text: An enterprise-wide management group operates to evaluate the cybersecurity program's effectiveness. The Company has an employee who functions as a Chief Security Officer, whose responsibilities include cybersecurity and who has a reporting relationship to senior management. This employee has had a twenty-five year career with the Federal Bureau of Investigation (FBI) prior to joining the Company. She served as the Confidential Advisor to the Director of the FBI, providing strategic advice across all threats allowing her to develop unique and key insights into the global cyber threat landscape, FBI cyber strategy, and cyber operations. Prior to joining the Company, she served as the Special Agent in Charge of the FBI Jacksonville Division where she led all FBI cyber investigations and operations for nation state and criminal actors.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: The Board may also receive briefings from management on our cyber risk management program, and may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO) or external experts as part of the Board's continuing education on topics that impact public companies. Members of our management team, including our CFO, Head of Information Technology, General Counsel and our Vice President of Quality Assurance, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and oversees our retained external cybersecurity experts, which includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN

secItem: Item 1C


text: Tier 1. Access to critical infrastructure, data, or services affecting critical infrastructure. Administrative or privileged access to production systems, including hosting or developing systems, applications, websites, software, or SaaS solutions. Tier 2. Non-privileged access to Company applications.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: • Ongoing Evaluation and Assessment of Systems and Processes. We update our information security management system from time to time as appropriate and we employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks. • Security Awareness Program to Train and Test Personnel. We sponsor a multi-faceted security awareness program that includes mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Cyber Incident Response Plan. We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the ECS team would escalate the issue to the Council for initial analysis and guidance. In the event of a significant breach, the CIRT, overseen by the Council, would typically be tasked with preparing an initial response. The Council (in consultation with, among others, the CIRT) would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The ECS team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent ECS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: We have established a Cybersecurity Steering Committee comprised of key leaders across the Company whose responsibilities include oversight of technology, security, and reporting functions. The objective of the Cyber Security Steering Committee is to set policies and procedures for the Company in relation to cyber events, including the Company's response protocols and disclosure requirements upon occurrence of any cyber event that is considered material to the Company.

companyName: JBT MAREL Corp

ticker: JBTM


text: Our cybersecurity leadership team is made up of highly experienced professionals with an extensive background in information security, risk management, and incident response. This background includes a dynamic team, comprised of military veterans versed in forensic analysis and regulatory compliance with over 23 years of combined Cybersecurity experience in private and public sector, supported by a Master's degree in Cybersecurity as well as several industry certifications.

companyName: CSI Compressco LP


text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The S ponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.

companyName: Grayscale Horizen Trust (ZEN)

ticker: HZEN


text: In the event of a cybersecurity incident impacting us, our Advisor or Ares, Ares has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Ares, including coordinating with the relevant members of our Advisor. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Ares' Chief Information Security Officer ("CISO"), and, as appropriate, escalation to the full Ares ERC and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Ares, as well as to the audit committee of our board of directors and to our full board of directors, if appropriate.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: The Company's management, including the Company's Chief Compliance Officer and the investment manager's Global Chief Information Security Officer, are responsible for conducting a regulatory risk assessment which includes cybersecurity threats. Members of Company management possess relevant experience in various disciplines that are important to effectively managing cybersecurity related risks including Security Operations, Vulnerability Management, Network Security, Application and Cloud Security, and cybersecurity risk management. Management of the Company and the investment manager maintain compliance programs which include policies and procedures that are reasonably designed to address regulatory risks related to cybersecurity. The compliance programs include controls to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents impacting the Company; in addition to the compliance programs, a vendor oversight program is leveraged to monitor risks associated with relevant service providers including cybersecurity.

companyName: PIMCO Capital Solutions BDC Corp.


