text: On a periodic basis, but not less than annually, the Information Security Officer (ISO), in conjunction with the Information Technology department, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Information Security Officer, CIO and IT Department regularly meet to review, monitor and address technology related threats and emerging risks.


text: Governance & Reporting The Board of Directors has designated the Vice President of Information Security as Information Security Officer (ISO). The ISO reports directly to the Senior Vice President of Risk & Compliance and works in tandem with the Chief Information Officer.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK

secItem: Item 1C

stage1Category: Management Role

stage1Method: unanimous


text: Additionally, the Company engages third parties to aid in the identification of risks and controls related to technology and technology driven product delivery channels, allowing for an independent opinion. The risk assessment process identifies data sources, threats and vulnerabilities, and ensures awareness, accountability and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). Risk Assessments (Detail)

stage1Category: Risk Management Process


text: On a periodic basis, but not less than annually, the Information Security Officer (ISO), in conjunction with the Information Technology department, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer records. Risks are identified and mitigations are documented by the ISO, IT staff and business lines responsible for the assessed area. Risks related to the engagement of third-party providers are identified and reviewed by the Risk & Compliance Department, in coordination with Vendors and Business lines that engaged the vendor relationship.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor provided software fixes (patches); • Ensuring that changes to security configurations are documented, approved and tested; • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs; • Updating and monitoring vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities; • Conducting penetration testing and vulnerability assessments as warranted; • Review performance with service providers to ensure that security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit and Testing Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of key controls, systems and procedures. In addition, independent third party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually. Management determines the scope and objectives of the penetration analysis.


text: Aspects of the Information Security program are audited by the Company's Internal Audit provider(s) to ensure aspects are aligned with regulatory expectations.


text: Employee Training Employees are an integral part in the line of defense against cybersecurity risks. Every employee is responsible for protecting Company and client information. Accordingly, employees complete formal training, including regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. Our employees are supported by solutions designed to identify, prevent, detect, respond to and recover from incidents. Technologies include firewalls, intrusion detection systems, managed endpoint security automation and response capabilities, encryption, data backups and multi-factor authentication when available. Notable services include 24/7 security monitoring and response, real time vulnerability scanning, third party monitoring and threat intelligence.


text: Service Providers The company relies on third party vendor services and solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a "Third Party" Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The program is audited as part of the Company's internal audit program.

stage1Category: Third-Party Risk

stage1Method: majority


text: Program Adjustments The ISO monitors, evaluates and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements and changes to customer information systems.


text: Incident Response Plan The Company has implemented an Incident Response Plan (IRP) to provide structure and a systematic incident response process for information security incidents that may affect any of the information technology systems, network or data. The Company's business continuity program provides a coordinated response when responding to incidents. The IRP is implemented and maintained by the ISO and is subject to annual review and approval by the IT Steering Committee and the Board of Directors. Cybersecurity metrics are reported to the Audit Committee quarterly.


text: The IRP includes: • Identifying the Incident Response Team (IRT); • Coordinating IRT activities, including developing, maintaining and following appropriate procedures to respond to and document identified information security incidents; • Conducting post-incident reviews to gather feedback on information security incident response procedures and to address any identified gaps in security measures; • Provide training and conduct periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; • Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: At least annually, the ISO reports to the Board of Directors the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed, as are management responses and any recommendations for program changes.

stage1Category: Board Governance


text: Cybersecurity is a significant and integrated component of CFSB Bancorp's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, we have not, to our knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Company.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and audits of the areas noted above, including cybersecurity-related vendors.


text: The Board of Directors designated the Chief Information Officer as the Information Security Officer (the "ISO") and for oversight, the full Board receives threat intelligence reports and a Cybersecurity Executive Dashboard from the ISO each month. The ISO has more than thirty years' experience with the Company and meets with full Board of Directors in person at least annually. The ISO works with the Company's third-party Security Operations Center and the Company's Compliance/Enterprise Risk Management ("ERM") Team to identify, assess, and manage material risks from cybersecurity threats. The ISO also oversees the Company's Information Security Program, which governs various information security and cybersecurity processes, systems development, change control, disaster recovery/business continuity, physical asset classification and control policies. The Information Security Program identifies data sources, threats, and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The ISO is a member of various management committees, including the quarterly Management Control meetings which serve as the Company's IT Steering Committee.


text: On a periodic basis, but not less than annually, the ISO in conjunction with the Compliance/ERM Team, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Compliance/ERM Team reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Employees and Training Employees are an integral part in the line of defense against cybersecurity risks. Every employee is responsible for protecting Company and client information. Accordingly, employees complete formal training including regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, managed endpoint security automation and response capabilities, user behavior analytics, multi-factor authentication when available, encrypted data backups, and business continuity applications. Notable services include 24/7 security monitoring and response, real-time vulnerability scanning, third-party monitoring, and threat intelligence.


text: Service Providers The Company relies on third-party vendor services and solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented an Outsourcing Management Policy which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Outsourcing Management program is audited as part of the Company's external audit program.


text: At least annually, the ISO reports to the Board the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments The ISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan The Company has implemented an Incident Response Plan (the "IRP") to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data. The Company's business continuity and disaster recovery programs provide a coordinated response when responding to incidents. The IRP is implemented and maintained by the ISO and is subject to annual review and approval by the Board. Cybersecurity metrics are reported to the board monthly.


text: The IRP includes: • Identifying the incident response team (the "IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP. • Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Risk Management and Strategy We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature. We believe our information security program is appropriate for a company of our size and stage of development, taking into account our operations and risks.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: Mechanisms, controls, and technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment.


text: Information security policies, network and device security, encryption standards, risk management, as well as security tools such as malware protection and secure authentication tools.


