSA Bancorp, Inc.


text: Implementation of the IR Plan requires cross-functional efforts from across the organization. The roles/functions involved and the related responsibilities in enforcing the IR Plan are spread across the entire organization of the Bank's senior.


text: Once the possibility of a cybersecurity incident has been noted, employees assigned to appropriate teams do the necessary research and analysis to confirm either that there is an incident requiring additional action, or that no further action is necessary. This will typically involve some combination of Operations and Information Technology. If an incident is confirmed, an incident response team is formed, and the team takes steps to contain the incident to limit damage, eradicate the incident to restore our full control of all Bank systems and eliminate unauthorized access, and recover data and full functionality. Detection and analysis continue during this phase as necessary to ensure that this phase has been successfully executed. This phase also involves communication as needed with employees, customers, partners and service providers, legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as necessary and appropriate.


text: In the post-incident phase, the Bank analyzes the root cause of the incident, identifies any changes that need to be made to policies, procedures, training, documentation, and technology to protect against similar incidents in the future, and institutes a plan to implement them. In addition, the Bank undertakes any additional communication with the necessary parties and the public, if appropriate, and the Bank's legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as appropriate to fully address the impact of the incident, and fully documents the entire incident.


text: During the fiscal year ended September 30, 2024, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy At Genasys, cybersecurity risk management is integrated into our overall risk management program through regular internal risk assessments and continuous monitoring. Under the leadership of the Information Technology ("IT") Director, IT developed, implemented, and maintain a broad range of processes and protocols designed to monitor, identify, mitigate, and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Our protocols include a third-party provided 24/7 Security Operations Center (SOC), which is designed to oversee our Endpoint Detection and Response (EDR) system and a robust Security Information and Event Management (SIEM) system that aggregates logs for real-time threat detection.

companyName: Genasys Inc.

ticker: GNSS


text: We believe Manhattan has appropriate processes for assessing, identifying, and managing material risks from cybersecurity threats. Those processes are embodied in our enterprise-wide Cyber Risk Management Program (the "Cyber Program"), which includes our cybersecurity governance structure and our cybersecurity strategy and processes.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Our cybersecurity risk management program applies information and direction from industry-recognized cybersecurity frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-171, the Department of Defense Cybersecurity Maturity Model Certification (CMMC) Level 2, Sarbanes Oxley (SOX), and Services Organization Controls (SOC) 2. Third-party risk is managed through vendor assessments and SOC 2 report requests, designed to ensure that our partners adhere to strict cybersecurity standards.


text: Notwithstanding the foregoing, we have not identified and are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. See "Risk Factors – Actual or perceived failures or breaches of our information and security systems, or those of our customers, suppliers or business partners, could expose us to losses."


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and includes it as part of the full Board's oversight function. The full Board is updated on cybersecurity risks and compliance with relevant standards and regulations as part of its overall governance responsibilities, including quarterly Board meeting reports. Our Director of IT, who is responsible for the oversight and implementation of the cybersecurity program, also periodically makes presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company. Additionally, we have an escalation process to inform the Board of high-severity cybersecurity incidents that may occur. Our Board also periodically engages independent third-party technology experts to test our information technology systems, including cybersecurity.


text: The Director of IT leads the day-to-day management of cybersecurity at Genasys, supported by a team of three IT professionals with a combined 45 years of IT and cybersecurity experience. This team handles ongoing risk assessments, manages threat detection through our SOC and Security Information and Event Management (SIEM), ensures compliance with industry regulations, and informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy. Management also ensures that employees and contractors undergo quarterly cybersecurity training and phishing simulations via KnowBe4, as part of a comprehensive awareness program.


text: Cybersecurity Risk Management and Strategy We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our IT systems. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: enGene Holdings Inc.

ticker: ENGN


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we plan to implement a process to review risks to our Company in connection with certain third-party providers and vendors, which we expect will involve assessments through vendor questionnaires, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party IT service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, "Risk Factors," in this Annual Report.


