text: The Company’s cybersecurity program is integrated within the Company’s enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks. The Company also engages third party experts to assist with compliance and maturity assessments and penetration testing, as appropriate.


text: The Company maintains arrangements with third party information infrastructure or IT vendors, including “cloud computing” vendors. All potential vendors are evaluated through the Company’s third-party due diligence process, which includes conducting cybersecurity risk assessments prior to integration into the Company’s networks and additional assessments prior to contract renewals or extensions. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.

companyName: Phoenix Education Partners, Inc.

ticker: PXED

secItem: Item 1C

stage1Category: Third-Party Risk

stage1Method: majority


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee of the Board of Directors. The Audit Committee oversees the implementation of the cybersecurity risk management program.

companyName: Thunder Power Holdings, Inc.

ticker: AIEV


text: To date, the Company’s business strategy, operating results, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior incidents. Our program is designed to identify, prevent, and mitigate cybersecurity events that would have a material adverse effect on the Company; however, the nature and sophistication of cybersecurity risks continue to evolve. No security framework, system, or control environment can fully eliminate the risk of a cyberattack or unauthorized access. Despite the Company’s safeguards to protect its systems, intellectual property, and confidential and personal information, vulnerabilities may persist that could be exploited by threat actors. See Item 1A, “Risk Factors—Risks Related to our Business.”

stage1Category: Strategy Integration

stage1Method: unanimous


text: We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: The Company’s Chief Information Security Officer (“CISO”) is responsible for cybersecurity at the executive level and oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with and reports to the Chief Information Officer. Our CISO has over two decades of cybersecurity experience, including responsibilities in technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains relevant industry credentials.

stage1Category: Management Role


text: The CISO also leads a cross-functional Incident Response Team (“IRT”) responsible for responding to and managing cybersecurity incidents in coordination with our Legal department and ECDP department. The IRT consists of professionals from various departments, including Information Technology and Security, Legal, ECDP, Finance, Public Relations, and other key business areas as needed. The IRP is tested annually via a tabletop exercise, focused on executive strategy and communication processes during an incident.

stage1Category: Risk Management Process


text: The Audit Committee of the Company’s Board of Directors is tasked with oversight of the Company’s cybersecurity, information and technology security and data privacy strategies and policies. The Chief Information Officer and/or CISO provide regular updates to the Audit Committee on cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries.

stage1Category: Board Governance


text: We are subject to various cybersecurity risks in connection with our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors, I. Risks Related to Our Business Operations and Industry of this Annual Report.

companyName: PTC INC.

ticker: PTC

stage1Category: None/Other


text: We take a holistic, multi-layered approach to cybersecurity and privacy that combines traditional Defense-in-Depth methods with next-generation Zero Trust principles. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST") and the Software Assurance Maturity Model developed by the OWASP (the "OWASP SAMM"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II and FedRAMP, for certain of our products and services.


text: People. Recognizing that technology alone cannot mitigate all security threats, we focus on developing our most critical resource: our people. Our corporate cybersecurity awareness activities are combined with enterprise-wide and department-specific tools and mandatory employee training, providing our employees with knowledge and resources to support our efforts to mitigate security threats.


text: Process. We maintain processes and policies to try to anticipate security risks and facilitate compliance with applicable contractual obligations, regulations, and standards, as well as address any incidents or violations. We focus on continuous improvement and constantly mature our processes to keep pace with the rapidly evolving cybersecurity threat landscape.


text: Technology. We seek to automate processes and remove the potential for human error to the extent feasible by implementing technology solutions. From fundamental IT security to development of our software products and keeping our customers' data safe, we aim to maintain a secure infrastructure that is appropriately monitored for possible threats.


text: These three key elements of people, process, and technology are tightly interwoven to support our aim to secure our environments and the data for which we are a custodian.


text: Cybersecurity is a risk area with oversight at the highest levels of the organization, including the Executive and Board Level. The overall operational program is led by the Cybersecurity Strategy Council, a cross-functional team of executives and subject matter experts, led by our Chief Product Security Officer, Chief Information Security Officer and Chief Compliance Officer. The Cybersecurity Strategy Council oversees a "Three Lines Model" of Operations, Risk Monitoring and Oversight, and Audit, to effectively address cybersecurity, risk management, and control. All Cybersecurity, Risk, and Internal Audit functions report to the PTC Executive Leadership Team.


text: Third-Party Vendor Risk Management Our Vendor Risk Management (VRM) program is designed to meet cybersecurity, privacy, regulatory and compliance obligations, by managing risk associated with third-party vendors who have access to PTC IT systems and data. Prior to outsourcing or allowing third-party access to PTC or customer systems, IP, or data; risks associated with such activity are identified and documented. The process of selecting a third-party vendor includes due diligence of the vendor service or product in question. Third-party companies using PTC facilities or accessing PTC's IT Systems are subject to PTC's VRM review and must demonstrate that proper security measures are in place before they have access to any PTC IT systems or data. All such vendors are to be approved by PTC's VRM process and contractually bound to maintain appropriate cybersecurity technical and organization measures and to protect PTC's data to which they may have access.


text: Incident Response We maintain an Enterprise Cybersecurity Incident Response Policy to address cybersecurity incidents. The Policy is tested on a periodic basis, including an ongoing improvement program involving periodic tabletop exercises. Cybersecurity incident handling is managed by individual organizations with cybersecurity responsibility and monitored/guided by applicable corporate functions. All Cybersecurity Incident Response Plans under the Policy are based on industry standards, such as the NIST Computer Security Incident Handling Guide – Special Publication 800-61.