text: We conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts, and conduct regular trainings for our employees and senior management on cyber and information security.


text: The Audit Committee of our Board of Directors oversees and reviews the Company's cybersecurity risks and the steps management has taken to protect against threats to the Company's information systems and security. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board and the Audit Committee, as applicable.


text: To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: We have implemented cybersecurity practices appropriate for the size and complexity of our operations. Our IT systems are professionally managed, and access to Company data is restricted to authorized personnel using secure access protocols.

companyName: Paramount Gold Nevada Corp.

ticker: PZG


text: We take a proactive approach to managing cybersecurity risks. This includes regular updates to our systems, access controls, and training programs to help employees recognize and avoid phishing, spam, and other common cyber threats.


text: To date, we have no t experienced any material cybersecurity incidents. We continue to monitor evolving threats and adjust our practices as necessary to help protect our systems, data, and operations.

stage1Category: Strategy Integration


text: We recognize the importance cybersecurity has to the success of our business, as well as recognize the need to continually assess cybersecurity risks and evolve our responses in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, records and information against known and evolving cybersecurity threats.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Risk Management and Strategy We have established policies and processes for assessing, identifying and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within these systems.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks and the sufficiency of existing policies, procedures, systems and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Director, Information Security and Infrastructure who reports to our Acting Chief Executive Officer and Chief Financial Officer to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our Information Technology department. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and internal communications.


text: If required, we engage consultants, or other third parties in connection with our risk assessment processes. These service providers, where appropriate, assist us in the assessment, testing or other aspects of our security controls to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment, as well as assist us in designing and implementing our cybersecurity policies and procedures.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program and is responsible for monitoring and assessing strategic risk exposure, while our management team is responsible for the day-to-day operations over the material risks we face. Our management team, including our Acting Chief Executive Officer and Chief Financial Officer and Senior Director, Information Security and Infrastructure, provide periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if applicable.


text: The Audit Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, in the discretion of the Board and management. Board members may receive presentations on cybersecurity topics from external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Acting Chief Executive Officer, CFO and Senior Director, Information Security and Infrastructure, are responsible for assessing and managing our material risks from cybersecurity threats and have decades of experience in overseeing operations, including information technology functions, in the public company environment. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants as needed.


text: Our management team supervises cybersecurity risk management efforts to prevent, detect, mitigate,and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment. The cybersecurity risk management program also includes tools and activities to prevent, detect and analyze current and emerging cybersecurity threats and plans and strategies to address threats and incidents.


text: External Assessments. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants. Cybersecurity processes are adjusted based on the information provided from these assessments. In addition to annual attack and vulnerability testing, we engage a third-party cybersecurity provider for managed detection and response and as a managed security operation center.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: MARINE PETROLEUM TRUST

ticker: MARPS


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee’s cyber risk management program.


text: Other non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A “Risk Factors – Risks Related to Units – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”


text: Our risk management program is designed to identify, assess and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational and legal. Cybersecurity is a critical component of this program as we rely extensively on various information systems and other electronic resources to operate our business. Additionally, we rely to a great extent on third-party service providers to perform critical functions to assist in maintaining customer accounts, providing electronic banking services and financial reporting. Our Information Security Officer, who is a member of our Executive Management Team, is primarily responsible for managing our cybersecurity program. Our Information Security Officer has direct access to our Board of Directors and is authorized to evaluate our cybersecurity posture throughout the Company to ensure the implementation of appropriate controls over our systems and applications to maintain an effective cybersecurity program. The information security officer consults, where appropriate, with both our staff of IT professionals and, at times, outside security professionals to ensure the implementation of appropriate controls.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: We have implemented a cybersecurity risk management program to protect the confidentiality, integrity and availability of our information and information technology environment. Our cybersecurity risk management program consists of an extensive range of risk assessments to identify the cyber threats to our environment along with multiple policies and procedures to mitigate the risks identified, including, but not limited to, information technology and cybersecurity standards, incident response and disaster recovery/business continuity. Employees receive regular information and cybersecurity training and reminders throughout the year.


text: Daily operations are monitored by a dedicated team of information technology professionals complemented by management's monitoring of critical information security monitoring reports along with our third-party security vendor who provides for 24x7 monitoring of our external connections and email system. Defined incident response procedures are maintained, including a requirement that our security vendor notify designated members of management when unusual or suspicious activity is identified.


text: To test and evaluate the effectiveness of our cybersecurity program, we are subject to annual audits of our program by an outside audit firm who specializes in both information technology and cybersecurity assessments. These assessments include a review of general IT controls, external penetration assessments, internal penetration assessments and security awareness testing of our staff.


text: Our vendor management program is designed to identify the risks associated with using third-party service providers to run our business. Third-party service providers that present cyber risk to our operations must meet specific criteria, such as the maintenance of appropriate controls, processes and monitoring to ensure the confidentiality, integrity and availability of data and resources prior to being onboarded. In addition to initial assessments of our critical third-party service provides, we perform regular on-going monitoring of these critical third parties' infrastructure and performance, including data security and the effectiveness of their cybersecurity risk management programs.


text: Our Board of Directors, along with our Information Technology Committee, which is comprised of key members of senior management, are actively involved in providing oversight of our cybersecurity program. Monthly updates are provided to our Board regarding the status of our program, including key monitoring metrics and trends noted both internally and within our industry. Our Board reviews and approves all cybersecurity-related risk assessments, polices and formalized reviews performed throughout the year.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks Cybersecurity is integrated within the Company's Enterprise Risk Management process, which is the Company's systematic approach to identifying, managing and assessing major risk and safeguards, including cybersecurity. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas. Despite our efforts we put into maintaining a high level of cybersecurity, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We periodically conduct assessments of cybersecurity risks to identify potential vulnerabilities and threats to our systems and data. These risk assessments are designed to help identify material risks from cybersecurity threats to our critical systems and information.