text: Cybersecurity Governance Our cybersecurity program is managed and directed by our Vice President, Information Technology, or IT, who has approximately 20 years of experience in information technology and information systems management. Our Vice President, IT reports to our Chief Financial Officer.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process. Our Board of Directors does not have a standing risk management committee, and administers this oversight function both directly as a whole, and through various standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee is responsible for overseeing the Company's enterprise risk management processes as well as our policies with respect to risk assessment and risk management, which includes cybersecurity risk. A cybersecurity update is provided at least annually, or more frequently as needed, to the Audit Committee by members of management responsible for managing cybersecurity risks.


text: SLB's Cybersecurity Director reports to SLB's Chief Information Officer and is the head of the Company's cybersecurity team. The Cyber Security Director is responsible for assessing and managing SLB's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, and private sources, including external consultants engaged by SLB.


text: The Audit Committee of the Board of Directors oversees SLB's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of SLB's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the SLB Board of Directors, at least annually, as part of the Company's enterprise risk management process.


text: SLB faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. SLB has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on SLB's business, financial condition, results of operations, or cash flows. See "Risk Factors – Business and Operational Risks – Our operations are subject to cyber incidents that could have a material adverse effect on our reputation, business, financial condition, results of operations, and cash flows."


text: The Company's senior management is actively involved in oversight of the Company's risks and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including two factors: authentication, firewalls, anti-malware functionality, email threat protection and access controls, which are evaluated and improved through vulnerability assessments.


text: Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact on our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides training, support and alerts for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Senior management, in coordination with the Company's third-party service providers specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through ongoing communications with third party service providers, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.


text: Cybersecurity incidents have not materially affected the Company's results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: At Hexcel, we are committed to the security of our products and services, the protection of employee, customer and Company data, and the safeguarding of our manufacturing capability. Our cybersecurity program is led by our Chief Information Officer ("CIO"), who has over 20 years of experience in information technology leadership and 10 years of experience directly overseeing our information security program and holds a Master of Business Administration in technology management. As a part of our cybersecurity program, we have engaged, and in the future may continue to engage, third-party consultants and advisors, including a third-party consultant with extensive experience designing, leading, and maintaining the implementation and assurance frameworks for organizational information, to provide virtual chief information security officer services, including establishing a security architecture, policies, practices, and response capabilities.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: Our CIO regularly updates senior management on our cybersecurity risk governance and management and the status of ongoing efforts to strengthen cybersecurity effectiveness. Our board of directors views cybersecurity as a strategic priority and therefore maintains oversight of management's actions in implementing our overall cybersecurity program, with our CIO regularly reporting directly to our board of directors. The audit committee of the board of directors also periodically reviews the cybersecurity program as part of its oversight of the Company's internal audit function and insurance program.


text: As part of our cybersecurity program, we maintain various protections designed to safeguard against cyberattacks, including firewalls, anti-malware, intrusion prevention and detection systems, access controls and other encryption configurations and cybertechnologies, and continuously monitor and audit our information technology and data assets to detect any anomalies and to respond quickly to threats that may arise. We periodically conduct intrusion and penetration testing through third parties to evaluate our cybersecurity response capability. We also regularly conduct employee awareness training on email management (phishing), safe internet browsing, malware, and other cybersecurity risks and routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques, and how to avoid them through our established communications channels.


text: We have adopted and implemented an approach to identify and mitigate cybersecurity risks within our overall enterprise risk management program that is based on a recognized framework established by the National Institute of Standards and Technology. The board of directors is responsible for overseeing management's enterprise risk management program, and receives regular reports on cybersecurity risk identification, monitoring and mitigation from our Chief Financial Officer as part of its review of that program, in addition to the regular reports received from the CIO as part of the board's overall cybersecurity program review.