text: Management's Role in Assessing and Managing Our Risks from Cybersecurity Threats Our Cybersecurity Program is overseen by executives on our Executive Leadership Team and managed by our Cybersecurity Strategy Council, including our Senior Vice President, Chief Information Security Officer (CISO), who reports to our Executive Vice President, Chief Digital and Information Officer (CDO). Our CISO is responsible for day-to-day risk management activities, including staying informed about and monitoring prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, and the use of technological tools and software. Our CDO is responsible for our broader IT program, which includes our ability to remediate and recover from a cybersecurity incident while reducing impacts to the business and operations. Our CDO and CISO regularly report directly to the Cybersecurity Committee of the Board of Directors on our Cybersecurity Program and efforts to prevent, detect, mitigate, and remediate issues. In addition, we have an escalation process in place to inform senior management and the Cybersecurity Committee and the Board of Directors of material issues.


text: Management Experience Our CDO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CDO joined PTC as Chief Digital and Information Officer in January 2022 and is responsible for PTC's global information technology (IT) team, overseeing PTC's digital infrastructure and working with business leaders to guide PTC's digital process optimization strategy. He has more than two decades of IT and operations leadership. Before joining PTC, he served as Global Vice President and Chief Information Officer for Avaya, where he led a globally-dispersed team of 1,200 IT professionals to support the entire global Avaya enterprise. Prior to Avaya, he held technology leadership roles at Arise Virtual Solutions Inc., Oracle, and Colorado College.


text: Our CISO joined PTC as Cyber Information Security Officer in April 2022 and, before joining PTC, was the Vice President, Information Technology, North America and Europe for Alorica, where he led Alorica's transformation to a secure endpoint architecture for 90,000 global remote and hybrid employees.


text: Risk Management and Strategy As noted in Part I, Item IA, Risk Factors, Cabot recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we have taken measures to protect Company data and the continuing operation of our information technology and communications systems. Our cybersecurity program includes information technology ("IT") policies and standards and an IT risk management program. Our cybersecurity risk management program leverages standards established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which provides guidance to organizations on how to identify, prevent, detect, respond and recover from cybersecurity threats.

companyName: CABOT CORP

ticker: CBT


text: Further, cybersecurity risk is integrated into our enterprise risk management ("ERM") approach and is among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. We use several tools and controls designed to manage IT risk, including, but not limited to, controls for the management of privileged access, anti-malware tools, simulated email phishing attacks, and other email security tools intended to detect and prevent intrusions as well as monitor risks. All Cabot employees participate in monitored cyber security training and have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. We have a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engage in response planning, simulations, trainings, tabletop exercises, and other efforts to prepare for any incidents should they occur.


text: We periodically engage assessors, consultants, auditors, and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. These assessments provide insight into areas of future improvement in risk mitigation and further program development. In addition, we rely on third parties for various business functions and oversee such third-party service providers by conducting vendor diligence upon onboarding as well as ongoing monitoring.


text: Governance and Oversight Management Oversight in Cybersecurity Governance Cabot's Cyber Risk Steering Committee is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Our Chief Digital Information Officer (the "CDIO") is the member of the Company's management principally responsible for overseeing the Company's cybersecurity risk management programs in partnership with business and functional leaders across the Company as well as a managed security service provider that provides threat intelligence, global infrastructure monitoring and threat detection and response to cyber events. The CDIO has held various positions within Cabot's IT department over his 20-year tenure with the Company, and contributes technical expertise to the Company's management team. The CDIO leverages extensive industry, IT and cybersecurity expertise to make strategic and operations decisions for Cabot's information security program. The CDIO collaborates with Cabot's Management Executive Committee to manage cyber risk and enhance the cyber program and reports directly to a member of our Management Executive Committee who has executive responsibility for Digital matters.


text: We have established a process to assess the nature, scope and timing of a cyber incident and, as appropriate, communicate the facts of an incident to management and the Board of Directors and, as appropriate, investors. In the event of a cybersecurity incident, the incident response team is responsible for notifying senior management in a timely manner, to the extent that the facts and circumstances of a particular incident warrant such notification. If it is determined that the event is material to the Company, the matter will be escalated to the Board. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations.


text: Board of Directors Oversight in Cybersecurity Governance Cabot's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which comprises independent directors. Company executives along with external and internal cybersecurity personnel update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic assessments of the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. Relevant matters are also reviewed with the full Board on at least an annual basis.


text: As of the date of this report, we have not experienced a cybersecurity incident that has resulted in a material effect on our business strategy, results of operations or financial condition. Despite our efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of the Company's or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm; damage to our brand; lost sales; physical damage to facilities; physical harm to individuals; reduced demand; loss of intellectual property rights; significant costs; or the Company being subject to government investigations, litigation, fines or damages. For additional information, see Part I, Item 1A, "Risk Factors—Operational Risks—Information technology systems failures, data security breaches, cybersecurity attacks or network disruptions have harmed us in the past and could compromise our information, disrupt our operations and expose us to liability, which may adversely impact our operations."


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company, including the CCO, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser. The Company also relies on the communications and systems of other third-party service providers.

companyName: PENNANTPARK INVESTMENT CORP

ticker: PNNT


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving as CCO since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Our Board maintains oversight responsibility of risks from cybersecurity threats. This oversight is facilitated primarily through the Audit Committee (the "Committee"), which is responsible for oversight of our information system risk, including cybersecurity threats. The Committee oversees the risk management program designed to implement adequate controls to mitigate cybersecurity risks.

companyName: MAYS J W INC

ticker: MAYS


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care and is integrated into our overall enterprise risk management program.

companyName: Woodward, Inc.