text: We have established a security team which is principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents.


text: Protection Measures We implement and maintain cybersecurity controls, including firewalls, access controls, and intrusion detection systems, to safeguard our systems and data from unauthorized access, use, or disclosure. Furthermore, we use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.


text: Incident Detection and Response We have established a cybersecurity incident response plan that includes procedures for responding to relevant cybersecurity incidents. These protocols include incident response plans and escalation procedures to minimize the impact of potential breaches.


text: Cybersecurity Training and Awareness All new hires receive cybersecurity awareness training. All employees, including incident response personnel and senior management, receive periodic training and are periodically subject to evaluations to confirm their cybersecurity knowledge and awareness.


text: Third-Party Risk Management We have implemented a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Material Cybersecurity Incidents We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors" within this report when evaluating our business and related risk.


text: Cybersecurity Governance The Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company's cybersecurity, information security, and information technology risks. Periodically, the Audit Committee reviews and discusses with the Chief Financial Officer, who leads our cybersecurity program, the Company's policies, procedures, and practices with respect to cybersecurity, information security and information and operational technology, including related risks.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board of Directors considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, our Chief Financial Officer holds discussions on cybersecurity risks and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Given the size of the Company, we do not employ individuals with significant experience and relevant backgrounds in information security, cyber risk management, and cyber incident response. However, we contract with third-party vendors who have these backgrounds. These backgrounds include relevant degrees, certifications, and relevant work experience, including in roles responsible for cybersecurity oversight in entities similar to us, and our Chief Financial Officer relies on the expertise provided by these third-parties in carrying out his cybersecurity responsibilities.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Risk management and strategy Neuphoria recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP

stage1Category: None/Other


text: Managing Material Risks & Integrated Overall Risk Management Our risk management team has evaluated and addressed cybersecurity risks in alignment with our business objectives and operational needs and have integrated them into our overall risk management system.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Neuphoria has and engaged with a range of external experts, including cybersecurity assessors, consultants, advisors, and auditors in evaluating and testing our risk management systems. These partnerships will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Neuphoria will implement stringent processes to oversee and manage these risks. We will conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats While we have encountered cybersecurity threats, including a breach of an administrative email account, these challenges have not resulted in the loss of any data, materials, or clinical information, and have not materially impaired our operations or financial standing.


text: Board of Directors Oversight The Audit & Risk Management Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit & Risk Management Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Risk Management Personnel Our IT Manager is actively involved in assessing, monitoring and managing our cybersecurity risks. He has over 30 years of experience in the field of cybersecurity, and his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Monitor Cybersecurity Incidents Our IT Manager implements and oversees processes for the regular monitoring of our information systems, which includes having a well-defined incident response plan. In the event of a cybersecurity incident, we can take immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Management and the Board of Directors Our IT Manager will provide regular updates to our CEO, Spyros Papapetropoulos, regarding all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks faced by Neuphoria. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The Company recognizes the critical importance of cybersecurity in safeguarding its operations, assets, and various stakeholders and acknowledges that such risks are becoming more complex and frequent. As part of its enterprise-level risk management assessment process, the Company has implemented a cybersecurity program to identify, mitigate, and respond to risks associated with cyber threats and to protect the confidentiality, integrity and availability of Company computer systems.

companyName: LINDSAY CORP

ticker: LNN


text: Cybersecurity governance is a priority for both our Board of Directors and management. The Board has delegated primary oversight of cybersecurity risks to the Audit Committee. The Audit Committee monitors the cybersecurity risk management and cyber control functions, including external security audits. The Audit Committee receives periodic updates from experienced senior management of the Company's cyber risk management team knowledgeable about assessing and managing cyber risks, including, as appropriate, updates on the prevention, detection, mitigation, and remediation of cyber incidents.

companyName: BrightView Holdings, Inc.

ticker: BV


text: The aspects of the Company's risk management approach to cybersecurity include: • Annually reviewing and updating cybersecurity policies to ensure alignment with the latest industry standards and regulatory requirements. The specific aspects of the Company's program are informed by guidelines outlined in various accepted frameworks, including the Cybersecurity Framework issued by the National Institute of Standards and Technology Framework, an agency of the United States Department of Commerce. • Maintaining a dedicated cybersecurity team under the direction of the Company's Chief Information Officer ("CIO"), that has expertise related to data and network security, data governance, and risk management. • Conducting vulnerability assessments to identify and mitigate potential security risks. These assessments include network scans, penetration testing, and security audits performed by internal resources or qualified third-party providers. • Requiring all employees to participate in cybersecurity training and awareness programs including annual cybersecurity training and monthly phishing campaigns. These programs educate employees on how to recognize and respond to cyber threats and develop best practices for maintaining a strong security culture. • Monitoring information channels from trusted security information sources to stay abreast of developing cybersecurity concerns that may affect the Company or its operations. • Reviewing the security protocols of new third-party service providers to ensure acceptable levels of security are documented and maintained. • Maintaining an incident response retainer with a respected cybersecurity firm to ensure timely response and forensic capabilities.


text: Despite the Company's efforts, cyber attacks, unauthorized access, security breaches, ransomware, social engineering attacks or other cyber incidents could materially affect the Company and disrupt its business. Potential consequences of a successful cyber attack or cybersecurity incident could include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. While the Company is regularly exposed to such malicious threats, none of these threats, individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this Annual Report on Form 10-K.