text: As part of our cybersecurity risk management, we have established controls and procedures to guide the Company through an active threat or incident to the recovery of normal business, following industry-standard data protection standards. The controls and procedures provide for the identification, notification, escalation, communication, and remediation of cybersecurity incidents to management, including where appropriate the board of directors, so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. We maintain an Executive Cyber Response Team composed of senior leaders across various functions, including our CIO, General Counsel, Chief Accounting Officer and VP Communications. The Executive Cyber Response Team is trained and experienced in managing cybersecurity incidents and meets regularly to practice and refine our processes for incident response, management and escalation through tabletop exercises simulating cyberattacks administered by a legal advisor with extensive experience in cyber investigations, cyber threats and cyber-enabled frauds. The results of such exercises are then reported to management and our board of directors. The third-party legal advisor also assesses and advises on our overall cybersecurity program, reports to our board of directors on a periodic basis and is engaged to provide support in the event an attack or other intrusion were to be successful.


text: Furthermore, as part of our cybersecurity management, we are committed to strong third-party risk management. We actively and routinely address cybersecurity capabilities with our top-tier suppliers and have implemented cybersecurity requirements in our standard supplier contract terms to address cybersecurity risk. Additionally, we validate cybersecurity practices of key suppliers as may be necessary to comply with applicable regulations or flow-down requirements from our customers.


text: The Company maintains disaster recovery plans for key applications and site-specific incident response plans, as well as a cybersecurity and related insurance policies as a measure of added protection.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management Program We recognize the importance of maintaining the integrity of our information systems and safeguarding the confidential business and personal information we receive and store about our residents, prospective residents, employees and suppliers. As such, we have implemented a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ what we believe are industry best practices, including monitoring and analysis of the threat environment, vulnerability assessments and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Key processes in our program include: • regular cybersecurity training and testing for employees with company email and access to connected devices; • continuous security event monitoring, management and incident response; • regular testing of incident response procedures; • regular internal reporting; • regular consulting with external advisors and specialists regarding opportunities and enhancements to strengthen our cyber practices and policies and enhance our cybersecurity maturity; • independent third-party testing of our information technology controls and defenses, including penetration tests; • independent third-party audits of our cybersecurity controls; and • annual independent third-party reviews of program maturity based on the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: Mid-America Apartments, L.P.


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.

companyName: IMPINJ INC

ticker: PI


text: In addition, as part of our cybersecurity risk management program, we have processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers, and our cybersecurity risk management program takes into account third-party systems through which we could be impacted by the compromise of the security of a third-party service provider. In this regard, we conduct due diligence on third-party service providers with respect to cybersecurity risks prior to entering into relationships with them, and we regularly assess security risks associated with our use of third-party service providers, including onboarding contract employees through the same process we onboard our own employees. In addition, we contractually require third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations, and we continuously track mission critical vendors using a third-party monitoring service.


text: We maintain a cyber insurance policy, we periodically meet with our insurance broker and insurer to discuss emerging trends in cybersecurity and we utilize self-assessment tools and other services provided by our insurance broker and insurer, including annual tabletop exercises conducted by cybersecurity experts.


text: Our cybersecurity risk management program is integrated into our overall risk management system. To help identify, assess and manage material risks from cybersecurity threats, we include cyber risk in our enterprise risk management, or ERM, evaluation and strategy process. Our ERM process takes a top-down, enterprise view of risks; it is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Our Vice President Cyber Security has a dotted line reporting relationship to our Chief Administrative Officer and General Counsel to help ensure that risks from cybersecurity threats are considered as part of the broader ERM process. At a management level, our Chief Administrative Officer and General Counsel leads our ERM process.


text: We do not believe that any risks from cybersecurity threats of which we are aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For information regarding the risks we face associated with cybersecurity incidents, see "Risk Factors – We rely on information technology systems in our operations, and any breach or security failure of those systems could materially adversely affect our business, financial condition, results of operations and reputation" included in this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors is responsible for oversight of risks from cybersecurity threats. At a management level, our cybersecurity risk management program is led by our Chief Technology and Innovation Officer who has over 20 years of experience providing business and information technology, or IT, process consulting and regulatory compliance services, including founding a cyber-security consulting and regulatory compliance firm and serving as Sarbanes-Oxley subject matter specialist for an international public accounting firm, and whose certifications include Certified Public Accountant and Certified Information Systems Auditor. Partnering with our Chief Technology and Innovation Officer is our Vice President Cyber Security, who has over 30 years of IT technical and IT business process experience and has been an IT and cyber security leader for multiple financial services companies. Collectively, our cybersecurity team consists of 5 professionals with an average cybersecurity tenure of 15 years and various relevant certifications. Members of our cybersecurity team deliver regular updates to our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel.