ticker: WWD


text: We have established processes to evaluate and address cybersecurity risks on an ongoing basis. As part of our risk management program, we engage with external third parties to measure the effectiveness of our cybersecurity program through penetration tests, control assessments, tabletop exercises, and other related activities. Further, we have implemented a defense-in-depth strategy in which we utilize real-time 24/7 monitoring to identify anomalies, potential threats, and alerts. This cybersecurity strategy incorporates frameworks, policies, and practices designed to protect the privacy and security of our sensitive information, backed by a suite of security technologies and tools to implement and automate select security protections. We maintain cyber risk and related insurance policies as a measure of added protection.


text: We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. We periodically send "Test" phishing assessments to our members. Any failures trigger a retraining exercise. Also, we have specific and regular training for our IT and finance members, as well as our system administrators.


text: In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes, as applicable and appropriate based on risk profile and criticality, a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and/or Cybersecurity Maturity Model Certifications, as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this Form 10-K, including the risk factor entitled "Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions."


text: Cybersecurity Governance Our cybersecurity program is ultimately overseen by the Board of Directors (the "Board"). The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry, monitor various security tools deployed in the IT environment and review threat intelligence and other information from various public and private sources. The team has decades of experience with varied certifications and is led by our Chief Information Security Officer ("CISO"), who reports to our Vice President of IT, has over 18 years of experience as an IT professional and in cybersecurity, including experience leading cybersecurity programs protecting high value assets and critical infrastructure, including in high-risk locations. Our Vice President of IT has been a key leader in our IT group for more than 25 years, including the last seven in his current role leading our IT function. He plays an integral role in cybersecurity risk assessment and mitigation in all corporate acquisitions, and he participated in the development and implementation of our initial cybersecurity program more than 20 years ago.


text: Our information security team, including our system engineering department leader who manages our information technology, is responsible for accessing and managing cybersecurity operations and incident response, reports cybersecurity incidents to management and, if the incidents are material, our audit committee. The members of our information security team each have over 10 years of experience and extensive knowledge in managing cybersecurity programs.

companyName: SemiLEDs Corp

ticker: LEDS


text: Our CISO and Vice President of IT are primarily responsible for assessing and managing risks from cybersecurity threats to the Company. The CISO and Vice President of IT make regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. The senior management team, including the CISO and Vice President of IT, provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.


text: Cybersecurity risk may adversely impact our business. The impact could include weakened financial condition, litigation risk, degrading mining operations, loss of competitiveness, fraud, extortion, harm to employees, violation of applicable privacy or other regulations that could result in regulatory action and fines.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: Risk Management and Strategy We maintain a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.


text: We use third-party security vendors to further strengthen our cybersecurity posture. These partners provide advanced monitoring, detection, and response capabilities that complement our internal controls and staff expertise. Their services include continuous threat intelligence, vulnerability management, and incident response support, which are integrated into our cybersecurity program. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also key components of our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.


text: We have implemented a third-party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third-party vendors. As part of communicating the importance of cybersecurity at an enterprise-wide level, we require that all company employees participate in annual cybersecurity training.


text: Our IT Steering and Risk Committee ("ITSRC") has been delegated the responsibility for managing cybersecurity risk for the company by the Board of Directors (the "Board"). This committee is chaired by our Chief Technology Officer & Chief Operating Officer and includes a diverse cross section of company stakeholders including the CFO, Director of IT, SVP of Security, and our General Counsel. On May 1, 2025, we added an outsourced virtual CISO who is a key advisor to the ITSRC, bringing over a decade of expertise in managing and maturing cybersecurity program that includes mitigation, incident prevention, detection and remediation disciplines. The ITSRC is also responsible for maintaining and monitoring legal and regulatory requirements and compliance as well as oversight of the adequacy of company cyber insurance. Our third-party security vendors, in collaboration with our Director of IT, keep the ITSRC apprised of efforts surrounding the prevention, detection, mitigation and remediation of any cyber threats or cybersecurity incidents.


text: The Board is entrusted with the oversight of the management of cybersecurity risk and our cybersecurity program. The Board administers this oversight through its audit committee and the ITSRC. The ITSRC committee chair is responsible for reporting to the Board's audit committee with respect to cybersecurity at least twice per calendar year. The audit committee, as necessary, reports any findings and recommendations to the Board. As cyber threats evolve and as our cybersecurity program matures, the Board will consider further developing specific cybersecurity oversight functions and protocols. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM


text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are assessed for risk and may additionally be required to adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2025. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Horizen Trust (ZEN)

ticker: HZEN


text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The S ponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.


text: Our Audit Committee assists the Board in overseeing cybersecurity risks, including discussing with management and the information security team if cybersecurity threats are identified, and recommends cybersecurity framework improvements to the Board.


text: Cybersecurity Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents. Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the NIST Cybersecurity Framework. Our program is comprehensive in scope and covers all of our general corporate IT systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers. Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives. Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: Our cybersecurity risk management program includes an incident response plan ("IRP"). Our IRP provides us with a plan for identifying, responding to, reporting and remediating cybersecurity incidents. Our IRP has been established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. Our Information Services Breach Response Team ("ISBRT") takes a central role in developing and maintaining our incident response framework in coordination with our Cybersecurity Response Team ("CRT") that is dedicated to proactively addressing and managing potential breaches and incidents to ensure that our cybersecurity defenses are well designed and managed. Our Incident Management Team ("IMT") handles the response process for all cybersecurity incidents.


text: Our cybersecurity risk management program and strategy also includes: • a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information protection and broader enterprise IT environment; • the use of reputable cybersecurity consultants and other experienced third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so we can maintain a posture of continual enhancement of our cybersecurity risk management program and strategy; • continuous and updated cybersecurity awareness training for our employees, incident response personnel and senior management; and • a risk management process for critical third-party service providers and vendors that includes due diligence in the selection of third-parties and vendors and the periodic monitoring thereof to ensure that they adhere to applicable cybersecurity standards.