text: Incident Response Procedures The Company's cybersecurity incident response plan is a critical component of the overall cybersecurity strategy. This plan outlines the procedures and actions to be taken in the event of a cybersecurity incident to minimize impact and ensure a swift recovery. Key elements of the Company's incident response plan include: • Incident discovery and confirmation: the Company has established clear protocols for identifying and reporting suspected cybersecurity incidents. Employees are trained to recognize potential incidents and report them immediately to the Company's IT security team. • Incident assessment and classification: upon receiving a report of a potential incident, the Company's IT security team conducts a thorough assessment to determine the nature and severity of the incident. Incidents are classified based on their impact and risk level. • Containment and continuity: once an incident is confirmed, the Company takes immediate steps to contain and mitigate its impact, which may involve isolating affected systems, applying security patches, or implementing other remedial actions. • Eradication and recovery: after containment, the Company works to eradicate the root cause of the incident and restore affected systems to normal operation, which includes evicting threat actors, removing malware, repairing vulnerabilities, and validating system integrity. • Communication and reporting: the Company maintains clear communication channels to keep all relevant stakeholders informed throughout the incident response process, which includes internal communication with employees and external communication with customers, regulators, and other parties as necessary. • Post-incident review and improvement: following the resolution of an incident, the Company conducts a post-incident review to identify lessons learned and areas for improvement, which helps enhance incident response capabilities and prevent future incidents.


text: As part of its oversight responsibilities as it relates to the Company's overall risk management, the Company's Board of Directors has designated cybersecurity oversight as a full board responsibility. The Board of Directors is mindful to have members with cybersecurity expertise represented on the Board of Directors. The CIO provides monthly reports to the Board of Directors regarding cybersecurity related matters and presents cybersecurity updates to the full Board of Directors at each Board meeting. The Board of Directors also participates in regular training and educational efforts to stay current on relevant cybersecurity related topics.


text: The Company's CIO reports directly to the Company's Chief Executive Officer and is responsible for managing, designing, and implementing all aspects of the Company's day-to-day cybersecurity programs and initiatives. The CIO and the dedicated cybersecurity team have appropriate levels of expertise, certifications, and previous work experience to effectively develop and oversee the Company's cybersecurity efforts.


text: Cybersecurity represents an important component of our overall approach to risk management. Our information security risk management (ISRM) policies, standards and practices are integrated into our overall enterprise risk management approach, and cybersecurity risks are one of the business risks that are subject to oversight by our Board of Directors. Our ISRM policies, standards and practices align with National Institute of Standards (NIST) and Technology Cybersecurity Framework and International Organization for Standardization (ISO) 27001.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: Risk Management and Strategy Our cybersecurity program focuses on the following areas: • Vigilance – We maintain cybersecurity threat operations with the goal of proactively identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established cybersecurity incident response procedure plan. We recognize that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence technologies. • Systems Safeguards – We implement layered systems safeguards to enable the protection of our information systems from cybersecurity threats. These safeguards include network security, vulnerability management, and threat detection. • Collaboration – We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management – We actively manage cybersecurity risks posed by third parties and their systems that could impact our operations. We monitor and assess the security posture of our third-party vendors. We require third-party service providers with access to sensitive information to maintain cybersecurity practices aligned with industry standards and applicable laws. In addition, we proactively monitor public information regarding our vendors for security incidents, investigate potential impacts, and take appropriate action to mitigate risk. • Training – We have implemented and maintain a comprehensive cybersecurity training program to educate personnel about evolving threats and reinforce security best practices. This program includes: i. Monthly phishing awareness campaigns with mandatory remedial training for those who fail. ii. Annual security and acceptable use awareness training.


text: • Incident Response and Recovery Planning – We have established and maintain a cybersecurity incident response procedure plan that addresses our response to cybersecurity incidents and recovery from such incidents, and such plan is tested and evaluated periodically. • Communication, Coordination and Disclosure – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Audit Committee of the Board of Directors, in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. We have established an Incident Response Committee, which is chaired by our SVP Administration, to quickly organize and execute an effective, productive, timely and compliance-conscious response to cybersecurity threats and incidents, as well as coordinate among the cross-functional groups.


text: We manage risks from cybersecurity threats through the assessment and testing of our processes and practices focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. We maintain cyber risk and related insurance policies as a measure of added protection.


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Audit Committee reviews cybersecurity on a quarterly basis. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board of Directors and the Audit Committee discuss our approach to cybersecurity risk management with the Chief Information Security Officer (CISO) and other cyber team members, as well as senior leadership.


text: The CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO has decades of experience in the cybersecurity and information security fields, including experience with both private and public companies and the military, as well as experience in the transportation and rail industry. The CISO is a Boardroom Certified Qualified Technology Expert (QTE) and holds certifications including Certified Chief Information Security Officer (C|CISO), Certified Internal Auditor (BSI) and is a graduate of the Wounded Warrior Cyber Combat Academy. The CISO has experience with regulatory compliance frameworks including ISO 27001, SOX, NIST and CMMC.


text: The CISO works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal & Compliance Officer across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our cybersecurity incident response procedure plan.


text: To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy is designed to detect, evaluate, and manage risks from cybersecurity threats and incidents. Our program is intended to identify cybersecurity risks facing our organization and inform our risk-based approach to cybersecurity preparedness and incident response procedures.

companyName: UNIFIRST CORP

ticker: UNF


text: Our cybersecurity risk management program is supported by our third-party vendors and service providers, and includes, but is not limited to, periodic penetration testing and endpoint detection, and automated tools to monitor our network and systems to detect vulnerabilities or unusual activity that could lead to unauthorized access to our systems or data. We conduct assessments, as appropriate, of critical third-party service providers, which generally include a cybersecurity questionnaire and a review of security assessments and certifications. We also provide cybersecurity awareness training to employees with access to our network.


