text: Cybersecurity Governance Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls and audit results. Our Audit Committee receives quarterly updates on our cybersecurity posture, threats and incidents from Aytu's management. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.


text: Our cybersecurity operations are led by our Chief Financial Officer. He is responsible for overseeing the development and implementation of our cybersecurity strategy, policies, standards and practices. He also oversees our cybersecurity team, which includes a staff member who has over 20 years of experience in the field. Our cybersecurity team monitors, detects, responds and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU

secItem: Item 1C


text: Aytu adheres to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, which provides a set of standards, guidelines and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy and our password policy. We regularly conduct phishing simulations, vulnerability scans and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we, or third -party providers that we rely on, will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. During fiscal 2025, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Part 1, Item 1A, Risk Factors of this Annual Report.

stage1Category: Strategy Integration

stage1Method: unanimous


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.


text: Risk Management and Strategy As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to identify, assess and manage material risks related to information technology, including cybersecurity threats to our critical computer networks, third-party hosted services, and our critical data, ("Information Systems"). Our Information Systems risk management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Annual tabletop exercises to test incident response plans, improve communication and coordination between relevant employees, and identify gaps to inform needed adjustments to plans;

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: To mitigate the occurrence of an incident as defined by the Company's formal documentation, which classifies and defines the properties of potential threats, the Company has in place a host of defenses which include, but are not limited to, the use of gateway consoles in all our global locations, limited access to key Information Systems from in-office networks or VPN with multi-factor authentication by means of a third -party mobile identity management tool to limit access to authorized users.

stage1Category: Risk Management Process


text: Internally to manage potential cybersecurity threats, we have established an Incident Response Plan that is designed to control the workflow of a reported incident. This plan formalizes incidence response stages such that reporting, identification, scope, response, and recovery are executed in a timely manner and identifies the order and coordination of internal and external communication. In addition, the Company addresses crisis management and business continuity with respect to Information Systems to ensure reliable redundancy and recovery of backed-up databases.


text: Management is not aware of any material security breaches on its Information Systems and risks from cybersecurity threats have not previously materially affected us. Certain of our vendors have experienced cyberattacks in the past and the threat and development of cyberattacks is continuous. It is impossible to say with certainty whether the Company's efforts will prevail in a coordinated attack on its Information Systems. Currently we expect the risks from cybersecurity threats will continue, but are not reasonably likely to materially affect us mostly due to our profile and not because our defenses are impenetrable or the efforts of criminals will not become more sophisticated. A cybersecurity attack on our systems could have a material negative impact upon our business, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Role of the Board The Audit Committee of our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. The Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for mitigation. The involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and management communicates with the Board and its members regularly between Board meetings as otherwise needed and are available to address any questions or concerns raised by our Board on risk management and any other matters.

stage1Category: Board Governance


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks the Company faces, including those related to cybersecurity. We believe it is important to work at all levels of the Company's hierarchy to manage cybersecurity risks and threats. Therefore, all users must use an online IT ticketing system, which is monitored around the clock, to report any incidents. Qualified individuals in IT determine what resources to allocate to each case and escalation of an incident, if deemed necessary. The Systems Administrators and IT Director, who has more than 18 years of experience with the Company, communicates on a day-to-day basis with the Chief Financial Officer, and President/Chief Operating Officer who would bring any material cybersecurity issues to the attention of the Company's Chief Executive Officer, the Audit Committee, and the Board.

stage1Category: Management Role


text: We recognize the importance of cybersecurity in safeguarding sensitive information, withstanding and recovering from adverse events, and protecting stockholders' interests. We currently manage cybersecurity risks by utilizing basic security protocols, such as network monitoring and access controls. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes that are designed to ensure such potential cybersecurity risks are monitored, putting in place reasonable appropriate mitigation measures and maintaining cybersecurity programs. Any significant incidents are reported to the board of directors, however the board of directors does not have a designated cybersecurity committee. During the fiscal year ended June 30, 2025, we have not identified any indication of a cybersecurity incident that would materially affect our business.

companyName: MOVING iMAGE TECHNOLOGIES INC.

ticker: MITQ

stage1Method: majority


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third -party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third -party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: ReposiTrak, Inc.

ticker: TRAK


text: Ongoing risk assessments of third-party service providers designed to ensure they meet the Company's standards for reliability, security, compliance, and performance.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our processes and resources are also designed to help enable us to actively identify, protect, detect, respond to, and recover from risks and threats. Nevertheless, we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. As of the date of this report, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition.


text: Third-party experts assist our senior management team in assessing and managing material risks from cybersecurity threats. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.


text: Risk Management and Strategy As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments. As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer, depending on the severity of the threat.


