text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our management team, including our CIO and our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and CISO collectively have over five decades of IT and cybersecurity experience in technology companies, including two decades in senior-level leadership roles. Additionally, our CISO holds Certified Information Security Manager and Certified in Risk and Information Systems Control certifications, They are assisted by a cross-functional Information Security Steering Committee.

companyName: EXTREME NETWORKS INC

ticker: EXTR

secItem: Item 1C

stage1Category: Management Role

stage1Method: majority


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

stage1Category: Risk Management Process


text: Overview and Leadership The Company maintains a company-wide risk management system focused on detecting, identifying, defending against and mitigating the impact of cybersecurity risks in order to guard our information technology systems and protect the confidentiality, integrity, and availability of our information technology processes and data. Our Board of Directors (the "Board") is responsible for the oversight of cybersecurity risks, including through the delegation of certain cybersecurity oversight authority to the Audit Committee of the Board.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS

stage1Category: Board Governance

stage1Method: unanimous


text: The Company's information security function and management team is led by our Vice President of Information Technology and Cybersecurity, who has approximately 38 years of experience in the information technology area and holds the CISM certification, and our Senior Director of Information Technology Infrastructure and Cybersecurity, who has approximately 25 years of experience in the information technology area and holds CISSP, CCSP, CISM, and OSCP certifications.


text: The information security team is responsible for monitoring, managing and assessing cybersecurity risks and threats on a day-to-day basis. In particular, the information security team monitors, assesses and mitigates threats and is responsible for improving and strengthening the Company's cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel as part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including for consideration of whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.


text: The information security team undertakes or engages in the following practices and activities, among others, as part of the Company's risk management system: • updating of software and hardware (including firmware) for vulnerabilities and required patches; • regular employee training and education to identify and avoid cybersecurity risks and threats at each level of the organization; • developing, implementing and testing incident response and information recovery plans to assess and respond to cybersecurity threats and incidents; • collaborating with our internal audit function and other internal teams for the testing of cybersecurity controls and procedures; • identifying and managing cybersecurity risks presented by third parties, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to the Company's systems and data; as well as the systems of third parties that could adversely impact our operations or business in the event of a cybersecurity incident affecting those third-party systems; • overseeing threat intelligence systems and notification procedures; and • maintaining technology solutions for cybersecurity prevention and defense, including outside firewalls, multifactor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls.


text: Use of Third Parties The Company has engaged, and intends to continue to engage, nationally recognized third parties to assist the Company in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.


text: We also have engaged a nationally recognized third party to assist with a tabletop exercise to test our readiness in respect to certain of the preceding events and risks. When risks or threats are identified to the Company by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: The AEOC regularly discusses with management, including our Chief Technology Officer, our enterprise risk management process, including our cybersecurity exposures, the steps management has taken to monitor and control such exposures and guidelines and policies to govern our risk assessment and risk management processes. The AEOC periodically reports to the Board regarding significant matters identified with respect to the foregoing, including, among others, our risk assessment and risk management approach to cybersecurity.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Impact of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material impact on the Company's results of operations and financial condition. As described above under "Item 1A Risk Factors "Technology Disruptions, Failures or Breaches, Hacking Activity, Ransomware Attacks or Other Cybersecurity Events Could Materially and Adversely Affect Our Financial Condition and Results of Operations" a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial damage, in addition to litigation or remediation costs or penalties.

stage1Category: Strategy Integration


text: Governance Overview The Board oversees cybersecurity risk through multiple methods. The Audit Committee of the Board has been delegated certain cybersecurity oversight responsibility and, among other things, receives quarterly updates and presentations from the information security team regarding the Company's cybersecurity environment, cybersecurity risks and threats, cybersecurity projects the Company has implemented and plans to implement and other cybersecurity developments, and such committee reports to the full Board after each meeting. In addition to these quarterly reports to the Audit Committee, the information security team provides a presentation to the Board at least annually regarding the same topics covered with the Audit Committee. In addition, members of the Company's internal audit team have certain responsibilities with respect to projects designed to test the Company's cybersecurity controls and improve the overall cybersecurity environment.


text: The Company also has a Risk Assessment Committee composed of selected members of senior management. Member(s) of the information security team are members of this Risk Assessment Committee (which occur at least quarterly) to address cybersecurity risks and discuss cybersecurity threats to the Company. Member(s) of the information security team have the opportunity to present at the Risk Assessment Committee meetings and raise issues and concerns regarding cybersecurity. The minutes of Risk Assessment Committee meetings are provided to the Board and the General Counsel discusses with the Board the matters addressed at the applicable Risk Assessment Committee meeting.


text: Risk Management and Strategy The Company's cybersecurity program is part of its overall risk management framework. The cybersecurity risk program includes a risk-based approach to identifying, assessing, and addressing cybersecurity threats that could impact our data, our networks, or the information provided to us by consumers and counterparties.

companyName: QUINSTREET, INC

ticker: QNST


text: 1. Cybersecurity Risk Management Program – The Company's cybersecurity risk management program includes the following activities: • Regular Security Committee meetings where the head of Information Security briefs the Security Committee on cybersecurity threats and responses, strategies and initiatives relating to cybersecurity, and roadmaps for improving the Company's cybersecurity. • Training employees on cybersecurity upon hire, and at least annually, with more detailed training provided to those employees that have greater access to data and systems. • Over two dozen Information Security policies that focus on specific aspects of our cybersecurity risk management (e.g., Vendor Management).