text: Cybersecurity Governance Our Board of Supervisors is responsible for overseeing our enterprise risk relative to cybersecurity governance through the Audit Committee of the Board, with specific responsibility for overseeing cybersecurity threats, among other things. Our CRT is led by the Senior Vice President of Information Services ("SVP, Information Services"), who reports to the Partnership's CEO and is responsible for assessing and managing material cybersecurity risks and threats, in coordination with the ISBRT and the IMT, and regularly reports to the Audit Committee with regard to the Partnership's cybersecurity governance efforts. The SVP, Information Services has served in this role since 2014, and has more than 28 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance.


text: The ISBRT, CRT, IMT and the Audit Committee of the Board all play a role in the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents through their management and oversight of, and participation in, the cybersecurity risk management and strategy processes described above. As of the date of this Annual Report, we are not aware of any risks of, or actual, cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in the section entitled "Item 1A. Risk Factors" in this Annual Report.


text: Risk Management and Strategy We have dedicated to advance our cybersecurity risk management and integrated it into our overall risk management program, which program manages cybersecurity, financial, operational and compliance risks. To access, identify and manage cybersecurity threats, we implemented a cybersecurity risk management program with oversight by our Board of Directors ("Board"). Our management, led by an experienced information security team, continually monitors cybersecurity risk incidents.


text: Our cybersecurity risk management program sets forth a framework provided by our information security team to identify and mitigate vulnerabilities and risks in our information systems. Elements of the program include, among the other things, penetration tests on our networks and engaging in annual employee cybersecurity training.


text: We have engaged a third-party service provider periodically to review and improve our cybersecurity risk management framework, including by identifying third-parties information systems that could cause cybersecurity incidents to our business.


text: Risk Management and Strategy We have implemented an information security program to assess, identify, and manage material risks from cybersecurity threats. This program includes policies and procedures that guide the development, implementation, and maintenance of security measures and controls. We utilize industry-standard metrics to evaluate the criticality of software, data assets, and operational technology. We believe that our cybersecurity efforts align with the Center for Internet Security (CIS) Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and we conduct annual assessments to ensure compliance.

companyName: STAR GROUP, L.P.

ticker: SGU


text: Given our reliance on third-party software, service providers, and applications to support various business functions and security measures, we regularly conduct security audits and vendor management reviews. These processes are intended to ensure that third-party systems and services comply with our cybersecurity program.


text: Periodic cyber risk assessments of our operational technology network help us identify risks, which we address using risk-based analysis and judgment. We also conduct internal and external testing of software, hardware, and defensive systems in our efforts to uncover potential vulnerabilities. Third-party security firms are employed for certain controls and technology operations, including vulnerability scans and penetration testing. Our approach to managing third-party cybersecurity threats includes pre-acquisition due diligence, contractual obligations, and ongoing performance monitoring.


text: We employ governance, risk, and compliance (GRC) information technology tools to manage cybersecurity risks and maintain business continuity and disaster recovery plans to prepare for potential disruptions. Our employees receive cybersecurity awareness training upon hiring, with additional training provided on a regular basis.


text: The Vice President of Information Technology (IT) and the Director of IT Security are responsible for overseeing our cybersecurity risk management program and assessing cybersecurity risks. This includes managing internal cybersecurity staff, consulting with external cybersecurity experts, and staying informed through governmental and private sources. They report regularly to executive management on cybersecurity threats, resources, and program updates.


text: Cybersecurity risk management and strategy are integrated into our overall risk management processes. The program monitors the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of IT presents updates on IT projects, including cybersecurity policies and programs, to executive management at least quarterly.


text: The Board of Directors has overall oversight of key risks, with strategic oversight of cybersecurity risk management delegated to the Audit Committee. Annually, the Audit Committee reviews the Company's enterprise risk management, which includes cybersecurity. In fiscal year 2024, the Audit Committee established an IT Audit Subcommittee to enhance focus on IT-related internal controls and cybersecurity. The Board and Audit Committee have appointed one of the members of the Audit Committee to sit on the IT Subcommittee. This subcommittee meets quarterly with key company leaders to review cybersecurity risks and audit findings and reports regularly to the Audit Committee.


text: Impacts from Cybersecurity Threats Although we have experienced cybersecurity incidents, we do not believe they have, or are likely to have, a material impact on the business. However, we recognize that cybersecurity threats are constantly evolving, and future incidents remain a possibility. Despite our security measures and IT controls, we cannot guarantee that future cybersecurity incidents will be prevented. A successful attack could have significant consequences for the business. For more information on the risks associated with cybersecurity threats, see Item 1A, Risk Factors - "Risk Related to Information Technology and Cybersecurity."


text: Risk Management and Strategy The Company maintains a cybersecurity risk management program that is led by our Chief Information Officer ("CIO") and our Senior Director of IT - Security and Compliance ("Senior Director of IT"). Our CIO has over 25 years of experience in information technology and cybersecurity and reports to our President and CEO. Our Senior Director of IT has over 20 years of experience in information technology and cybersecurity, holds several industry certifications including CISSP and CISA, and reports to the CIO. The Company's CEO, Chief Financial Officer ("CFO") and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies, including risks arising from cybersecurity threats.

companyName: REV Group, Inc.