text: The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.


text: Our Senior Vice President of Information Technology manages our security program. Oversight of the program occurs via IT metrics-based updates provided to an Information Technology Steering team (consisting of the executive officers and other key employees of the Company) on a quarterly basis. Additionally, multiple elements of our cybersecurity security program are tested internally and externally on a bi-yearly basis in alignment with our Sarbanes-Oxley information security controls, and we engage independent third parties annually to assess the risks associated with our information technology assets. Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Lastly, a cybersecurity risk assessment is provided to our Board of Directors on an annual basis which includes metrics, security incidents, key risk indicators, and risk mitigation plans as well as on the status of material risks, mitigation measures, and incidents related to such risks. Our Board of Directors has overall responsibility for risk oversight, with the Information Technology Steering team assisting the Board in performing this function based on its respective areas of expertise. As such, the Information Technology Steering team performs materiality determinations of cyber incidents and advises the Board of Directors accordingly.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: We have an Information Technology committee that meets at least quarterly and includes members of our management team and compliance team. The members of the Information Technology committee have gained cybersecurity experience through years of training, internal and external discussions, and the development, implementation, and periodic evaluation of our cybersecurity policies.

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: We maintain a comprehensive cybersecurity risk management program that aligns to the National Institute of Standards and Technology (NIST) Cyber Security Framework and adopts a variety of cybersecurity best practices across the enterprise. We leverage industry-leading cybersecurity vendors that provide the following capabilities: Managed Detection and Response (MDR); a Security Operations Center (SOC) that monitors the Company's IT assets on a 24x7x365 basis; tools to interdict emails with phishing links and malware payloads; data leak protection tools that provide real-time interdiction of data transfers outside of normal business usage; vulnerability detection and automated patching tools; firewalls and instruction detection systems; multi-factor authentication mechanisms; mobile device management systems; penetration testing; and various third -party assessments. Our critical IP data is maintained on segmented, access-controlled data stores. We utilize a variety of backup mechanisms for its data including both warm and cold storage solutions. Lastly, we utilize token-based technologies to support Payment Card Industry Data Security Standard (PCI DSS) compliance safe handling and protection of credit card data.


text: We have a defined security policy that is reviewed on an annual basis. We have established response procedures for cyber-security incidents and test the procedures on a periodic basis. We provide robust computer-based cybersecurity and wire fraud / phishing awareness training to all new employees as well as training to existing employees on an annual basis. We have not experienced material information security incidents in the last three years nor have we incurred any material expenses related to penalties and/or settlements related to a material breach nor have we been materially affected or reasonably likely to have had a material adverse effect on us, our business strategy, results of operations, or financial condition. Nevertheless, we do carry a cybersecurity insurance policy.


text: The Trust does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. The Trust also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor's officers detailing cybersecurity review processes, any potential risks and any incidents which could impact the Trust. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes or are reasonably likely to materially affect, the Trust, including its operations, results of operations, or financial condition.


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Chief Technology Officer. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (i) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (ii) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (iii) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (iv) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: The World Gold Council has an incident response plan ("IRP") which (i) identifies the incident response team and the roles and responsibilities of the team members, (ii) details the incident response lifecycle, including preparation, detection, response and recovery, and (iii) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact the Trust to be reported to the Principal Financial and Accounting Officer of the Sponsor.


text: The Trust also relies on its other service providers, including the Trustee and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on the Trust's service providers, including the Trustee and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor's officers review and report the results of this annual review and any incidents or perceived risks to the Board of Directors.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor's officers detailing the Sponsor's annual due diligence on the Trust's service providers, including a summary of any potential operational risks and any incidents which could impact the Trust. The Board of Directors also periodically receives reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.


text: GLDM does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of GLDM. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. GLDM also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor's officers detailing the Sponsor's cybersecurity review processes, any potential risks and any incidents which could impact GLDM. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.

companyName: World Gold Trust

ticker: GLDM


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes are reasonably likely to materially affect, GLDM, including its operations, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this Annual Report for a discussion of the risks related to cybersecurity.