text: The Company's Information Security team is responsible for the Company's cybersecurity risk management program. Their Information Security policies contain processes and templates which are intended to set standards, assign specific roles and responsibilities with respect to our information security environment, and categorize threats and map them to responses as required by law and contract.


text: 2. Third Party Support – In addition to the internal tests and recurring audits our Information Security team performs on our systems, the Company also engages external consultants and auditors. For example, the Company engages third party auditors to obtain SOC 2 Type II Certification. Furthermore, the Company regularly works with third party consultants to perform penetration tests. These third-party engagements supplement internal tests and audits as detailed in our Information Security policies.


text: 3. Training and Screening of Employees – The Company provides all Information Security policies to new hires. In addition, new hires are required to complete security awareness training which contains cybersecurity principles. Employees must also complete annual security awareness training, with additional and dedicated cybersecurity training for employees with access to more data and systems. As a part of hiring employees and contractors, background checks are performed that involve varying levels of depth depending on the employee's or contractor's level of data and system access.


text: 4. Third Party and Vendor Management – The Company's Information Security team has established policies and processes to identify and oversee cybersecurity risks associated with using third party service providers and vendors. These include the following elements: • Access Control: The principle of least privilege is applied to manage user's access of Company's resources. User access is reviewed at least quarterly. • Vendor Management: One of the Company's Information Security policies is its Vendor Management Policy. This policy includes conditions for vendor evaluation, how the Company performs its evaluation, and steps for monitoring thereafter. • Privacy Impact Assessments: The Company's employees are trained to submit a Privacy Impact Assessment for review when there may be new access by a third-party to certain data or the Company may share information in a new way. The Privacy Impact Assessment is reviewed by the Information Security team to assess whether the proposed practices are manageable within the Company's cybersecurity environment.

stage1Category: Third-Party Risk


text: Impact of Cybersecurity Risks on Business Strategy, Results of Operations or Financial Condition Substantially all of the Company's business is conducted online. Accordingly, there is a risk that a cybersecurity incident that impacts our ability to conduct business online (including any loss of confidence by consumers and counterparties in our information security practices or capabilities) could have a material adverse impact on our business strategy, results of operations or financial condition. The Company's approach to the management and mitigation of cybersecurity risks reflects the online nature of our business. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. As part of the Company's overall risk mitigation strategy, we maintain cyber liability insurance coverage. Such coverage, however, may not be sufficient to cover us against related claims. For additional information, see "Risks Related to our Business and Industry," in Item 1A, "Risk Factors" in this Annual Report.


text: Cybersecurity Governance Pursuant to the Audit Committee Charter, the Audit Committee reviews management's assessments of, and plans with respect to, the Company's cybersecurity and other enterprise risks. The Audit Committee typically receives updates from a Security Committee member quarterly with respect to Information Security team activities.


text: The Company's Information Security team is responsible for identifying, assessing, and mitigating cybersecurity risks. The Information Security team reports to the head of Information Technology, who reports to the Chief Technical Officer who reports to the Chief Executive Officer. The Information Security team also briefs the Security Committee (which consists of the Chief Technical Officer, CEO, CFO and Chief Legal Officer) regularly about the cyber threat landscape, their plans to mitigate cybersecurity risks and their responses to cybersecurity incidents.


text: Risk Management and Strategy As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify, and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data security threats within our environment. In the event we identify a potential cybersecurity or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, the Board, other stakeholders and law enforcement when responding to such issues.

companyName: UNIFI INC

ticker: UFI


text: The Company's enterprise cybersecurity program focuses on vulnerability management, access management, and user awareness training. Among other things, the Company implements scheduled patching and system updates and proactively scans for vulnerabilities. We regularly engage qualified third-party experts to assess the Company's information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement. The Company utilizes industry-standard technologies, processes, and capabilities designed to protect our systems and data and to detect potential suspicious activity. We provide cybersecurity training and user education on a regular basis for users with access to the Company's information technology systems. We conduct monthly social engineering tests to promote phishing awareness and security awareness. The Company monitors servers and endpoint devices across the organization to detect signs of a cyberattack. We maintain and practice a response and recovery plan to restore systems and data. We also maintain cyber liability insurance against cyber-attacks as part of our comprehensive insurance portfolio. Because we are aware of the risks related to third-party service providers, we have implemented processes to oversee, identify, and manage risks from cybersecurity threats associated with our most significant third-party service providers.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For the years presented, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that had, or were reasonably likely to have, a material affect on the Company, including our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see "Operational Risks - Our business and operations could suffer in the event of cybersecurity breaches," in "Item 1A. Risk Factors" in this report.