text: The program is aligned with industry frameworks and controls from the National Institute of Standards and Technology, including NIST Cybersecurity Framework, v2.0. Leveraging these frameworks and controls allows the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain and enhance cybersecurity, including threat intelligence, penetration testing, multi-factor authentication, and endpoint detection and response. The Company maintains a cyber incident response plan, which is tested periodically. The Company maintains a cybersecurity insurance policy, which gives us access to expert forensic and legal experts to help manage a major incident or a data breach. We have rolled out a formal cybersecurity awareness training program to our entire workforce as part of our annual ethics and compliance training. Additionally, the Company conducts ongoing phishing and social engineering simulations that are tied to our cybersecurity awareness training program, and our workforce is encouraged to report any suspicious activities to our cybersecurity team. The Company also has processes in place to oversee and identify risks from cybersecurity associated with the use of third-party service providers that could impact our business. We review available data related to our third-party service providers and assess the appropriateness of our service providers' cybersecurity programs and practices to ensure risks are properly mitigated. In fiscal year 2025, we commissioned an independent assessment from an accredited firm to evaluate the effectiveness of our cybersecurity program and plan to make adjustments to address the improvement opportunities identified in the assessment. We intend to perform this assessment on a biennial basis going forward.


text: Assessing, identifying and managing cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") program. Cybersecurity-related risks fall within the scope of risks that the ERM program evaluates to assess top risks to the enterprise. Such risks are directly communicated to the Audit Committee on a bi-annual basis, or more frequently as needed. The Audit Committee reports the results of their bi-annual meetings to the Board of Directors at the succeeding Board meeting. To the extent the ERM process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. We have a formal process to annually assess the feasibility, validity and effectiveness of our incident response plans including information technology recovery and business continuity procedures.


text: The Company did not experience a material cybersecurity incident in fiscal year 2025. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and, if deemed necessary, the Board of Directors. Additionally, we plan to consult with outside counsel, as appropriate, on our materiality determinations, our disclosure requirements, and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents, as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks applicable to the Company.


text: The Company maintains a formal Information Security Steering Committee comprised of a cross-functional group of business leaders. This committee meets at least quarterly to discuss performance of the prevention, detection, and mitigation plans that are being carried out by the Company's information security function, as well as the identification of any material new or heightened cybersecurity risks or incidents not already communicated by the CIO and Senior Director of IT.


text: The Board of Directors is responsible for the overall oversight of risk at the Company and has delegated to the Audit Committee the oversight of the risk management strategy specific to cybersecurity. Bi-annual reports regarding cybersecurity are provided to the Audit Committee by the CIO. These reports include information about the prevention, detection, mitigation, and remediation activities related to cybersecurity, any updates to internal processes surrounding cybersecurity, and any other relevant topics or information that allow the Audit Committee to provide proper oversight into cybersecurity risks. Additionally, the Board of Directors receives an annual update on cybersecurity from the CIO, which includes updates on any material cybersecurity incidents, and updates on topics related to cybersecurity both on a broad and company-specific level.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our IT Director, who reports to our Chief Financial Officer and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our IT Director leads our information technology team and regularly reports to our Audit Committee.


text: Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We work with third-party firms to monitor our cybersecurity environment and report findings to executive leadership, internal audit and the Audit Committee regularly.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, certifications, audits and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our IT Director based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by our Chief Financial Officer, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our IT Director has served in various roles in technology leadership for more than 20 years, including cybersecurity. With an undergraduate degree in Information Systems, an MBA, and certification as a Certified Information Systems Security Professional (CISSP) from ISC2, the IT Director plays a key role in managing risks at our company. This includes risks arising from cybersecurity threats, drawing on extensive experience gained from similar companies and leadership positions across the technology sector. Although the Company does not have both a Chief Technology Officer or a Vice President of Security, the IT Director's expertise ensures robust risk management practices are in place. Our Chief Executive Officer, Chief Financial Officer and IT Director each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.


text: Cybersecurity Risk Management and Strategy At Genasys, cybersecurity risk management is integrated into our overall risk management program through regular internal risk assessments and continuous monitoring. Under the leadership of the Information Technology ("IT") Director, IT developed, implemented, and maintain a broad range of processes and protocols designed to monitor, identify, mitigate, and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Our protocols include a third-party provided 24/7 Security Operations Center (SOC), which is designed to oversee our Endpoint Detection and Response (EDR) system and a robust Security Information and Event Management (SIEM) system that aggregates logs for real-time threat detection.

companyName: Genasys Inc.

ticker: GNSS


text: Our cybersecurity risk management program applies information and direction from industry-recognized cybersecurity frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-171, the Department of Defense Cybersecurity Maturity Model Certification (CMMC) Level 2, Sarbanes Oxley (SOX), and Services Organization Controls (SOC) 2. Risks from cybersecurity threats associated with the Company's use of third-party service providers are managed through vendor assessments and SOC 2 report requests, designed to ensure that our partners adhere to strict cybersecurity standards.


text: Notwithstanding the foregoing, we have not identified and are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. See "Risk Factors – Actual or perceived failures or breaches of our information and security systems, or those of our customers, suppliers or business partners, could expose us to losses."


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and includes it as part of the full Board's oversight function. The full Board is updated on cybersecurity risks and compliance with relevant standards and regulations as part of its overall governance responsibilities, including quarterly Board meeting reports. Our Director of IT, who is responsible for the oversight and implementation of the cybersecurity program, also periodically makes presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company. Additionally, we have an escalation process to inform the Board of high-severity cybersecurity incidents that may occur. Our Board also periodically engages independent third-party technology experts to test our information technology systems, including cybersecurity.


text: The Director of IT leads the day-to-day management of cybersecurity at Genasys, supported by a team of two IT professionals with a combined 45 years of IT and cybersecurity experience. This team handles ongoing risk assessments, manages threat detection through our SOC and Security Information and Event Management (SIEM), ensures compliance with industry regulations, and informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy. Management also ensures that employees and contractors undergo quarterly cybersecurity training and phishing simulations, as part of a comprehensive awareness program.


text: We have implemented and continue to maintain a robust cybersecurity program intended to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Leslie's, Inc.