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Chief Technology Officer. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (1) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (2) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (3) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (4) incorporates advanced technologies such as identity management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: The World Gold Council has an incident response plan ("IRP") which (1) identifies the incident response team and the roles and responsibilities of the team members, (2) details the incident response lifecycle, including preparation, detection, response and recovery, and (3) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact GLDM to be reported to the Principal Financial and Accounting Officer of the Sponsor.


text: GLDM also relies on its other service providers, including the Administrator and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on GLDM's service providers, including the Administrator and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor's officers review and report the results of this annual review and any incidents or perceived risks to the Board of Directors.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor's officers detailing the Sponsor's annual due diligence on GLDM's service providers, including a summary of any potential operational or cybersecurity risks and any incidents which could impact GLDM. The Board of Directors also periodically receives reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management process includes an evaluation of cybersecurity risk together with other company risks. The Company has established a cybersecurity risk management program (the "program") designed to assess, identify, and manage material cybersecurity risks. Our program is designed based on industry best practices and is aligned with the core components of frameworks established by the National Institute of Standards and Technology (NIST), Center for Internet Security (CIS) and International Organization for Standardization (ISO).


text: An annual risk assessment is performed to identify internal and external cybersecurity threats and vulnerabilities, assess the likelihood and potential impact of such threats and vulnerabilities, and prioritize the risks from such threats and vulnerabilities. The results of the risk assessment, along with professional judgment, are used to develop and implement cybersecurity risk mitigation strategies and controls.


text: A cybersecurity incident response plan that outlines a structured approach to investigating, containing, documenting, and mitigating cybersecurity incidents, including reporting findings and keeping senior management, the Audit Committee, and other key stakeholders informed and involved as appropriate; Annual external penetration testing to identify vulnerabilities, assess perimeter security, improve incident response, and strengthen security policies and procedures; Regular phishing, social engineering, and cybersecurity awareness training for employees with access to the Company's information technology environment;


text: Third-party service providers are used in various capacities as part of our cybersecurity risk management program, including performing risk mitigation controls and providing cloud-based cybersecurity services and platforms. For example, third-party service providers are used to conduct our external penetration testing, as well as assist the Company in detecting, responding, and mitigating cybersecurity incidents. The Company uses a variety of processes to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are required to complete a detailed questionnaire, which is used to identify and assess material cybersecurity risks. In addition, the Company performs an annual review of independent attestation reports of the third-party service providers' control environments designed to ensure that the controls meet Company security requirements and that any identified issues in the independent attestation reports do not present material cybersecurity risks to the Company.

stage1Category: Third-Party Risk


text: To date, we have not identified any cybersecurity threats or incidents which have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition; however, there is no guarantee that we will not be the subject of future successful cybersecurity threats or incidents that may materially and adversely affect the Company, including its business strategy, financial condition, results of operations or prospects. Additional information on cybersecurity-related risks is discussed under the heading "Risks Associated with our Information Technology Systems" under Item 1A, which should be read in conjunction with Item 1C.


text: Cybersecurity Governance Our Board of Directors has delegated oversight responsibilities for enterprise risk, including cybersecurity risk, to the Audit Committee. The Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide periodic updates to the Audit Committee regarding the Company's cybersecurity risk management program. The Company has a cybersecurity incident response plan that includes a process to evaluate cybersecurity incidents for materiality. The escalation protocol includes reporting potentially material cybersecurity incidents to senior members of management for further evaluation. Any cybersecurity incident determined to have a material impact on the Company is timely reported to the Audit Committee.


text: The CISO has primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. Our CISO has 25 years of experience in information technology and cybersecurity generally, which has been gained from a combination of education, including relevant degrees, and prior work experience.


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools designed to monitor, identify, and address cybersecurity risks. In support of this approach, we implement processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we c onduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident.

companyName: NORTHERN MINERALS & EXPLORATION LTD.

ticker: NMEX


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: We have policies and procedures for identifying, assessing, and managing material risks associated with cybersecurity threats. We seek to address cybersecurity risks through a comprehensive approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third party information technology vendor), the use of a third party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan. We also maintain cybersecurity insurance that provides for certain protection against potential losses arising from a cybersecurity incident.


text: Internal and External Penetration Testing of SCC's Technology Infrastructure: This service is contracted at least annually to identify and remediate vulnerabilities that may exist at the infrastructure and critical operation systems levels.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: We have not experienced a material cybersecurity incident, any expenses we have incurred from cybersecurity breaches have been immaterial, and we are not aware of any cybersecurity incidents that are reasonably likely to materially affect our business. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents. However, future incidents could have a material and adverse impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A, "Risk Factors."


text: Our Board of Directors oversees cybersecurity risk management as part of its general oversight function. The Company's management team provides updates to the Board of Directors regarding cybersecurity as appropriate.