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: We understand the importance of identifying, assessing, and managing risks related to cybersecurity threats and data protection. We acknowledge the potential adverse effects of cybersecurity incidents on our business. As part of our enterprise risk management program, cybersecurity risks are evaluated alongside other company risks within the broader risk assessment process. Our data security plan incorporates a specialized cybersecurity risk assessment process, which helps us identify potential risks by benchmarking our procedures against National Institute of Standards and Technology (NIST) standards and engaging third-party experts to test the security of our information systems. Key aspects of our risk management program include: • Monitoring Regulatory Changes: We monitor emerging data protection laws and, if necessary, implement changes to our policies and employee training processes. • Cybersecurity Policy Reviews: We regularly review and update (when applicable) our policies and procedures related to cybersecurity. • Security Tools and Response Exercises: We use various tools, such as network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to assist in risk identification and assessment. We then use these findings (where applicable) to enhance our processes and technologies. • Employee Training: We conduct annual cybersecurity awareness training for all employees with computer access, as well as specific training for those who handle sensitive data or are involved in cybersecurity management. • Expert Collaboration: We work with third-party subject matter experts to assess cybersecurity threats, their severity, and potential mitigation strategies. • Safeguard Third-Party Data: Through policy, practice, and contracts (as applicable), we require employees, as well as third parties providing services on our behalf, to treat customer information and data with care. • Use of Third-Party Service Providers: As cybersecurity considerations affect the selection and oversight of our third-party service providers, we also conduct pre-engagement assessments for third-party providers based on the sensitivity of the data they handle, and annually review SOC 1 or 2 reports for certain outsourced service providers whose systems are utilized in processing company or employee data. • Phishing Simulations: Regular phishing simulations help employees recognize and respond to potential email threats, with additional training provided, as necessary • NIST Framework: We leverage the NIST incident handling framework to guide our responses to actual or potential cybersecurity incidents, covering identification, protection, detection, response, and recovery.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Our Information Security team, including our Information Security leadership, has primary responsibility for assessing and managing material risks to the Company from cybersecurity threats, including our overall cybersecurity risk management program and supervision of our internal cybersecurity personnel and our external cybersecurity consultants.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Primary responsibility for assessing any cybersecurity risks rests with our Chief Executive Officer, who would report any threat to our Board date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.

companyName: GLOBAL LEADERS CORP

ticker: GLCP


text: Our Chief Financial Officer ("CFO") has significant work experience related to information security issues and oversight and is the executive officer that oversees our cybersecurity program, which includes the implementation of controls to identify threats, detect attacks and protect our information assets. Our dedicated ERM Committee, which includes our CFO and certain members of our executive leadership team, provides principal oversight and guidance of our cybersecurity risk management programs and processes. While our Board has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. Our Audit Committee is responsible for reviewing and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures and the guidelines, programs and steps implemented by management to assess, manage and mitigate any such exposures. The ERM Committee reports to the Audit Committee at least annually on the Company's enterprise risk management and will report cybersecurity incidents to the Audit Committee as they occur, if material.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Century Communities, Inc.

ticker: CCS


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 39 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 25 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.

companyName: JUNIPER NETWORKS INC


text: VRM considers specific factors in performing their due diligence based on the risk profile of the high-risk and vital vendor and services being performed. The specific factors include, but are not limited to, a review of the vendor's: Information security and related controls (third-party audit); Existence of disaster recovery and business continuity program and testing; Geographic location (country risk).

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Certifications and Audits We maintain the following ISO certifications related to our information systems: • ISO 22301:2019 (standard for implementing and managing an effective business continuity management system); • ISO/IEC 27001:2013 (security standard for information security management systems, covering our production, quality assurance and implementation environments); • ISO/IEC 27701:2019 (standard for establishing, implementing, maintaining and continually improving a privacy information management system); and • ISO 9001:2015 (standard for the implementation of quality management processes).

companyName: Paycom Software, Inc.

ticker: PAYC


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents.

companyName: Thoughtworks Holding, Inc.


text: Our Chief Executive Officer will oversee our information security programs, including cybersecurity initiatives, and is integrated into the cybersecurity the incident response process that we adopt. Our board of directors will oversee cybersecurity risk management activities, supported by Company management and external consultants.

companyName: NETWORK CN INC

ticker: NWCN


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences, which may adversely affect our business.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.

companyName: INCOME OPPORTUNITY REALTY INVESTORS INC /TX/

ticker: IOR


text: Innospec's Board and its committees provide oversight of the Company's IT, including cyber security, in connection with the Company's efforts to assess and manage the Company's risk exposure. Oversight of risk management, including cyber security risk management is an integral part of Board and committee deliberations throughout the year. Since 2019, the Board has retained NCC Group ("NCC") to perform cyber security reviews. NCC reports its findings directly to the Board. In addition, in early 2020 the Audit Committee retained Deloitte to lead a series of information technology risk evaluations. The evaluation resulted in a three-year audit plan covering Cyber Security, Legacy IT and IT Strategy. The audit plan was approved by the Audit Committee.

companyName: INNOSPEC INC.