text: Day-to-day management of cybersecurity risk is performed by the Company's Information Technology Security Team with direct oversight from the Chief Information Officer (the "CIO"). The Company's incident response plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CIO, who further escalates critical or high severity events to the Company's Cyber Incident Steering Committee (the "CISC"), which consists of the CIO, the Chief Financial Officer, the General Counsel, and the Internal Audit Manager. Additional senior management from relevant business units are included as needed based on the nature of identified cybersecurity incidents. The CISC is responsible for providing support, guidance, and oversight of UNIFI's incident response, including making a determination of materiality to evaluate the need for escalation and disclosure. The materiality evaluation is made using the framework established in the federal securities laws, with a focus on the importance of the information to a reasonable investor.


text: The Board recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee, and vendor information, as well as non-public information about UNIFI. Although the Board as a whole is ultimately responsible for the oversight of our risk management function, the Board uses its committees to assist in its risk oversight function. The Audit Committee of the Board has primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and other technology issues.


text: The Audit Committee regularly reviews our cybersecurity and other technology risks, controls and procedures. The Audit Committee receives reports from the CIO quarterly regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. The Company's Information Technology Security Team and its cybersecurity infrastructure is overseen by the CIO who reports to the Chief Executive Officer. The CIO has served in various roles in information technology for over 29 years.


text: Furthermore, UNIFI management prepares, and the Audit Committee reviews and discusses, a quarterly assessment of our risks on an enterprise-wide basis. We conduct a rigorous enterprise risk management program that is updated quarterly and is designed to bring to the Audit Committee's attention our most critical risks for evaluation, including cybersecurity risks.


text: Risk Management and Strategy Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications, or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier and partner information that we collect and store.

companyName: SYNAPTICS Inc

ticker: SYNA


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Information Security team monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, assessing and prioritizing risks, employing various tools and techniques, including vulnerability scanning and penetration testing. Based on the risk assessment, appropriate security measures are implemented. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the heading "We face risks associated with security breaches or cyberattacks," included as part of our risk factors disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K.

stage1Category: None/Other


text: In the last three fiscal years, we have not experienced a cybersecurity incident which has been determined to be material, and the expenses we have incurred from cybersecurity incidents and threats were immaterial, including penalties and settlements, of which there were none.


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee biannually reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports its findings to the full Board of Directors. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the Chief Information Security Officer ("CISO") and Sr. Director of Internal Audit on a biannual basis. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer, Chief Information Officer, and Chief Legal Officer may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.


text: We have an Information Security Management Steering Committee (the "ISMS Committee"), comprised of our CISO, as well as members of our executive team, including our Chief Information Office and Chief Legal Officer. Our Chief Information Officer and CISO, in coordination with the ISMS Committee, work collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our InfoSec team communicates with and reports to the CISO, enabling the CISO, CIRT, and ISMS Committee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO has over 28 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.


text: Cybersecurity Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and to protect the confidentiality, integrity, and availability of our and our client's data and information assets. As such, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Intapp, Inc.

ticker: INTA


text: We design our program based on industry standard cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Also, our cloud services comply with numerous internationally recognized standards, such as ISO 27001, ISO 27017, ISO 27108, SOC 2 and CSA STAR.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including through the use of third-party providers for regular mandatory trainings; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: When we experience cybersecurity incidents, we promptly activate incident response protocols and commence investigation of the incident. We may notify law enforcement and engage third-party professionals, as appropriate, as part of our incident response and/or investigation. Based on our assessments, we have not identified any cybersecurity threats that have had a material impact during the last fiscal year, and we do not believe these incidents have materially affected or will materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of the Company's enterprise risks, including cybersecurity and other information security risks. The Committee oversees management's implementation of our cybersecurity risk management program. Also, the Company created a Risk Management Working Group which meets no less than quarterly and which receives updates on the Company's cybersecurity risk management program and cybersecurity risks from the Chief Information Security Officer ("CISO"). The Risk Management Working Group includes two Audit Committee members, certain members of senior management and the CISO.


text: The Committee receives quarterly reports on our cybersecurity risks from the Risk Management Working Group. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports quarterly to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings on our cyber risk management program, including from our CISO.


text: Our team of experienced cybersecurity professionals has primary responsibility for our overall cybersecurity risk management program, including assessing and managing material risks from cybersecurity threats. Our CISO, Mark Schertler, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Schertler has over 40 years of experience in the field of cybersecurity. Mr. Schertler leads a team of experienced cybersecurity professionals who have extensive experience in the field of cybersecurity, including experience in cybersecurity consulting, cloud security, principal security architect, application security and as a chief technology officer.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management framework considers cybersecurity risk alongside other applicable risks as part of our overall risk assessment process. Within our comprehensive enterprise risk management framework, our cybersecurity risk management program is focused on assessing, identifying, and managing risks arising out of our use of information technology ("IT") including the risk of cybersecurity incidents and threats. The program is informed by recognized frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to raise and maintain its maturity across the elements of NIST CSF.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Our cybersecurity risk management program includes a Cyber Security Incident Response Plan ("CSIRP"). Our CSIRP supports the Company in identifying, containing, and tracking cybersecurity incidents experienced by us or our third-party service providers or suppliers. The CSIRP was established to minimize the impact of cybersecurity incidents on our networks, IT systems, users and business processes, and to ensure the timely and accurate reporting of material cybersecurity incidents, should they occur. The execution of our CSIRP is led by our Chief Information Officer and Head of Business Services ("CIO"), with support from a designated IT Incident Response Manager leading an Incident Response Team consisting of subject matter experts, as well as our Executive Response Team when appropriate. In the event of an incident, these individuals work together to assess its severity, notify and brief the appropriate team members, escalate to our Board of Directors as needed, and implement containment procedures. The Company also conducts tabletop exercises to enhance incident response preparedness and engages third parties, including consultants and other professionals, on an as-needed basis to assess and support our cybersecurity practices and procedures.