text: We also have a policy for responding to and mitigating cybersecurity incidents. Our Chief Information & Technology Officer ("CITO") oversees our incident response procedures, which are reviewed and updated periodically.


text: The Company's Chief Technology Officer has been serving in this role for the Company since March 2025 and has over 30 years of experience in various information security and related technology roles. The Chief Technology Officer oversees the information technology and information security functions of the Company which includes our cyber risk management team.


text: We have not identified cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see the risk factor titled "If our information technology systems suffer interruptions or failures, including as a result of cyber-attacks, our business operations could be disrupted or other material adverse impacts on our business could result."


text: Cybersecurity Governance Our CITO, who reports to our Chief Executive Officer, is responsible for leading our information security team and overseeing the Company's cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer. Our Chief Information Security Officer supports the program and incident response and reports to the CITO.


text: Our cybersecurity risk management program is overseen by our Board of Directors. Members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.


text: Risk Management and Strategy Our cybersecurity risk management program is designed to monitor and control cybersecurity risk exposure, response, mitigation and protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity policies and processes are fully integrated into the Company's Enterprise Risk Management program. Our cybersecurity program is based on industry recognized best practices, including the ISO 27001 Information Security, Cybersecurity and Privacy protection international best practice standards.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Our cybersecurity risk management program includes: • Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends, internal assessments and engaging third parties to assess the effectiveness of our cybersecurity practices; • The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls; • Mandatory cybersecurity awareness training for employees and simulated phishing attacks; • A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors; • Cybersecurity insurance which is assessed annually; and • Risk management process for service providers, suppliers, and vendors.


text: Cybersecurity risks are monitored on an ongoing basis, and the security program and practices are adjusted as necessary. We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program, including the steps taken to monitor, minimize or control such risks or exposures.


text: The board of directors receives quarterly reports from management regarding the status of the cybersecurity risk management program, current activities, planned projects, and security assessments. In addition, management will update the board of directors, as necessary, regarding any significant cybersecurity incidents that we may experience.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity risk management team is led by our VP IT Security Compliance and our Head of IT. These individuals have collectively over 50 years of experience in both restaurant and technology sectors and have held technology leadership roles at national restaurant companies.


text: Additional information on cybersecurity risks is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely significantly on information technology and cybersecurity, and any material failure, weakness, interruption or breach of security could prevent us from effectively operating our business."


text: Spire's Board of Directors ("Board") recognizes the significance of cybersecurity risk and has therefore retained oversight of cybersecurity rather than delegating this risk to a committee of the Board. Every regular meeting of the Board includes a cybersecurity report provided by the Company's Chief Information Officer and the Chief Information Security Officer. These reports focus on developments within the Company's cybersecurity program and provide an update on any cybersecurity events or concerns. In 2024, the Board added a new director with expertise in cybersecurity to assist the Board to appropriately oversee the Company's efforts.

companyName: SPIRE INC

ticker: SR


text: Risk Management Strategies Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems. We have developed and implemented a cybersecurity risk management program ("Cybersecurity Program") that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. The Cybersecurity Program is intended to protect the confidentiality, availability, and integrity of our information and critical systems by continually monitoring, assessing, identifying, and mitigating cybersecurity risks. The Cybersecurity Program is part of our integrated risk management process and includes, but is not limited to, the following features: • Regularly simulated phishing attacks and comprehensive cybersecurity training for all employees, with special focus on high-risk individuals using a new security awareness platform. • Cybersecurity insurance coverage to mitigate financial impacts from potential cyber incidents. • Endpoint detection and response technologies (EDR) to monitor systems continuously for malicious activity. • Behavior analytics tools that help track normal behavior patterns and quickly detect any anomalies. • Cloud security measures, offering comprehensive protection and vulnerability management for our cloud environments. • Digital risk protection that includes brand protection, social media monitoring, dark web surveillance, and proactive response to phishing, fraud, and account takeovers. • Zero-day vulnerability management, with third-party monitoring to prioritize critical vulnerabilities based on real-time risk assessments and active exploitation. • Comprehensive vendor risk management program, including penetration tests, Service Organization Control ("SOC") reports, and security architecture reviews, especially for third parties managing sensitive data or accessing internal systems.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: In addition, we have a written cybersecurity incident response plan ("Response Plan") that is reviewed and updated, if necessary, at least annually. The Response Plan includes a cross-functional incident response team comprised of various key executive representatives from different departments in our organization, such as our Chief Information Security Officer ("CISO") and General Counsel, that are tasked with assessing the scope, nature, and potential impact of incidents. Findings are reported to the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), our Board and the Disclosure Committee, the latter of which is comprised of senior representatives from our finance, accounting, internal audit and legal departments under the supervision of the CEO and CFO.


text: We also regularly engage third parties to perform assessments on the Cybersecurity Program, including an annual self-assessed risk review facilitated by an independent third party, where we evaluate various cybersecurity domains and control areas and benchmark our program against industry peers. Additionally, we conduct annual third-party penetration tests focused on our highest-risk areas globally, providing insights into potential vulnerabilities. These assessments are supplemented by red team exercises and real-world incident response simulations to continually improve our security posture.


text: From time to time, we experience cybersecurity threats and incidents. As of the date of this Annual Report, we have not identified any instances that have occurred in the current year, or in prior years, that would have a material impact on our Company or on our results of operations, or financial position. For more information related to our cybersecurity risks, see Item 1A. "Risk Factors–Regulatory, Legal, and Cybersecurity Risks" within this Annual Report.


text: Our Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 25 years of experience in information security, including more than 10 years as a Chief Information Security Officer in the retail industry. With a diverse background in both industry and consulting, our CISO has led major security programs, implementing practical strategies to protect critical data and systems.