ticker: LESL


text: Our board of directors, with assistance from the audit committee, oversees the Company's management of risks arising from cybersecurity threats. The audit committee regularly reviews the measures implemented by the Company to help identify and mitigate risks from cybersecurity threats. As part of such reviews, the audit committee receives reports and presentations from the CIO and members of our team responsible for overseeing the Company's cybersecurity risk management, including our legal team, which may address a wide range of topics. This includes recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, compliance, privacy, technological trends and information security considerations arising with respect to the Company's peers and third parties. The audit committee also reports to the board of directors at least annually on cybersecurity matters.


text: We have an incident response plan under which certain cybersecurity incidents are escalated within the Company to senior executives on the cybersecurity risk management committee, and, where appropriate, reported to the board of directors and audit committee in a timely manner. At the management level, our cybersecurity risk management committee, comprised of senior executives representing functional and business areas, including our legal team, has broad oversight of the Company's risk management processes. Members of the Company's cybersecurity risk management committee includes certain IT leadership and the General Counsel. The committee meets regularly to discuss the risk management measures implemented by the Company to help identify and mitigate data protection and cyber security risks. Certain IT leadership and the General Counsel attend each cybersecurity risk management committee meeting to report on ongoing cybersecurity matters. Our IT leadership also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: Our CIO, Vice President of Infrastructure and Security, IT Security Director, and cybersecurity engineers have knowledge and experience to effectively implement, monitor, and maintain our cybersecurity posture. This team receives reports on cybersecurity threats from various business teams, and in conjunction with management, regularly reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly conduct penetration and vulnerability testing, security audits, and tabletop exercises. We conduct regular employee training on cybersecurity and provide management reports to monitor training effectiveness. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer that otherwise implicates third-party technology and systems we use. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Cybersecurity threats continue to evolve. We consider cybersecurity threats along with other significant risks that we face within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us.


text: Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our IT systems. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: enGene Holdings Inc.

ticker: ENGN


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have implemented a process to review risks to our Company in connection with certain third-party providers and vendors, which involves assessments through vendor questionnaires, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party IT service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, "Risk Factors," in this Annual Report.


text: Cybersecurity Governance Our cybersecurity program is managed and directed by our Vice President, Information Technology, or IT, who has approximately 20 years of experience in information technology and information systems management. Our Vice President, IT reports to our Chief Financial Officer.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process. Our Board of Directors does not have a standing risk management committee, and administers this oversight function both directly as a whole, and through various standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee is responsible for overseeing the Company's enterprise risk management processes as well as our policies with respect to risk assessment and risk management, which includes cybersecurity risk. A cybersecurity update is provided at least annually, or more frequently as needed, to the Audit Committee by members of management responsible for managing cybersecurity risks.


text: Maintaining a robust cybersecurity strategy to safeguard and protect the confidentiality, integrity and availability of our critical infrastructure assets as well as all other information systems and the information residing in them is critically important to our business. We face various cyber threats, including malware intrusion, computer viruses, unauthorized access attempts, ransomware attacks, social engineering attacks, hacktivism and insider threats. In addition to the cybersecurity threats faced by any business with a cyber presence, as an owner and operator of critical infrastructure assets, we are subject to cybersecurity threats from domestic and foreign threat actors who wish to disrupt our electricity delivery operations and/or the ERCOT bulk power grid. With an ever-increasing share of our operational and administrative activity being dependent on our information systems, we strive to create a company-wide culture of cyber safety that continually monitors risk.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Our Cybersecurity Strategy Our cybersecurity strategy is built on "defense-in-depth" as recommended by the National Institute of Standards and Technology. We have processes in place to identify, assess, and manage material risks from cybersecurity threats. We have developed and implemented, and we continue to develop and implement, protective measures to reduce risk, manage incidents, and sustain our security posture. For example, in our efforts to lower the risk of ransomware attacks, we have increased our cybersecurity operations by strengthening our defense-in-depth approach to protections and controls, operational resiliency, cyber hygiene and monitoring. Specific steps include tool deployments to mitigate ransomware threats and impacts, as well as implementation of practices and enhancements to minimize the risk of ransomware launching and spreading across the organization. An additional protective measure to reduce risk with respect to the unauthorized access to confidential and sensitive data in Oncor's possession includes our data risk management (DRM) program. Our DRM program focuses on data loss prevention, including as the result of unauthorized access or acquisition, by taking proactive steps to limit confidential and sensitive information from being managed or distributed electronically in an unsecure manner. Led by our executive leadership team, as well as a governance committee and operational stakeholders, our DRM group provides formal guidance, including policies and standards, to reduce our data risk. We continue to participate, review, assess and adjust our mix of activities to improve our grid operations, digital perimeter security and information security.


text: We have policies and procedures in place to identify, protect, detect, respond and recover from cybersecurity incidents. The life cycle of our incident response includes: (i) preparation through employee training and drills, including regular simulation exercises that include management from various departments in addition to representatives from our information technology security team; (ii) detection and analysis of the cybersecurity incident; (iii) assembling the appropriate response team and escalating the incident to the appropriate parties internally and externally; (iv) containment, eradication, recovery and monitoring; and (v) post incident activity to document the root cause and discuss areas of improvement.


text: In accordance with our policies and procedures, we investigate any technological, computer, or network security event or incident within our networks or involving confidential and sensitive data maintained by Oncor, including events or incidents involving third-party vendors that interface with our networks or otherwise hold confidential and sensitive data maintained by Oncor. With respect to certain of our third-party vendors, we may also require such third-party vendors to notify us of any cybersecurity incident that may impact our operations or involve confidential and sensitive data maintained by Oncor. Multiple security operations centers monitor our digital environment at all times for anomalies, threats, and indicators of compromise. We have a variety of tests performed by internal and external parties related to the integrity of our networks, cyber protections and policies and procedures. Third-party security tests of our network, applications, perimeter, physical equipment and other areas of security are used to test cybersecurity readiness. When a cybersecurity threat either newly materializes or escalates, we elevate communication both internally and externally to ensure situational intelligence is both known and shared to help in defending against that threat.