text: Our cybersecurity risk management program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, which includes information about how to identify and report cybersecurity concerns and incidents. Our information technology organization also conducts phishing simulations and testing scenarios to help ensure compliance with our cybersecurity policies and procedures. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our information technology organization.


text: We maintain business continuity and disaster recovery plans to prepare for potential information technology disruptions. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures. Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors – Risks Related to Cybersecurity and Technology" for further information about these risks.


text: Cybersecurity Governance Our Board of Directors has risk oversight responsibility for the Company, which it administers directly and with assistance from its committees. The Audit Committee assists the Board in its oversight of the cybersecurity risk management program. The Audit Committee is tasked with reviewing and receiving periodic reports from management regarding the Company's information technology system controls and security and, at least annually, evaluating the adequacy of the Company's information technology security program, compliance, governance processes, training and controls. The Audit Committee specifically oversees: • management's evaluation of the potential impact of cybersecurity risk exposures on the Company's business, financial results, operations and reputation, • the steps management has taken to monitor and mitigate such exposures, • major legislative and regulatory developments that could materially impact such exposure, and • the Company's incident response planning (including escalation protocols), including with respect to the prompt reporting of material cybersecurity threats or incidents to management, the Audit Committee and the Board of Directors.


text: Our CIO periodically provides the Executive Leadership Team, which consists of the Company's executive officers and other senior leaders, with cybersecurity briefings, information and trainings, and updates the Audit Committee on cybersecurity biannually or more frequently as appropriate. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend changes regarding controls or procedures to management. Our CSIRP includes a process for incidents to be evaluated for material impact, with an escalation protocol requiring reporting of material incidents to the Executive Response Team and to the Board of Directors.


text: The CIO is the management position with primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. The CIO has deep experience in information systems and technology, including developing information and cybersecurity programs, roll-outs of new technology, information security audit and assessments, and cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CIO has experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CIO joined the Company in 2020, bringing over 15 years of experience leading IT strategy and change initiatives in the consumer packaged goods industry, and reports directly to our CEO.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by GECM. In order to assess, identify and manage material risks from cybersecurity threats, GECM has implemented a cybersecurity program for GEG and its subsidiaries, which is focused on (i) protecting the confidentiality of business, client, fund investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Great Elm Group, Inc.

ticker: GEG


text: GECM has implemented an information security policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that it stores or processes and the maintenance of critical services and systems. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. GECM's policies and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. GECM's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: (1) cybersecurity risks associated with its physical and digital devices and infrastructure, and (2) cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. This program is based on recognized industry standards and is supported by both management and our Board. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use recognized industry standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by GECM's Chief Operating Officer, IT Specialist and other members of Company management (together, Great Elm IT Management) and their third-party consultants. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires these parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs annual reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.


text: GECM also provides its employees with cybersecurity awareness training at onboarding and semiannually, as well as interim security reminders and alerts. GECM's third-party consultants conduct regular phishing tests and provide additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by Great Elm IT Management. The members of the Great Elm IT Management team collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. Great Elm IT Management is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by Great Elm IT Management, with support from their third-party consultants. Great Elm IT Management alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing its severity and determining potential responses, as well as communicating with business leaders and senior management, and the Board, as appropriate.


text: Our Board monitors cybersecurity risk as part of Great Elm's overall risk management program. Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of the fiscal year ended June 30, 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our security approach is aligned with applicable security and/or technical requirements and best practices established by multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. This does not imply that we meet any particular technical standards, specifications or requirements, only that our information security team uses the NIST CSF, ISO 27001 and other frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management, regarding phishing, malware and other cyber risks; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Part 1, Item 1A. "Risk Factors - Risks Related to Our Business – Our business operations could be negatively impacted by an outage or breach of our information technology systems, network disruptions, or a cybersecurity event."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser potential impact. The Committee members also receive presentations on cybersecurity topics from our Chief Information Officer ("CIO"), who also serves as our Chief Information Technology Architect & Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our cybersecurity management team, lead by our CIO, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and reports produced by security tools deployed in the IT environment. Our CIO reports to the Company's Chief Executive Officer, as well as to the Board and Audit Committee. The CIO has served as our CISO for three years and has more than 20 years of experience in various roles involving managing cybersecurity functions, developing strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CIO holds a bachelor's degree in computer science and various certifications which include Certified Ethical Hacker and Certified Chief Information Security Officer, and has 25-plus years of previous software and hardware systems engineering experience.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all areas of the business. The cybersecurity risk management program is designed to align with industry best practices and has adopted the framework and measurement practices developed by the National Institute of Standards and Technology (NIST). In addition, the Company has implemented a cross-functional cybersecurity steering team to facilitate coordination across key departments and assists in defining policies, procedures, and mitigation strategies, and will be called on to assist in risk assessment of any threat or incident.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: Management of the Company, including the CCO, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: The Company has a written Emergency Action Plan that includes the handling of material cybersecurity incidents and business continuity if there is a disruption in operations. The Company utilizes a third-party cybersecurity partner to assist in monitoring our systems 24 hours a day, and to structure the technical handling of cybersecurity threats and incidents. In addition, the partner is utilized to regularly conduct formal penetration testing and tabletop exercises used to further prepare the organization. This partner also provides ongoing insights and advisory services in order to better align our program with current best practices. The Company uses a variety of processes to address risk associated with the use of third-party service providers. All employees, including anyone with access to Company-provided email accounts, must engage in quarterly cybersecurity awareness training and are tested internally on a regular basis. Additionally, we maintain cyber insurance coverage, including protection to further mitigate potential financial losses from cybersecurity incidents.