text: Risk Management and Strategy In an effort to mitigate cyber intrusions, the Company has implemented a cybersecurity program intended to protect and preserve the integrity, confidentiality and reliability of data and systems. Cybersecurity risks are a key component of the Company's overall risk management, is integrated into other corporate processes and goes beyond the Company to certain vendors or suppliers. The Company has instituted certain cybersecurity requirements, interacted with various external organizations including its state regulator, and participated in proprietary briefings by industry experts to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: RGC RESOURCES INC

ticker: RGCO


text: The Company's cybersecurity program fundamentally aligns with the COBIT framework. This is reflected in our related policies, practices and procedures. We have multiple layers of security controls as well as a third -party SOC that helps identify, avoid and mitigate cybersecurity threats. The evaluation of risks includes consideration of cybersecurity and privacy risk, including ( 1) potential impact on the Company's employees, customers, and other stakeholders, ( 2) intelligence briefings on notable cyber events impacting the industry and ( 3) evaluation of external threats. The Company utilizes internal and third -party assessment tools and tests to evaluate its cyber risk policies, practices and procedures as well as to challenge how its defenses are built and deployed. These assessments provide opportunities for critical self-analysis, constructive feedback from third parties, and learnings from industry experts to enhance cyber resilience. Both formal and informal cybersecurity awareness trainings are provided to employees to help identify and avoid cybersecurity threats and to ensure employees understand the Company's cyber risk management policies along with the key role they play to ensure cyber hygiene. The Company has established a cybersecurity incident response team that includes the CEO, CFO, VP of HR, IT Director and other personnel. The Company has also retained counsel to advise on cybersecurity matters. The Company periodically undertakes table top exercises facilitated by a third party whereby the incident response team reacts to, evaluates and updates, if necessary, its policies and processes to a simulated cyberattack.


text: The Company's current security posture and regulatory compliance efforts are intended to address evolving and changing cyber threats. During the past three years, the Company has not experienced a cybersecurity incident resulting in a material impact to its business strategy, results of operations, or financial condition. The Company has identified the risk that a hostile cyber intrusion could severely impair the Company's operations, lead to disclosure of confidential information, damage the Company's reputation or otherwise have an adverse effect on the Companies' business as disclosed within Item 1A. Risk Factors.


text: The Company's Board of Directors, including its Audit Committee, provides oversight of the Company's risks from cybersecurity threats. Management, including the CEO, CFO and IT personnel, presents formal reports to the Audit Committee and to the full board at least annually, as well as whenever cyber events warrant update.


text: We have implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is an element of and is integrated into our overall enterprise risk management program, and is a key component of our annual organizational risk assessment. Our cybersecurity risk management program is based in part on, and incorporates elements of, the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Azenta, Inc.

ticker: AZTA


text: Our cybersecurity risk management program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;


text: a security team that is principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls and policies, and ( 3) our response to cybersecurity incidents;


text: The use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect intrusions such as identity attacks. Engagement of a provider for real-time threat detection, alerting and immediate, automated remediation service for the entire organization.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management; assessment of material cybersecurity risks posed by third -party service providers, including risks to employee, customer and financial information; a cybersecurity incident response protocol that includes procedures for responding to cybersecurity incidents; and business continuity plans.


text: As part of the above processes, we engage, as necessary, consultants and other third parties, to review our cybersecurity incidents if material to help quantify the impact and identify areas for continued focus, improvement, and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third -party service providers, including our suppliers and manufacturers or who have access to confidential, proprietary, personal, or employee data, or to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third -party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or audits for System and Organization Controls (SOC) compliance.


text: We have been, and expect to continue to be, subject to cybersecurity risks and incidents related to our business. We have not experienced any material cybersecurity incidents during the last fiscal year. For more information about the cybersecurity risks we face, see Part I, Item 1A, "Risk Factors " of this Annual Report on Form 10 -K.