text: On at least a quarterly basis, the CISO delivers a detailed report to the full Board on data protection and cybersecurity matters. Topics covered by these reports include, but are not limited to, risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company's ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, updates on annual associate training and other specific training initiatives.


text: Managing risk related to cybersecurity is a top priority for Spire, and the Company remains focused on addressing threats that would jeopardize the confidentiality, integrity and availability of stakeholders' information or the ability to continue providing safe and reliable service to customers. To date, Spire has not experienced any material cybersecurity breach that impacts the Company's business strategy, results of operations, or financial condition.


text: Enterprise risk management ("ERM") at Spire oversees significant risks to the Company's ability to successfully execute on strategy and achieve corporate objectives. Spire's ERM is based on a structured, comprehensive process that leverages ISO 31000:2018, adopted and customized to the Company's needs, utilizing an ongoing process of risk identification, evaluation, treatment, integration and monitoring. ERM helps assess priorities and facilitate decision-making for resource allocation as it relates to risk management. Two risks prioritized by our Enterprise Risk Oversight Committee related to cybersecurity are cyber threats and vendor management. Additionally, the ERM process is structured to integrate with operational levels, where risk is managed, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 utilized by the Company's Information Security function for managing cybersecurity.


text: Spire's cybersecurity program is led by the Chief Information Officer and the Chief Information Security Officer, who together have over 40 years of experience in information technology and cybersecurity, along with a cross-functional team of technology, legal, physical security and risk leaders. Internal Audit provides assurances of risk management activities, including certain third-party cybersecurity activities, such as penetration testing.


text: Strategy/Approach Spire's cybersecurity team developed a five-year strategic roadmap in 2020, which is reviewed and updated annually. A NIST-based maturity assessment is also conducted annually to assess Spire's current maturity level and is used to establish initiatives to drive capabilities in key focus areas. Such initiatives were updated to align with federal security directives issued in 2021, with a key focus on increasing overall visibility into the environment to better correlate potential security related items; completing segregation and dependency from the enterprise and industrial control systems environments; and establishing defined policies and procedures to enhance overall governance and risk management. In addition to these strategic efforts, the Company works closely with federal agencies, including the U.S Department of Homeland Security, TSA and the local FBI chapter, and is actively involved in industry information sharing groups.


text: The Company's cybersecurity function is staffed with dedicated professionals who continuously monitor risks and evaluate the resiliency and effectiveness of the architecture and defenses within Spire's systems. The Company also maintains policies, procedures and standards to manage conduct within Spire and to be prepared for new cybersecurity threats and events. The cybersecurity program involves a variety of training and education to increase awareness of cybersecurity threats through mandatory annual security awareness training for all employees, quarterly phishing campaigns, and table-top exercises. The Company also engages third parties to evaluate potential risks through external penetration testing to assess the efficacy of systems.


text: Spire maintains business continuity plans to guide the Company's response to a potential cybersecurity event. These plans are regularly reviewed, tested and updated to ensure they meet the evolving needs of the Company in this area. The Company also conducts annual disaster recovery exercises to test the efficacy of core systems in the event of a catastrophic incident.


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We, directly and through our third-party service providers, maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We and our third-party service providers conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan.

companyName: Salamander Innisbrook, LLC


text: We have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements. We gather information and review security protocols of certain third parties who integrate with our systems, such as our payroll processor, managed solutions provider, and software as a service provider, on an annual basis to identify and manage risk. We regularly seek to improve and mature our cybersecurity processes. We apply lessons learned from our efforts to help prevent attacks and utilize data analytics to detect anomalies and search for cyber threats.


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase generally in business and society. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our finance and IT consultants have oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. They receive updates from management on our cybersecurity risks as may be required or prudent. In addition, management updates the home office executive committee as necessary, regarding any material cybersecurity incidents. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our home office executive committee. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership, as appropriate.


text: Our Chief Financial Officer and Corporate Controller oversees our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. These officers work with other members of management, employees and outside service providers to promote and evolve our cybersecurity protocols and systems. There were no material cybersecurity incidents in 2024 or up to the date of this filing.


text: Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed by such providers. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.

companyName: MARINEMAX INC

ticker: HZO


text: Our Executive Vice President and Chief Digital Officer, (the "CDO"), Shawn C. Berg, is responsible for managing the Company's cybersecurity risk and cybersecurity program. Shawn Berg has served as CDO since April 2019 overseeing the Company's Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. He previously served as Vice President of Technology upon joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including experience in multiple officer-level positions, in information technology and security.


text: Our Technology Group, in collaboration with the leading cybersecurity providers, monitors material cybersecurity and overall technology platform risks over time and updates the Company's mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.


text: The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Company has been subject to cybersecurity threats in the past. As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Notwithstanding our vigilant cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factor in this report, titled "Increased cybersecurity requirements, threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, data and our third-party service providers. Our business operations could be negatively impacted by an outage or breach of our informational technology systems or a cybersecurity event".


text: Risk Management and Strategy We recognize the critical importance of effective cyber risk management and response strategies in today's digital landscape. As part of our comprehensive risk management framework, we have developed a cyber crisis and data breach response plan for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. These engagements include routine audits, threat assessments, and consultations aimed at enhancing our security measures. We have incorporated cybersecurity risk management within our comprehensive risk management framework to cultivate responsiveness and a corporate culture that prioritizes cybersecurity risk management. Our cyber risk management team works closely with stakeholders across corporate functions to consistently assess and mitigate cybersecurity risks, aligning with our business goals and operational requirements.


text: We utilize a range of external experts, including cybersecurity consultants to assist in evaluating and testing our risk management systems, particularly where advanced or specialized expertise may be required.