text: As of the date of this Annual Report on Form 10-K we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our best efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion.


text: The Board of Directors is responsible for the oversight of our cybersecurity risk management program. On a quarterly basis, our Chief Information Officer (CIO) provides a cybersecurity status report and update to the Board of Directors, which includes a scorecard of cybersecurity threats, updates on key initiatives, and any changes in trends that may impact the Company. The CIO reports directly to the President and Chief Executive Officer (CEO) and meets regularly with him, the Chief Financial Officer, and other members of the Executive Leadership Team. The CIO has over 25 years of experience in IT Operations and is supported by an internal Director of IT Security and a virtual Chief Information Security Officer (vCISO) service to ensure comprehensive focus on the program.


text: The Emergency Action Plan defines the handling of cyber related incidents with support of the cross-functional steering team to assess the potential materiality of cybersecurity events and to report on the detection, analysis, and containment from such events. As the severity of events meet certain levels as specified by the Incident Response Plan, those events are escalated to senior levels of management and reported to the Board of Directors. Our Board of Directors is responsible for the oversight of controls and procedures related to the public disclosure of material cybersecurity incidents.


text: We take cybersecurity threats seriously, including regular assessment of cybersecurity risks both internally and with third party assistance and updates to the Board of Directors at least annually. We use the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as the basis for the information security management system. As we implement new technologies, the NIST CSF is used as the guiding framework. Among other best practices, we use multi-factor authentication wherever possible for external access to systems, assess and update current versions of security solutions, perform regular cybersecurity training and email phishing campaigns for employees, use third parties to perform external penetration testing, and maintain disaster recovery and incident response plans, which include retainer contracts for third party cybersecurity response specialists. We employ a combination of methods to monitor for new or developing cybersecurity risks.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: The Board regularly receives reports and training from management and third parties on cybersecurity matters. Management is responsible for developing cybersecurity programs, as may be required by applicable law or regulation. Our cybersecurity personnel have the appropriate expertise in IT and cybersecurity, which generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. Our cybersecurity personnel, along with third parties, monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above. Incidents, if any, are escalated to management and the Board according to our incident response policy. There have been no material cybersecurity incidents in the periods presented.


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Bitcoin Cash Trust (BCH)

ticker: BCHG


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Sponsor or the Trust during the year ended June 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Litecoin Trust (LTC)

ticker: LTCN


text: To prevent, detect and respond to information security threats, the Manager maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Manager, receives regular reports from the CISO on, among other things, the Manager's cyber risks and threats, the status of projects to strengthen the Manager's information security systems, assessments of the Manager's security program and the emerging threat landscape.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: Our Audit Committee assists the Board in overseeing cybersecurity risks, including discussing with management and the information security team if cybersecurity threats are identified, and recommends cybersecurity framework improvements to the Board.

companyName: SemiLEDs Corp

ticker: LEDS


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Manager's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Manager about any information security incidents that may pose a material risk to the Manager. The Manager contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Manager's Security Awareness Program includes training that reinforces the Manager's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Manager's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Manager administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Manager or the Fund during the year ended June 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks Cybersecurity is integrated within the Company's Enterprise Risk Management process, which is the Company's systematic approach to identifying, managing and assessing major risk and safeguards, including cybersecurity. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas. Despite our efforts we put into maintaining a high level of cybersecurity, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We periodically conduct assessments of cybersecurity risks to identify potential vulnerabilities and threats to our systems and data. These risk assessments are designed to help identify material risks from cybersecurity threats to our critical systems and information.


text: We have established a security team which is principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents.


text: Protection Measures We implement and maintain cybersecurity controls, including firewalls, access controls, and intrusion detection systems, to safeguard our systems and data from unauthorized access, use, or disclosure. Furthermore, we use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.


text: Incident Detection and Response We have established a cybersecurity incident response plan that includes procedures for responding to relevant cybersecurity incidents. These protocols include incident response plans and escalation procedures to minimize the impact of potential breaches.


text: Cybersecurity Training and Awareness All new hires receive cybersecurity awareness training. All employees, including incident response personnel and senior management, receive periodic training and are periodically subject to evaluations to confirm their cybersecurity knowledge and awareness.


text: Third-Party Risk Management We have implemented a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Material Cybersecurity Incidents We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors" within this report when evaluating our business and related risk.