text: The Audit Committee of our Board of Directors receives regular reports, including an annual cybersecurity maturity assessment and quarterly scorecards, from our Chief Technology and Innovation Officer. Those reports cover topics related to information security, privacy, and cyber risks and our risk management processes, including the status of any recent cybersecurity events, the emerging threat landscape, and the status of capital investments in our information security infrastructure. The Audit Committee provides regular reports to the full Board of Directors. In addition, the Audit Committee and the full Board of Directors have authority to engage external consultants, including legal, accounting or other advisors, such as cybersecurity firms, in carrying out its oversight of our cybersecurity risk management program. Likewise, the Audit Committee or the Board of Directors may request members of management or others to attend meetings at which cybersecurity risk management is addressed.


text: As part of our cybersecurity risk management program, we have adopted an incident response plan which provides for controls and procedures upon the occurrence of a cybersecurity event. In connection with that plan, we have established a cross-functional critical response team, comprised of members of management under the direction of our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel, which is responsible for monitoring our cybersecurity incident response. In addition, this critical response team performs an impact assessment in the event of the occurrence of a cybersecurity event meeting certain criteria, which is elevated for the team's review and, if any such cybersecurity event is determined by the critical response team to have the potential to have a material impact on the Company, the cybersecurity event is elevated for further review and assessment by a senior management team, which includes all of the members of our standing crises control committee, and, under certain circumstances, the Audit Committee and/or the full Board of Directors.


text: Cybersecurity risks are part of the broader ERM process overseen by our Board of Directors. ERM risk assessment results are presented annually to the Board of Directors, and status updates are delivered quarterly to the Audit Committee.


text: Governance Structure Board Oversight. Our Board of Directors has delegated oversight of our Cyber Program to the Board Audit Committee. Despite that delegation, the full Board also remains informed, through quarterly presentations to the full Board by our Chief Financial Officer or their designee (or more frequently as necessary), followed by the opportunity for Q&A and discussion, on the status of the Cyber Program. The presentations cover, among other things, our cyber incident experience, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages, and our employee-training programs. If further Board engagement on cybersecurity matters is required, management, through the CEO, CFO or CLO, communicate directly with the Audit Committee chair, who engages the Audit Committee as they deem appropriate.


text: Management's Assessment and Management of Cybersecurity Threats. Members of Manhattan's executive management team, along with others from Company senior management, and others with varying areas of expertise, are engaged as part of our Cyber Program: • Chief Financial Officer and Chief Information Officer – Direct management of our Cyber Program falls within our Information Technology department, which reports up through our CIO, who reports to our CFO. Both our CIO and CFO have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as Manhattan. The CFO is a member of our Disclosure Committee, which is responsible for determining whether a cybersecurity incident is "material" for purposes of publicly reporting cybersecurity incidents, and is a member of our "Core Response Team" under the Company's Crisis Response Program. Our CFO also chairs our management Cybersecurity Committee. • Chief Legal Officer – Our CLO has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims, and loss mitigation. Our CLO also is member of the Disclosure Committee and the Core Response Team. • Senior Director, Global Security – Our Senior Director, Global Security, has managed our Cyber Program for eight years. He manages its day-to-day operations, oversees our security analysts and engineers, and leads our Cybersecurity Committee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Committee – Members include, in addition to the CFO and SD, Global Security, business representatives of Manhattan's material business lines and administrative departments, cyber-risk operational heads from our material business lines, and our VP, Contracts and Administration (or their designee). The Cybersecurity Committee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts, and make recommendations to leadership. • Crisis Response Team – Pursuant to our Crisis Response Program, our Crisis Response Team, which comprises the CLO, CFO, Chief People Officer and Chief Marketing Officer, and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the CLO, on behalf of the Team, will report to or engage the CEO and the Chairman of the Board if and when an incident becomes a crisis or potential crisis.