text: Our Board of Directors considers cybersecurity risk as part of its enterprise risk management oversight function. The Board of Directors delegates oversight of the cybersecurity risk management program to the Audit Committee. This oversight includes periodic reports from management concerning cybersecurity related risks. The management of the program is the responsibility of our Risk Management Committee, comprised of our Chief Financial Officer, Chief Digital & Information Officer, Chief Accounting Officer and General Counsel. Our Chief Digital & Information Officer, who has over 30 years of extensive work experience in the field of technology and cybersecurity, leads our team of cybersecurity professionals and provides the Risk Management Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. Our team of cybersecurity professionals monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through the cybersecurity risk management and processes described above, including the operation of our incident response plan. The Risk Management Committee provides updates to the Audit Committee on our cybersecurity risk management program as appropriate, including updates on ( 1) any critical cybersecurity risks; ( 2) ongoing cybersecurity initiatives and strategies; ( 3) applicable regulatory requirements; and ( 4) industry standards. The Risk Management Committee also notifies the Board of Directors of any significant and/or material cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: Risk Management and Strategy We rely on computer systems and information technology to conduct our business, including to securely transmit data associated with cashless payments. These systems and technology are increasingly complex and vital to our operations, which has resulted in an expansion of our technological presence and corresponding risk exposure. In addition, these systems are inherently vulnerable to disruption or failure, as well as internal and external security breaches, denial of service attacks and other disruptive problems caused by cybersecurity threat actors. We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition based on information known to us as of the date of this report. Under the oversight of our Board, our management has developed a cybersecurity risk management program based on the Center for Internet Security Critical Security Controls framework that is integrated with our overall risk management program and is designed to assess, identify, manage and mitigate material cybersecurity risks. Our cybersecurity program includes policies and procedures that govern how security measures and controls are implemented and maintained. We identify and implement security controls to address cybersecurity risks based on an annual risk assessment and our evaluation of relevant factors, including the likelihood of risk, the potential impact and severity of the risk, the feasibility and expense of potential controls, and the impact of controls on our operations. Our cybersecurity program includes regular security assessments and testing, regular employee trainings, third-party security audits, and solutions designed to detect and mitigate cybersecurity threats, including data breaches, malware, ransomware and phishing attacks.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: We utilize third party security firms and consultants to test our cybersecurity control environment and to provide certain security measures that we use to protect our information technology environment, including to detect and filter external phishing and malware threats, to provide enhanced endpoint protection and to protect our data through data classification. We have developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: We have prepared a written incident response plan and crisis management plan to enhance our ability to respond to cybersecurity incidents. We periodically conduct internal tabletop exercises to enhance incident response preparedness. Our employees are required to participate in regular cybersecurity awareness trainings upon hiring and on a quarterly basis thereafter.


text: The use of multi-factor authentication for all remote users when they connect to the corporate network and the corporate email platform.


text: The deployment of updates and patches as they are available for all installed versions of enterprise software to reduce the exposure to vulnerabilities.


text: Cybersecurity Governance Our Vice President of Information Technology (our VP of IT) has primary responsibility for monitoring, assessing and managing our material risks from cybersecurity threats. He oversees a dedicated information technology team that is responsible for managing enterprise-wide information security strategy, policy, standards, architecture and processes, and is regularly informed of, and monitors, the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our VP of IT has over 26 years of information technology experience, has earned a graduate degree in Cybersecurity and Information Assurance, and maintains relevant industry designations including Certified Information Systems Security Professional and Certified Information Security Manager certifications.


text: Our Board considers cybersecurity risk as a part of its overall risk oversight function. Our Board receives reports from our VP of IT at least bi-annually, and on an as-needed basis, on cybersecurity risks and actions taken to mitigate those risks. These reports include updates on our cybersecurity risks, the emerging threat environment, and the status of projects designed to enhance our information security systems and programs.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to materially protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes policies and processes for assessing, identifying, and managing risk from cybersecurity threats as well as a cybersecurity incident response plan. Our cybersecurity risk management program is integrated into our overall risk management system and processes, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other strategic, operational, legal, compliance, and financial risk areas.

companyName: VERU INC.

ticker: VERU


text: Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained, with assistance from a third -party service provider. These policies and procedures and the resulting safeguards are designed and evaluated in light of our risk assessments. We have implemented access controls, firewalls, and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes to safeguard our information systems. We maintain a business continuity and disaster recovery plan designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when hired and based on periodic phishing tests.


text: As of the date of this Annual Report on Form 10 -K, we have not identified risks from known cybersecurity threats, including or as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks to us from cybersecurity threats, see "Risk Factors" in Item 1A. of this report.


text: One of the key functions of our board of directors is risk oversight, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly and through the audit committee.


text: Our Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from a third-party service provider. Our Chief Financial Officer supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include quarterly briefings from our third-party service provider and alerts and reports produced by security tools deployed in the IT environment. Our Chief Financial Officer has over 10 years of experience in overseeing our cybersecurity and information technology programs. We also rely on our third-party service provider for advice and expertise on monitoring evolving industry standards and best practices.


text: Our Chief Financial Officer provides periodic briefings to the board of directors regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cyber security systems testing, and activities of third parties.


text: The Company is subject to attempted cyberattacks and other cybersecurity risks. Our business relies on various information technology and application systems that may be impacted by a malicious cyberattack. Such cyber incidents may cause lost revenues or increased expenses stemming from inability to use certain systems for a period of time, loss of financial assets, fines related to breach of personally identifiable information or other protected information, reputational damage and remediation and litigation costs as well as increased cybersecurity protection costs.


text: We regularly evaluate cybersecurity risks from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are monitored and reviewed by management on a periodic basis as deemed appropriate.