text: Cybersecurity Governance The Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company's cybersecurity, information security, and information technology risks. On an annual basis, the Audit Committee reviews and discusses with the Chief Financial Officer, who leads our cybersecurity program, the Company's policies, procedures, and practices with respect to cybersecurity, information security and information and operational technology, including related risks.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board of Directors considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, our Chief Financial Officer holds discussions on cybersecurity risks and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Given the size of the Company, we do not employ individuals with significant experience and relevant backgrounds in information security, cyber risk management, and cyber incident response. However, we contract with third-party vendors who have these backgrounds. These backgrounds include relevant degrees, certifications, and relevant work experience, including in roles responsible for cybersecurity oversight in entities similar to us, and our Chief Financial Officer relies on the expertise provided by these third-parties in carrying out his cybersecurity responsibilities.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, partners and customers. We understand the increasing reliance of our customers, suppliers, and partners on our digital platforms. Our goal is to strengthen our digital infrastructure, ensuring the highest levels of customer service while effectively managing risks and adhering to global compliance standards. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, and we continually monitor our overall security to assess performance and identify areas for improvement.


text: Risk Management and Strategy Our processes for assessing, identifying, and managing cybersecurity threats have been integrated into our overall risk management processes. Our cybersecurity and risk management program is structured around strategy, execution, management, oversight, and user training, with ongoing evaluations to ensure its effectiveness.


text: Identifying and assessing cybersecurity risks and threats are integral components of our broader enterprise risk management strategy. Our information technology leadership, with input from senior management, is responsible for defining our cybersecurity strategy, setting priorities, and driving the execution of our cybersecurity initiatives. We maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of our information systems, including the information residing on our systems. We utilize the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to guide our efforts, aligning with industry standards.


text: We believe each of the members of the AEOC has relevant work experience related to information security or cybersecurity to allow for the effective oversight of cybersecurity risks. In particular, Richard Palmieri has held numerous roles where he provided oversight of technology functions, Kristin Toth has significant experience managing e-commerce platforms and businesses, and Michael Gould has held senior roles in the technology consulting businesses at Oracle and Hewlett-Packard Company.


text: Cybersecurity risk management and strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. Our cybersecurity and risk management program is developed based on: • Continuous Development: Ongoing refinement of our risk management processes. • Partners and Tools: Leveraging global access control and activity monitoring solutions. • Education and Training: Implementing company-wide policies and proactive user training. • Continuous Monitoring: Regular surveillance of our environment. • Access Management: Ensuring only authorized users have access to our network.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: 24x7 Endpoint Monitoring by NOSC As part of our commitment to safeguarding our network, we operate a Network Operations and Security Center ("NOSC") that provides 24x7 monitoring of all endpoints across our network. This continuous surveillance allows us to detect and respond to potential threats in real time, helping our systems remain secure and operational. The NOSC is a critical component of our cybersecurity infrastructure, enabling proactive risk management and the ongoing protection of our digital assets.


text: Use of Consultants and Advisors In addition to our in-house capabilities, we engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information. We partner with a third-party provider specializing in endpoint security and monitoring. This partnership enhances our overall security posture by providing advanced incident response capabilities. This collaboration ensures that any potential threats are quickly identified and managed, adding an extra layer of security to our existing infrastructure.


text: The execution and measurement of our cybersecurity program are managed by our Information Technology department. This program is integrated into our broader governance and internal controls framework. We regularly engage with third-party consultants, auditors, and specialists to enhance our program, employing advanced cybersecurity technologies and services to prevent, detect, respond to, and recover from cyber threats and incidents. Additionally, our third-party security partner actively monitors and mitigates risks from external sources as part of our overall cybersecurity strategy.


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Role of Management Management has implemented risk management structures, policies and procedures, and is responsible for the day-to-day cybersecurity risk management. Our Information Technology department that is led by our Chief Technology Officer is responsible for the day-to-day assessment and management of cybersecurity risks. Our Chief Technology Officer has led our IT department since 2013 and has over thirty years of experience developing and implementing technology and supply chain services. We have implemented a number of processes which allow the management team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Our Chief Technology Officer and his team shares such information with our management team and reports information about such risks to our Audit and Executive Oversight Committee ("AEOC").


text: The Board of Directors, both directly and through the delegation of responsibilities to the AEOC has risk management oversight, which includes the proper functioning of our cybersecurity risk management program. In particular, the AEOC assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: The AEOC, which is comprised entirely of independent directors, is responsible for periodically reviewing and assessing with management (i) the adequacy of controls and security for our information technology systems, processes and data, and (ii) our contingency plans in the event of a breakdown or security breach affecting our information technology systems, it being understood that it is not possible to eliminate all such risks and that we will necessarily face a variety of risks with respect to information technology in the conduct of our business. The AEOC is additionally responsible for reviewing the cybersecurity disclosures required to be included in our filings with the SEC.


text: Risks from Material Cybersecurity Threats Although we have taken steps to prevent and mitigate data security threats, there can be no assurance that our protective measures and those of our third-party service providers will prevent or detect security breaches that could have a significant impact on our business, reputation, operating results and financial condition.