text: We acknowledge that there are risks associated with third-party service providers that have access to our systems and data, we have implemented processes to oversee and manage these risks. We oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers by reviewing service organization controls reports for key outsourced systems. We also conduct security assessments of certain third-party providers before engagement and monitor such providers to confirm compliance with industry accepted cybersecurity standards and practices. This approach is designed to reduce risks related to data breaches, operational disruptions, or other security incidents originating from third-parties.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.


text: We provide regular updates on our cybersecurity strategic plans, programs, and initiatives to the Cybersecurity Committee of the Board of Directors at its four regularly scheduled meetings per year. Our Incident Response Plans provide for notice, and continued updates, to the Cybersecurity Committee of applicable incidents on a timely basis.

companyName: PTC INC.

ticker: PTC


text: The Chief Legal Officer acts as the Company's Data Breach Coordinator and leads our Cyber Crisis and Data Breach Response Committee (the "Committee") which consists of the Company's Chief Technology Officer, Chief Financial Officer and Chief Accounting Officer. Cybersecurity incidents that may significantly impact the confidentiality, integrity, or availability of the Company's data or the reliability of the Company's systems or networks are reported to the Committee. The Committee assesses the materiality of each incident, which is made using both quantitative and qualitative analyses to determine an incident's immediate and reasonably likely future impacts. Such cybersecurity incidents are also reported to the Audit Committee. The Company's Data Governance Committee has oversight of that how the Company's data is handled and shared with third parties and is comprised of the Company's Chief Technology Officer, Chief Legal Officer, Chief Human Resources Officer, Chief Accounting Officer, Vice President of Business Shared Services and Chief Audit Executive.


text: The Company has a cybersecurity training program that requires all employees with access to the Company's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks. Also, the Company regularly tests the efficacy of its training efforts as well as its systems to assess vulnerabilities to cybersecurity risks, including tabletop incident response exercises.


text: Annually we conduct an Enterprise Risk Assessment during which we identify and quantify risks, including cybersecurity risks, which could enhance or impede the Company's ability to achieve current or future strategic objectives. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee.


text: We have continued to invest in an evolving state-of-the-art cybersecurity framework of tools, processes, training, and people designed to efficiently assess, identify, and remediate material risks that could affect business operations, financials, or public reputation. Our multi-layered approach to cybersecurity involves regular network monitoring, vulnerability scanning, advanced threat detection, and incident response capabilities against recognized cyber threats to our business and stakeholders, including ransomware, data breaches and insider threats. We regularly update our security measures, as necessary, to ensure we address all new threats and technologies, using the National Institute of Standards and Technology ("NIST") Framework as a guide, when appropriate and relevant to our business.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: As further protections, we utilize encryption, access control mechanisms and secure cloud infrastructures, and we invest in extensive user training. All users regularly undergo updated cybersecurity awareness training in an ongoing effort to reduce the risk of human error contributing to any potential security incidents. All users are also subject to simulated phishing emails with real time feedback for a more continuous layer of training.


text: We have retained an industry expert to be our virtual Information Security Officer ("vISO") to assist and guide our IT organization in maintaining and evolving a comprehensive and robust cyber security environment. Monthly meetings review all facets of our current status against appropriate NIST standards, review any incidents, and review the results of ongoing simulated phishing exercises to identify certain users who may need extended training. In addition, as part of our annual security review, we hire a third-party network penetration testing firm to provide simulated probing and subsequent reporting. We use the results of these annual tests to improve the strength and flexibility of our network's security.


text: Our Incident Response Plan ("IRP") has evolved with our cyber environment and consists of a set of state-of-the-art-tools capable of monitoring, reporting and alerting, as well as regular reviews. The IRP also sets forth guidelines on how to triage, assess the severity and materiality of findings, and remediate and escalate findings to upper management in a timely manner, as necessary. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. However, such insurance may not be sufficient to cover us against all possible claims related to security breaches, cyber-attacks and other related breaches. As of the date of this report, we have not identified cybersecurity threats that we believe are reasonably likely to materially affect us. However, cybersecurity risk is dynamic, and future incidents could materially affect our operations, financial condition, or reputation.


text: Cybersecurity Governance and Oversight The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any material incidents to upper management in a timely manner whenever they occur.


text: We have also formed a steering committee, composed of IT staff and relevant business leaders responsible for the Company's material information, including commercially sensitive data. The goals of this steering committee include overseeing our annual material risk assessment and documenting and reporting to senior management. The steering committee also reviews changes to procedural and other controls. We have also formed a risk register subcommittee to review and formally discuss any critical risks identified during our vISO annual assessment of our cyber environment.


text: When utilizing third-party software for key services, we seek to engage those that are reliable, reputable, and maintain cybersecurity controls. To address risks associated with third-party providers for critical services, we review available audit reports of controls from such providers to assess and manage any identified risks.

companyName: MAYS J W INC

ticker: MAYS


text: Risk Management and Strategy The protection of our clients' data, our brand, and our systems is of utmost importance. We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security. We have implemented comprehensive cybersecurity and data privacy programs, fostering a culture of awareness across all employee groups and systems. In 2025, we achieved SOC2 Type 2 certification, reflecting our commitment to supporting our clients by aligning our controls and processes with the System and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA). This achievement builds on our previous SOC2 Type 1 certification and complements our ongoing TX Ramp compliance.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Our process to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third-party service providers, including cloud-based platforms. On an annual basis, we review the SOC2 (or equivalent) attestation of controls for material third-party service providers, coupled with monitoring industry notices and threat intelligence regarding potential vulnerabilities or threats targeting these third-party services.