text: We have developed and continue to invest in a variety of solutions and controls for real-time threat prevention, detection and instantaneous, automated reaction to such cyberattacks. Our overall strategy in combatting known cybersecurity risks includes:


text: Regardless of the controls we have in place, cybersecurity risks continue to become more complex and pervasive, and our internal controls cannot provide absolute assurance that we will be able to protect ourselves from significant cyberattack incidents. Additionally, by outsourcing certain administrative functions to third parties, we may be exposed to risk of data security breaches against those third parties.


text: We are not aware of any existing cybersecurity threats that would materially affect, or that are reasonably likely to materially affect, our business strategy, results of operations, liquidity or financial conditions. Furthermore, we are not aware of having experienced any significant cybersecurity incidents during fiscal year 2025. Management periodically updates the Board of Directors regarding efforts to minimize cybersecurity risks.


text: Risk Management and Strategy Our cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resident on them. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats. We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third -party cybersecurity firms. Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: An incident response plan has been established which provides detailed information on actions to take in the event of an incident. The incident response plan includes the scope of the plan, establishes the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high pressure situations which can occur during incidents.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.


text: Our management periodically evaluates information on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2025, and through the date of filing of this Form 10-K.


text: While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.


text: At Track Group, Inc., we recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: Track Group, Inc.

ticker: TRCK


text: We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and then reported to the Board of Directors.


text: We comply with the AICPA Trust Services Criteria for Security and have based our Information Security Management System on the ISO 27001 standard.


text: Track Group's Chief Information Security Officer, Tim Hardy, has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and report any findings and recommendations, as appropriate, to the full Board of Directors for consideration.


text: Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, results of operations and financial condition. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our IT department and our management actively oversee our risk management program, including the management of cybersecurity risks. We have contracted cybersecurity and risk assessment experts to help test our systems and guide the ongoing development of best practices policies. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: cbdMD, Inc.

ticker: YCBD


text: Network and endpoint protection: Utilizing firewalls, intrusion detection systems, antivirus software, and advanced encryption protocols to safeguard sensitive data and systems. Multi-factor authentication, security and principle of least privileged (PoLP)


text: Employee training and awareness programs: Educating employees on cybersecurity best practices and conducting phishing simulations to promote vigilance against social engineering attacks.


text: Incident detection and response plans: Maintaining real-time monitoring and implementing a structured incident response plan that allows us to quickly detect, respond to, and recover from cyber incidents.


text: Third-party risk management: Vetting the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.


text: While we have not experienced a cybersecurity incident that has had a material impact to date, the threat of potential incidents remains high. We continually evaluate our exposure to risks such as: Operational disruption from ransomware or other cyberattacks. Data breaches that could compromise customer or proprietary information. Regulatory and legal exposure arising from cybersecurity failures.


text: As part of our risk management framework, we regularly assess whether any cybersecurity incidents, or the likelihood of such incidents, could materially affect our business. We are also committed to continuous improvements to address emerging threats. Governance.


text: Our board of directors plays an active role in overseeing the company's approach to managing cybersecurity risks. The board receives regular updates from senior management regarding the company's cybersecurity strategy, potential risks, and any incidents that may arise. These updates ensure that the board remains informed and able to provide guidance on cybersecurity matters.


text: The board is also regularly briefed by management on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.


text: Management, led by the IT department, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The IT department is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.


text: The Company is committed to safeguarding its information systems and data against evolving cybersecurity threats. With operations spanning traditional publishing and the technology-driven Journal Technologies segment, the Company prioritizes robust cybersecurity measures to protect its operations, customers, and stakeholders. The Company employs a comprehensive cybersecurity risk management framework to identify, assess, and address risks that could impact business operations, sensitive client data, and the Company's portfolio of marketable securities. This framework incorporates: Technology Solutions: Prioritizing the security of Journal Technologies' court and justice software systems, which manage critical data and workflows. Traditional Business: Protecting the systems and data supporting the Company's publishing and printing operations. Financial Portfolio: Securing systems and processes related to the management of the Company's substantial marketable securities portfolio.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: Governance and Oversight The Company's Board of Directors as a whole supervises the Company's cybersecurity strategy and regularly reviews cybersecurity risks, incident reports, and risk mitigation initiatives.


text: Journal Technologies has a Chief Information Security Office (CISO) made up of internal cybersecurity practitioners who evaluate, identify, and mitigate significant risks posed by cybersecurity threats, with a focus on safeguarding the Company's technology, data, and intellectual property.


text: In August 2024, Journal Technologies hired a Director of Security Operations to lead the CISO team. With extensive IT leadership experience and a Certified Information Systems Security Professional (CISSP) credential, the Director oversees security strategies, incident response plans, and risk assessments. Reporting directly to senior management, the Director works closely with internal teams and external experts to align Journal Technologies' practices with industry standards.