text: We have experienced two separate cyber events. First, in December 2021, we experienced a targeted cyber-attack, leading to a global shutdown of our connectivity, operational, and accounting systems to protect our infrastructure. Although our operations systems were eventually restored, this event caused significant disruption to our operations for approximately two weeks, temporarily impacting our ability to manage freight shipments, customs brokerage functions, and distribution activities. Next, in March 2024, our Canadian subsidiary experienced a targeted cybersecurity breach. This attack was identified by our end point protection software and our third-party monitoring partner. As per our response process, we initiated a shutdown of our Canadian infrastructure and engaged our incident response team. The operations systems were restored and approved to return to service within one week. While we continue to learn from these incidents, we do not anticipate further material adverse impacts from them on our business. Following the attacks, we enhanced our security program with additional tools and strengthened measures for improved system and network monitoring.

stage1Category: Incident Disclosure


text: As of the date of this filing, we have not identified any cybersecurity threats that are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both internally and through our engagement of third-party service providers.


text: Cybersecurity Risk Management and Strategy We recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that we process. Cybersecurity risk management is an integral part of our overall enterprise risk management efforts. We manage cybersecurity risks using a framework based on applicable regulations, industry standards and recognized best practices. Through this framework, we devote significant resources to identifying, monitoring, assessing and responding to cybersecurity threats and incidents, including those associated with our use of third-party software, applications, services, and cloud infrastructure.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our Cybersecurity Program includes multiple policies, procedures, and other components designed to identify, analyze, and respond to cybersecurity risks, including reliance on a layered system of preventative and detective technologies and controls designed to detect, mitigate, and contain cybersecurity threats. As part of our Cybersecurity Program, we maintain a Written Information Security Plan that outline internal controls and procedures designed to protect our information systems. Our Cybersecurity Program contains a comprehensive suite of cybersecurity policies that are commensurate with companies in our industry of similar size and sophistication, and these policies are also informed by the sensitivity of our data processing activities. Our Cybersecurity Program also includes policies and procedures designed to ensure adequate business continuity, disaster recovery, and incident response. We also have access through our insurer to computer forensics firms and specialized legal counsel in case of a cybersecurity incident. While we maintain cybersecurity insurance to assist in the cost of recovery from a cybersecurity incident, such coverage may not be sufficient to cover all costs resulting from such incidents.


text: We leverage qualified third-party consultants, advisors, counsel, and other experts to inform, audit, and update our Cybersecurity Program throughout each year. We engage security assessors to identify vulnerabilities through both internal and external penetration tests and to perform cybersecurity maturity assessments. We perform risk assessments annually, or more frequently if circumstances require, using both internal and external resources. We may also be subject to examinations by applicable regulators. We conduct annual cybersecurity training for employees to enhance awareness of how to detect and respond to cybersecurity threats, as well as periodic phishing training and testing campaigns. We also conduct table-top exercises annually to simulate a response to a cybersecurity incident.


text: Our designated IT team members monitor cybersecurity threats in real time for the Company at the enterprise level, with the assistance of third-party threat detection and monitoring software. Cybersecurity threats at the subsidiary level are also monitored in real time by experienced IT professionals at those subsidiaries, including our Vice President of Digital and Technology at JM Bullion. These individuals report cybersecurity incidents immediately to our Chief Information Officer (CIO), who in turn follows approved reporting protocols, as more fully described below.


text: Our Cybersecurity Compliance and Disclosure Committee (CCDC), which is further described below, is chaired by our CIO and includes the General Counsel of A-Mark and other representatives from the Company and our subsidiaries, including top-level management, to ensure enterprise-wide implementation and consistent application of the Company's data security policies and procedures. The CCDC regularly enlists subject matter experts to assist where necessary.


text: We also maintain a formal Vendor Management Program that provides oversight of cybersecurity risks related to our vendor and supplier relationships. During vendor onboarding, we perform risk-based due diligence on these third-parties, with heightened requirements for vendors that have access to confidential or personal information or that require access to our information systems. This Vendor Management Program includes specific cybersecurity requirements for our vendors, as well as ongoing monitoring, assessment, and contract review. Members of the CCDC are involved in and review the Vendor Management Program at least annually.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all cybersecurity threats and incidents. For more information on the risks that we face from cybersecurity threats, see "Risk Factors – Risk Factors of General Applicability—New rules have recently become effective that will require the Company to provide disclosures regarding cybersecurity management and events." in Part 1, Item 1A of this report.


text: Cybersecurity Governance The Board has overall responsibility for risk oversight and has delegated oversight of our Cybersecurity Program, including enterprise-wide risk assessment and management, to the CCDC. The CCDC's charter requires it to monitor Company efforts to prevent, detect, mitigate, and remediate cybersecurity incidents, and to comply with cybersecurity laws and regulations. The CCDC oversees and approves all Company policies and procedures related to cybersecurity. The CCDC also ensures that significant cybersecurity issues or concerns are reported to the Board and A-Mark's CEO, and disclosed to the public, individuals, or regulators where required by law.


text: The CCDC directly oversees information technology and information security risks through regular meetings, reports from management on information technology, cybersecurity, and related risk assessments, and incidents disclosed by third-party service providers as applicable. If a cybersecurity threat is identified, our Vice President of IT or other reporting individuals will immediately inform our IT service desk and notify our CIO. Once the threat has been analyzed, our CIO will inform our General Counsel of any security incidents. The General Counsel will report on the incident, as appropriate, to the CCDC, our CEO, President and CFO, and to the Board, either at the next scheduled meeting or on a current basis, depending on the severity of the incident.