text: We developed our cybersecurity program by integrating proactive training, vulnerability management, and system design with active threat defense mechanisms. Our marketplace services are protected by multiple layers of security including firewalls, endpoint protection, WAF and Bot mitigation. Our "defense in depth" approach to asset protection is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals. We maintain a formal incident response plan, which is regularly tested and updated to ensure prompt detection, reporting, and mitigation of cybersecurity incidents.


text: In addition, we undertake integrated planning activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including active Disaster Recovery production environment tests, tabletop exercises, continuous vulnerability tests, and annual penetration testing. We conduct company-wide mandatory cybersecurity training as well as periodic employee education exercises, such as phishing simulation email campaigns designed to emulate real-world attacks.


text: We view cybersecurity protection and data privacy as a shared responsibility in which all employees are active participants. Each employee undergoes annual cybersecurity training with supplemental training disseminated throughout the year. This continual education helps promote a culture that understands the critical role cybersecurity and data privacy play in protecting our clients' assets. Furthermore, our computing environments, products, and services are reviewed by our internal security team and our controls are tested regularly by independent third-party assessors as part of our annual SOC2 and SOX re-certifications.


text: Cybersecurity Governance Board and Committee Oversight. Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk identification, mitigation strategy and efforts, and resources and receives quarterly updates on cybersecurity risks and mitigation efforts from management, including our Chief Technology Officer (CTO). The Audit Committee of the Board of Directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules. We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employs dedicated resources to protect our systems.


text: Management's Role. Our internal security team in conjunction with the Chief Technology Officer (CTO) reviews current risks with a cross-functional leadership committee on a quarterly basis.


text: We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding cybersecurity risks, see the risk factor in Part I, Item 1A. Risk Factors captioned: "We are required to maintain the privacy and security of personal and business information amidst multiplying threat landscapes and in compliance with privacy and data protection regulations globally. Failure to do so could damage our business, including our reputation with sellers, buyers, and employees, cause us to incur substantial additional costs, and make us subject to litigation and regulatory action."


text: Risk Management and Strategy Ashland recognizes the importance of cybersecurity in safeguarding sensitive information and maintaining operational integrity. To that end, Ashland maintains an information security program as part of its overall Enterprise Risk Management ("ERM") program. The Company's information security program includes an incident response plan, which has been reviewed by third-party consultants and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0. The information security program, overseen by the Company's Vice President of Information Technology and Chief Information Officer, is designed to provide a framework for assessing, identifying, managing, mitigating and responding to cybersecurity threats and incidents and to facilitate cross-functional coordination within Ashland.

companyName: ASHLAND INC.

ticker: ASH


text: We conduct an annual cybersecurity maturity assessment. Periodically, we engage a third-party security consulting firm to conduct an Enterprise Security Maturity Assessment. This independent assessment provides a mechanism to benchmark our current risk profile and enables us to measure progress as we make program improvements. Identified cybersecurity risks are reviewed by the Cybersecurity Strategy Council, which ensures that risk tolerances are established and used to appropriately manage risks and address the risks identified.


text: Ashland's information security program also includes policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies. This includes the use of a 24/7 Security Operations Center as well as an in-house, dedicated threat hunting team. Additional safeguards also include employee training and awareness programs around phishing, malware, and other cybersecurity risks. In addition, the Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems and regularly engages consultants and other expert third parties to assist the Company in the identification and assessment of risks.


text: Ashland maintains a similar risk-based approach to its third-party vendor management program including identifying and overseeing cybersecurity risks that such third parties may present. As part of this program, the Company, imposes additional scrutiny for vendors that may handle personally identifiable information data or trade secrets.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business, results of operations or financial condition. However, despite the Company's best efforts, it cannot eliminate all risks from cybersecurity threats or provide assurances that undetected cybersecurity incidents have not occurred. See the "Risk Factors" in Item 1A of this Annual Report on Form 10-K for further information.


text: Ashland's information security program is led by the Company's Cyber Security Director who has more than 25 years of experience in information technology and 5 years of experience serving in a deputy chief information security officer role or top executive leader in cyber. Our Cyber Security Director is primarily responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy. In addition, other members of the Company's information security team also have significant experience in information security.


text: As noted above, management of Ashland's cybersecurity risks is part of the Company's overall ERM program, which is overseen by the Board. The Board's Audit Committee has primary responsibility for the oversight of the Company's information and cybersecurity risks and the programs established to manage such risks. The Audit Committee fulfills this oversight responsibility through receiving regular (and as needed) reports and updates from the Company's Cyber Security Director and Ashland's Board also receives periodic reports updates from the Cyber Security Director and the Audit Committee regarding information and cybersecurity matters.


text: The Company maintains a risk-based cybersecurity program designed to protect the confidentiality, integrity, and availability of our networks and systems that we own or are in our care. Our program is aligned to U.S. National Institute for Standards and Technology (“NIST”) standards and other applicable industry frameworks. We document our compliance efforts with regulations and standards that govern our business, including the Sarbanes-Oxley Act, the Family Educational Rights and Privacy Act (“FERPA”), the Gramm-Leach-Bliley Act Safeguards Rule, and the Payment Card Industry Data Security Standard (“PCI-DSS”).

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: Our program is designed to identify, assess, and manage material risks from cybersecurity threats through practices that include: • required information security and privacy training supported by periodic phishing simulation exercises to reinforce awareness and enhance cybersecurity practices; • monitoring of network and system activity to detect unusual or suspicious behavior; • access management and access controls which aim to implement “least privilege” access; • multifactor authentication and encryption of sensitive data through “at rest” and “in transit” where feasible; • deployment of industry-standard security monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • business continuity and disaster recovery planning; and • a documented Incident Response Plan (“IRP”) that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents in coordination with our Legal and the Ethics, Compliance, and Data Privacy (“ECDP”) department.