text: The Company has also established a dedicated Cybersecurity Working Group, with members from both the Traditional Business and Journal Technologies, to collaborate on threat intelligence, incident response strategies, policy alignment, and security technology advancements. This partnership ensures both entities remain proactive in addressing evolving threats and benefit from shared expertise to implement coordinated security measures. The Company's senior management works closely with the CISO and the Cybersecurity Working Group to identify matters requiring the attention of the Board of Directors.


text: Threat Detection and Response: The Company employs enterprise security systems as the backbone of a defense in depth (DiD) strategy, such as patch management, intrusion detection, and network segmentation. A managed detection and response (MDR) solution from a world-class security company unifies our antivirus/malware (NGAV), endpoint detection and response (EDR), cyber threat intelligence, managed threat hunting capabilities, and security hygiene.


text: Employee Training and Awareness: The Company provides regular cybersecurity training for employees to enhance awareness of common threats, such as phishing and ransomware. All Journal Technologies employees undergo annual CJIS training and certification.


text: Risk Register: The Company maintains a central Risk Register as part of its cybersecurity risk management framework. This Risk Register identifies risks and their potential impacts, mitigation strategies, and ongoing monitoring efforts.


text: Third-Party Risk Management: The Company evaluates third-party vendors prior to onboarding to ensure they have industry standard best practices in place and, when applicable, verified by an external audit firm. The Company monitors third-party providers for breaches or other cybersecurity events and annually review each vendor's SOC 2 audit reports.


text: Incident Response Planning: The Company maintains a formalized incident response (IR) plan to address and remediate cybersecurity incidents. The plan defines roles and responsibilities and includes runbooks for likely scenarios. The Company performs testing of the IR plan at least annually with the results reported to senior management.


text: Certifications: Several of the Company's security personnel on the CISO team have and maintain CISSP, GCIH (GIAC Certified Incident Handler) and OSCP (Offensive Security Certified Professional) certifications.


text: Business Continuity: The Traditional Business and Journal Technologies have each implemented a Business Continuity Plan and Disaster Recovery (BCP/DR) with procedures aimed at minimizing downtime and facilitating recovery of both internal and customer assets in the event of a service disruption. The plan includes clearly defined roles, step-by-step recovery processes, and prioritized action plans to address various scenarios, such as natural disasters, cyber incidents, and hardware failures. We regularly test and update our BCP/DRs.


text: Enforcing multi-factor authentication (MFA) for all systems Deploying anti-phishing solutions to detect and block suspicious emails Using single sign-on (SSO) solutions integrated with secure identity providers Simulating phishing attacks to measure awareness and improve training programs Implementing Security Information and Event Management (SIEM) systems for continuous monitoring and logging.


text: Incident Reporting and Disclosure The Company adheres to strict protocols for evaluating and reporting cybersecurity incidents. Any incidents determined to have a material impact—assessed based on financial, operational, or reputational factors—are raised with the Board of Directors and, if necessary, disclosed in accordance with regulatory requirements.


text: Coastal recognizes the critical importance of identifying, assessing and managing material risks from information security threats. One key way that Coastal mitigates information security threats is through the Company's information security program (the "Information Security Program"). Cybersecurity is an integral subset of information security and the Information Security Program is designed to protect the Company from cybersecurity attacks, breaches, incidents and resulting consequences.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented prior to a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access and integrity monitoring and reporting and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, IT and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.


text: Coastal engages third party assessors, consultants and auditors in connection with the Information Security Program, including to conduct external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners in order to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of financial institution experience, which includes, compliance, BSA, operations, physical security along with information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and on information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on 3 pillars: Technology Strategy, InfoSec/Cyber, and Data.


text: The SVP of Technology has served in that role since 2005 and the SVP, Head of Technology Operations and Implementation, who also supports the Information Security Program, has 23 years of financial technology experience, including previously as Director, Application Development and Vice President, Integration and Analytics. The Information Security Program is further supported by other members of Coastal's management team, including the President, Chief Risk Officer, and the Chief Audit Executive.


text: The Board exercises oversight over the Information Security Program and reviews and approves the Information Security Program at least annually. Cybersecurity risk management is also incorporated into Coastal's overall enterprise risk management framework, which is updated on an annual basis and subject to oversight by the Management Risk Committee and the Board.


text: As the leader of our Information Security Team, our Vice President, Cybersecurity, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, requesting and allocating budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Although Coastal has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected Coastal's business strategy, results of operations, or financial condition, there can be no guarantee that Coastal will not experience such an incident in the future. For a discussion regarding risks from cybersecurity threats, see "Item 1A. Risk Factors," including the risk factors titled "—We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and earnings" and "—We are dependent on our information technology and telecommunications systems and third-party service providers; systems failures, interruptions, security breaches and cybersecurity threats could have an adverse effect on our business, financial condition and results of operations." As noted above, we are a regulated financial institution and are subject to financial privacy laws and to oversight by federal banking agencies. For additional information on these laws and oversight, see "Item 1. Business—Regulation and Supervision."

stage1Category: None/Other


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented before a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access, controls, data integrity monitoring and reporting, and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.


text: Coastal engages third party auditors and consultants in connection with the Information Security Program, including conducting external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third-party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of combined financial institution experience, which includes compliance, BSA, operations, physical security and information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on three pillars: Technology Strategy, InfoSec/Cyber, and Data.