text: The CCDC reports at least quarterly to the Board and A-Mark's CEO on the following topics, among possible others: our current risk posture and threat landscape; new material cybersecurity threats and high-risk exposures; risk mitigations and controls; incident response readiness; and updates to cybersecurity policies and procedures. The CCDC is also authorized and directed to report to the Board and A-Mark's CEO promptly in the event of a significant cybersecurity incident, as appropriate.


text: A-Mark's Chief Information Officer (CIO) chairs the CCDC. Our CIO brings over 14 years of IT experience to A-Mark. Since joining A-Mark in 2019, he has been pivotal in enhancing our data privacy compliance program, significantly strengthening our data protection and privacy measures, particularly ensuring protection of sensitive data. The co-vice chairs of the CCDC are A-Mark's Vice President of IT and JM Bullion's Vice President of Digital and Technology. Our Vice President of IT has over 25 years of experience in IT working in various industries including ecommerce, health care, and financial industries focusing on IT operations, cybersecurity and compliance. Since joining the company in 2014, he has been instrumental in the creation and growth of our cybersecurity program. Our Vice President of Digital and Technology at JM Bullion has comprehensive experience in the cybersecurity field. He successfully established a 24/7 security operation center (SOC) to continuously detect and respond to security incidents, as well as implemented various advanced services to proactively detect vulnerabilities on potential attack surfaces with high accuracy spanning across assets, applications, data, endpoints and network. He also centralized the workforce identity and access management (IAM) of the various systems for improved administration and control at the subsidiary level. He joined JM Bullion in 2015 and has served in his current role as Vice President of Digital and Technology since 2021.


text: Other members of the CCDC include top executives and management from the Company and its subsidiaries, including A-Mark's General Counsel, President, Chief Financial Officer, Chief Operating Officer, Senior Director of Financial Reporting, Director of Internal Audit, and Director of Enterprise Development and Administration, as well as JM Bullion's President and Chief Executive Officer and its Chief Financial Officer. Finally, the CCDC is assisted by an external compliance consultant with over twenty years of IT experience, and A-Mark's outside legal counsel for privacy and data security.


text: Cybersecurity is a significant and integrated component of CFSB Bancorp's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, we have not, to our knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Company.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and audits of the areas noted above, including cybersecurity-related vendors.


text: The Board of Directors designated the Vice President Information Systems as the Information Security Office (the "ISO") and for oversight, the full Board receives threat intelligence reports and a Cybersecurity Executive Dashboard from the ISO each month. The ISO has more than thirty years' experience with the Company and meets with the full Board of Directors in person at least annually. The ISO works with the Company's third-party Security Operations Center and the Company's Compliance/Enterprise Risk Management ("ERM") Team to identify, assess, and manage material risks from cybersecurity threats. The ISO also oversees the Company's Information Security Program, which governs various information security and cybersecurity processes, systems development, change control, disaster recovery/business continuity, physical asset classification and control policies. The Information Security Program identifies data sources, threats, and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The ISO is a member of various management committees, including the quarterly Management Control meetings which serve as the Company's IT Steering Committee.


text: On a periodic basis, but not less than annually, the ISO in conjunction with the Compliance/ERM Team, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Team reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Employees and Training Employees are an integral part in the line of defense against cybersecurity risks. Every employee is responsible for protecting Company and client information. Accordingly, employees complete formal training including regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, managed endpoint security automation and response capabilities, user behavior analytics, multi-factor authentication when available, encrypted data backups, and business continuity applications. Notable services include 24/7 security monitoring and response, real-time vulnerability scanning, third-party monitoring, and threat intelligence.


text: Service Providers The Company relies on third-party vendor services and solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented an Outsourcing Management Policy which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Outsourcing Management program is audited as part of the Company's external audit program.


text: At least annually, the ISO reports to the Board the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments The ISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan The Company has implemented an Incident Response Plan (the "IRP") to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data. The Company's business continuity and disaster recovery programs provide a coordinated response when responding to incidents. The IRP is implemented and maintained by the ISO and is subject to annual review and approval by the Board. Cybersecurity metrics are reported to the board monthly.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) program. As part of the Company's ERM program, the Board receives a report at least annually from the Company's chief executive officer and chief legal officer concerning the Company's risks, which include cybersecurity risks.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The IRP includes: • Identifying the incident response team (the "IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP. • Reviewing the IRP at least annually, or whenever there is a material change in Company's business practices that may reasonably affect its cyber incident response procedures.


text: Risk Management and Strategy We recognize the importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and working to ensure the safety and efficacy of our products. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management program, which considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. In addition, the risk oversight responsibility of our Board of Directors and its committees is supported by our cybersecurity risk assessment program, which include policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies, to our Board of Directors and personnel that are responsible for risk assessment. These policies also govern the security of our products and the protection of customer and patient data, provide for vulnerability remediation, regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's Cyber Security Framework and HIPAA. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: ACCURAY INC

ticker: ARAY