text: We are also subject to mandatory and enforceable regulatory standards for critical infrastructure protection, which include cybersecurity-related standards. We are subject to periodic audits by Texas RE of our compliance with critical infrastructure protection standards.


text: We also participate in, and work with, multiple federal, state, industry, and academic groups dedicated to cybersecurity, such as the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency, the Federal Bureau of Investigations' InfraGard, an ERCOT critical infrastructure protection working group, the Electricity Information Sharing and Analysis Center, and the Texas Information Sharing and Analysis Organization. This includes information-sharing and coordination with ERCOT, the PUCT, and other ERCOT market participants with a view toward protecting and enhancing the ERCOT grid from cyber and physical attacks and response preparation. In addition, we participate on various technical and advisory boards, such as the advisory board of the Energy Sector Security Consortium, Inc., a nonprofit organization that supports energy sector organizations with the security of their critical technology infrastructures, and the Electricity Subsector Coordinating Council. We believe that our participation and membership within these groups and organizations contributes to security improvements that directly impact our cyber operations.


text: We believe that cyber safety is everyone's responsibility at Oncor. We take proactive steps to train, re-train, educate and test our workforce on cyber safety practices and work to strengthen the cyber community within our company. We require an annual cybersecurity training of all credentialled individuals and in October 2023 we held our 2nd annual cyber awareness month, which included informational events, speakers and additional training resources to increase our workforce's engagement in cyber safety.


text: While we have not experienced a cybersecurity incident to date that has had a material impact on Oncor, we have experienced, and expect to continue to experience, threats and attempted intrusions into our technology systems and platforms. Our third-party vendors have been subject, and will likely continue to be subject, to acts that disrupt or attempt to disrupt the services they provide to us. Threat actors could also attempt to use our third-party vendors as a conduit to attack us. We are subject to evolving cyber risks related to adversaries attacking our technology infrastructure and platforms and the technology infrastructure and platforms of third-party vendors. See "Item 1A. Risk Factors—Cyber-attacks on us or our third-party vendors could disrupt business operations, initiate the loss or disclosure of critical operating or confidential data, have an adverse impact on our reputation, and expose us to significant liabilities." A future cybersecurity incident could potentially have a material impact on our business, operations and financial condition. In addition, non-compliance with electric industry specific regulations or violation of laws could have financial penalties, as well as impact our reputation, which could materially impact our results of operations or financial condition. Cybersecurity risk has also contributed to, and is expected to continue to contribute to, increased capital expenditures and operation and maintenance expenses, including as a result of the need for additional hardware, software, equipment, personnel, training and third-party service providers, as well as increased cyber insurance costs.


text: Cybersecurity risk is considered a significant corporate risk by management. Our technology security team provides our management with a weekly cyber update that discusses cybersecurity threats impacting Oncor. Management of our cybersecurity risks begins at the individual employee level, with each employee having responsibility for operating in a cyber safe manner, and flows up to our board of directors, which has overall oversight over Oncor's corporate risk management efforts. The board of directors has delegated its risk management oversight to the Audit Committee, whose charter provides that it is responsible for discussing with management our major risk exposure, and the steps management takes to monitor and control such exposure, including our risk assessment and risk management process, guidelines, policies and practices.


text: Our Cybersecurity Team Our management is responsible for assessing, managing and mitigating all risks relative to our business, including material risks from cybersecurity threats. Within our management team, assessment, management, and mitigation of cybersecurity threats is primarily overseen by our technology group, which has extensive experience in cybersecurity, technology, and digital grid operations. Our technology group is led by Joel Austin, our senior vice president and chief digital officer, and Malia Hodges, our senior vice president and chief information officer. Mr. Austin has over 34 years of technology operations, utility industry, and leadership experience, including more than 15 years of cybersecurity oversight experience. Ms. Hodges has 25 years of technology operations, utility industry, and leadership experience, including six years as our chief information officer, with responsibility in that role for management of Oncor's technology function, including cybersecurity. Both Mr. Austin and Ms. Hodges are long-time members of the Edison Electric Institute security and technology policy committee, which focuses on working with federal agencies on cybersecurity risks relevant to the electric industry. Mr. Austin has testified on cybersecurity issues facing the State of Texas and the electric utility industry in front of multiple Texas legislative sub-committees and been asked to discuss cybersecurity risks with members of the US Congress. Mr. Austin and Ms. Hodges also work closely and regularly with PUCT staff and PUCT commissioners on cybersecurity risks and mitigations. We also have a designated chief information security officer who has over 42 years of experience in cybersecurity, a master's degree in cybersecurity and a doctorate degree in cybersecurity/information assurance. Within our technology group, we maintain a dedicated cybersecurity group and 24/7/365 team that responds to and protects against cybersecurity risks. Our collective cybersecurity staff consists of a group of employees and contractors located inside and outside the state of Texas with a wide range of specialized skills and experience, including through service in the United States military and federal agencies, cybersecurity-related certifications, membership and advisory and board positions with industry groups and non-profit organizations focused on cybersecurity, and training in the cyber defense tools and methods we deploy, as well as various higher education degrees related to cybersecurity.