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Vice President, Cybersecurity and includes our Chief Human Resources Officer, Vice President, Privacy, senior personnel from our legal, finance, and relevant business departments (the "Incident Management Team"). Our Vice President, Cybersecurity brings extensive experience in software development, IT, and cyber security, gained in over two decades in the telecommunications, financial services, defense, and healthcare sectors. Notably, he spent the last four years at a medical device company focused on insulin delivery, where he successfully established the product security program and played a pivotal role in obtaining clearance for its flagship product line.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data ("Information Systems and Data").


text: Our information security function is led by our Vice President, Cybersecurity (our "Information Security Team"), and is supported by our Chief Technology Officer, our Chief Legal, Privacy and Compliance Officer and legal department, our Vice President, Head of Information Technology, and our cybersecurity incident management team. Our Information Security Team is tasked with identifying, assessing and managing our cybersecurity threats and risks. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting risk assessments, coordinating with law enforcement concerning threats, conducting internal and external audits and threat assessments for internal and external threats, obtaining third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including an incident response policy, vulnerability management policy, disaster recovery and business continuity plan, vendor risk management program, programs for incident detection and response, encrypting certain data, network security controls, data segregation, asset management tracking and disposal, penetration testing, employee training, access controls, physical security controls, systems monitoring, a dedicated cybersecurity officer; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity and Data Privacy Oversight Subcommittee (the "Privacy and Security Subcommittee") of the Nominating and Corporate Governance Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, including legal counsel; cybersecurity consultants; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes requiring certain vendors to complete security questionnaires, conducting risk assessments for certain vendors, reviewing security assessments, conducting security assessment calls with certain vendor security personnel, and imposing information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors in Part I, Item 1A of this Annual Report, including in the section titled "Risks Related to Privacy and Security."


text: Our cybersecurity incident response policy and security incident handling procedure are designed to escalate certain cybersecurity incidents to members of management who are part of the Incident Management Team. The Incident Management Team works to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the cybersecurity incident response policy and security incident handling procedure include escalating certain cybersecurity incidents to our disclosure committee and, if appropriate, to the Privacy and Security Subcommittee.


text: The Privacy and Security Subcommittee meets periodically, and receives regular reports from our Vice President, Cybersecurity and, as appropriate, other members of the Information Security Team concerning any significant cybersecurity threats and risk and the processes we have implemented to address them. The Privacy and Security Subcommittee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation, generally. The Privacy and Security Subcommittee provides regular reports to the Nominating and Corporate Governance Committee of significant matters related to the Privacy and Security Subcommittee's responsibilities, and the Nominating and Corporate Governance Committee together with the VP, Cybersecurity in turn provide regular reports to our Board of Directors on such significant matters.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data (Information Systems and Data).


text: Our information security function is led by our Vice President, Cybersecurity (our Information Security Team), and is supported by our Chief Technology Officer, our Chief Legal, Privacy and Compliance Officer and legal department, our Chief Information Officer, and our cybersecurity incident management team. Our Information Security Team is tasked with identifying, assessing and managing our cybersecurity threats and risks. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting risk assessments, coordinating with law enforcement concerning threats, conducting internal and external audits and threat assessments for internal and external threats, obtaining third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and tabletop incident response exercises.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity and Data Privacy Oversight Subcommittee (the Privacy and Security Subcommittee) of the Nominating and Corporate Governance Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Vice President, Cybersecurity and includes our Chief Human Resources Officer, Vice President, Privacy, senior personnel from our legal, finance, and relevant business departments (the Incident Management Team). Our Vice President, Cybersecurity brings extensive experience in software development, IT, and cyber security, gained in over two decades in the telecommunications, financial services, defense, and healthcare sectors. Notably, he spent four years at a medical device company focused on insulin delivery, where he successfully established the product security program and played a pivotal role in obtaining clearance for its flagship product line.


text: As the leader of our Information Security Team, our Vice President, Cybersecurity, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, requesting and allocating budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials ("Information Systems and Data").

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team, IT department and other relevant team members work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.