text: Our senior leadership team, which includes Mr. Austin and Ms. Hodges, has established a risk management framework to actively manage, mitigate and report on the various risks faced by Oncor. Pursuant to that framework, as frequently as necessary, but not less than quarterly, our chief risk officer, members of our senior leadership team and additional members of management meet to review and assess various operational, functional, legal and other types of risks facing the company, including risks related to cybersecurity. Discussions at these risk management forums include mitigation strategies and actions to provide oversight and assign responsibility for ongoing treatment and monitoring each specific risk. Risk management information collected at these meetings is then distributed at least quarterly to the Audit Committee of our board of directors as well as our full board of directors. In addition, our chief risk officer reports on these risk management efforts, including risks related to cybersecurity, to the Audit Committee and/or the full board of directors at least quarterly. In addition, Mr. Austin and Ms. Hodges also provide separate written reports on cybersecurity risks and activities to both the Audit Committee and the full board of directors, with specific discussion time devoted to cybersecurity at the Audit Committee and/or the full board of directors at least quarterly.


text: Maintaining a robust cybersecurity strategy to safeguard and protect the confidentiality, integrity and availability of our critical infrastructure assets as well as all other information systems and the information residing in them is critically important to our business. We face various cyber threats, including malware intrusion, computer viruses, unauthorized access attempts, ransomware attacks, social engineering attacks, hacktivism and potential insider threats. In addition to the cybersecurity threats faced by any business with a cyber presence, as an owner and operator of critical infrastructure assets, we are subject to cybersecurity threats from domestic and foreign threat actors who wish to disrupt our electricity delivery operations and/or the ERCOT bulk power grid. With an ever-increasing share of our operational and administrative activity being dependent on our information systems, we strive to create a company-wide culture of cyber safety that continually monitors risk.


text: Our Cybersecurity Strategy Our cybersecurity strategy is built on "defense-in-depth" as recommended by the National Institute of Standards and Technology. We have processes in place to identify, assess, and manage material risks from cybersecurity threats. We have developed and implemented, and we continue to develop and implement, protective measures to reduce risk, manage incidents, and sustain our security posture. For example, in our efforts to lower the risk of ransomware attacks, we have increased our cybersecurity operations by strengthening our defense-in-depth approach to protections and controls, operational resiliency, cyber hygiene and monitoring. Specific steps include tool deployments to mitigate ransomware threats and impacts, as well as implementation of practices and enhancements to minimize the risk of ransomware launching and spreading across the organization. These efforts also include the ongoing identification, review and mitigation of vulnerabilities to our owned or operated systems. An additional protective measure to reduce risk with respect to the unauthorized access to confidential and sensitive data in Oncor's possession includes our data risk management (DRM) program. Our DRM program focuses on data loss prevention, including as the result of unauthorized access or acquisition, by taking proactive steps to limit confidential and sensitive information from being managed or distributed electronically in an unsecure manner. Led by our executive leadership team, as well as a governance committee and operational stakeholders, our DRM group provides formal guidance, including policies and standards, to reduce our data risk. We continue to participate, review, assess and adjust our mix of activities to improve our grid operations, digital perimeter security and information security. For example, we are evaluating and implementing additional governance focused defensive measures as a result of new National Institute of Standards and Technology guidance.


text: In accordance with our policies and procedures, we investigate any technological, computer, or network security event or incident within our networks or involving confidential and sensitive data maintained by Oncor, including events or incidents involving third-party vendors that interface with our networks or otherwise hold confidential and sensitive data maintained by Oncor. With respect to certain of our third-party vendors, we may also require such third-party vendors to notify us of any cybersecurity incidents and/or vulnerabilities that may impact our operations or involve confidential and sensitive data maintained by Oncor. Multiple security operations centers monitor our digital environment at all times for anomalies, threats, and indicators of compromise. We have a variety of tests performed by internal and external parties related to the integrity of our networks, cyber protections and policies and procedures. Third-party and internal security testing of our network, applications, perimeter, physical equipment and other areas of security are used to test cybersecurity readiness. When a cybersecurity threat either newly materializes or escalates, we elevate communication both internally and externally to ensure situational intelligence is both known and shared to help in defending against that threat.


text: We are also subject to mandatory and enforceable regulatory standards for critical infrastructure protection, which include cybersecurity-related standards. We are subject to periodic audits by Texas RE of our compliance with critical infrastructure protection standards. In addition, we are required to file an emergency operation plan with the PUCT, including our procedures relating to addressing cyber incidents.


text: We believe that cyber safety is everyone's responsibility at Oncor. We take proactive steps to train, re-train, educate and test our workforce on cyber safety practices and work to strengthen the cyber community within our company. We require an annual cybersecurity training of all credentialled individuals, and each year we hold an annual cyber awareness month, which includes informational events, speakers and additional training resources to increase our workforce's engagement in cyber safety.


text: While we have not experienced a cybersecurity incident to date that has had a material impact on Oncor, we have experienced, and expect to continue to experience, threats and attempted intrusions into our technology systems and platforms. Our third-party vendors have been subject, and will likely continue to be subject, to acts that disrupt or attempt to disrupt the services they provide to us. Our technology team works to evaluate third-party solutions purchased, implemented or upgraded to ensure they meet our cybersecurity requirements. Threat actors could also attempt to use our third-party vendors as a conduit to attack us. We are subject to evolving cyber risks related to adversaries attacking our technology infrastructure and platforms and the technology infrastructure and platforms of third-party vendors. See "Item 1A. Risk Factors—Risk Related to Our Business and Operations—Cyber-attacks on us or our third-party vendors could disrupt business operations, initiate the loss or disclosure of critical operating or confidential data, have an adverse impact on our reputation, and expose us to significant liabilities." A future cybersecurity incident could potentially have a material impact on our business, operations and financial condition. In addition, non-compliance with electric industry specific regulations or violation of laws could have financial penalties, as well as impact our reputation, which could materially impact our results of operations or financial condition. Cybersecurity risk has also contributed to, and is expected to continue to contribute to, increased capital expenditures and operation and maintenance expenses, including as a result of the need for additional hardware, software, equipment, personnel, training and third-party service providers, as well as increased cyber insurance costs.