ticker: IOSP


text: While the Company has experienced cybersecurity incidents, we are not aware of any cybersecurity incidents to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase and the preventative actions we have taken and continue to take to reduce these risks and protect our systems and information may not successfully protect against all cybersecurity threats and incidents in the future. For more information, see Item 1A. Risk Factors under the heading of "Technology and Data Security Risks", of this Annual Report on Form 10-K.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: As part of our board of directors' enterprise risk management program, our board of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Chief Legal Officer provides an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.

companyName: Absci Corp

ticker: ABSI


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity risks, including the oversight of management's implementation of our cybersecurity risk management program.

companyName: FuboTV Inc.

ticker: FUBO


text: The Audit Committee of our board of directors provides primary oversight and strategic guidance on Cybersecurity. The Audit Committee receives reports from management, typically on a quarterly basis, regarding our security risk management, including cybersecurity-related risks, vulnerabilities, policies, practices, and strategic initiatives. Annually, our board of directors receives a report from management on our cybersecurity posture, our readiness and our capability to reduce the risk of, detect and respond to a cyberattack. In 2022 and 2023, our senior management and board of directors completed cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: We rely on our technology network infrastructure and information systems to operate our business, interact with vendors and customers, and collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats and incidents, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity or availability of such systems or related information.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: We have developed and maintain a robust cybersecurity incident response plan. JFrog's cybersecurity incident response team has a comprehensive strategy and policies in place for managing security incidents. Along with swift threat classification, containment, and eradication, the strategy includes notification procedures to promptly inform and support stakeholders in accordance with applicable data breach notification laws. Incident analysis is carried out to understand root causes and drive continuous improvement.

companyName: JFrog Ltd

ticker: FROG


text: In addition, we have aligned our incident response plan and process with our enterprise risk and global crisis management processes. These critical linkages ensure that we have an effective and efficient overall response to potential threats, with appropriate leadership governance involved in the ongoing cyber materiality assessment and determination.

companyName: BALL Corp

ticker: BALL


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company to date. While we are not currently aware of any cybersecurity threats that are reasonably likely to materially affect the Company there is no assurance that we will not be materially affected by such threats in the future. For additional information on our risks related to cybersecurity, see Item 1A, Risk Factors—Operational Risks.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: In the event of a cyber security incident, we would follow an incident response protocol that includes procedures for incident tracking, escalation, containment, eradication, and recovery. As part of our incident response process, we would adhere to SEC reporting requirements related to cyber security incidents, providing timely and transparent disclosures as necessary.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: Emergency Management, Incident Response and Cyber Insurance – The Company has invested in technology and processes for timely incident response to security and crisis events. Physical and cybersecurity staff, health and safety, legal, operational and human resources personnel are part of the overall emergency and incident response team. The Company has partnerships with third parties for forensics, and incident response consulting. The Company also maintains effective levels of cyber insurance against large data breaches or cybersecurity events.

companyName: CINCINNATI BELL INC


text: Information technology systems, including our website, email system, and various other online processes and functions, are critical to our business and operations.

companyName: BAIYU Holdings, Inc.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company for ten years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: FS KKR Capital Corp

ticker: FSK


text: The Company's enterprise risk management ("ERM") program includes assessing, identifying and managing material risks from various sources, including those related to cybersecurity. The Company uses information from incident history, threat intelligence, formal and informal security networks, government information sharing and recognized information security frameworks to inform its cybersecurity risk management approach.

companyName: OPENLANE, Inc.

ticker: OPLN


text: Management provides regular reports to the Audit Committee, generally on an annual basis, or more frequently as needed covering: the Company's cybersecurity strategy and policies, recent threat environment developments, and any cybersecurity incidents and responses.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Our information security function works with management to prioritize risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data.

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: We recognize the critical importance of safeguarding our information systems and data against evolving cybersecurity threats. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Paragon 28, Inc.


text: The corporate information security team has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have threat intelligence and insider threat programs to identify external and internal threats, and to mitigate those threats in a timely manner to the best of our ability. In addition, we have developed security corporate practices, controls, and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks.

companyName: Altair Engineering Inc.


text: Our board of directors has ultimate responsibility for oversight of our risk management, and delegates cybersecurity risk management oversight to the audit committee. The audit committee, which is responsible for ensuring that management has processes in place designed to identify, evaluate and manage cybersecurity risks and incidents, regularly reviews our cybersecurity program with management and reports to the board of directors. Cybersecurity reviews by the audit committee generally occur at least quarterly. A number of our directors have experience in assessing and managing cybersecurity risk, including by serving on other public company audit committees having responsibility for cybersecurity oversight. One of our directors has also served as a Chief Technology Officer for multiple companies.

companyName: Genpact LTD

ticker: G


text: Periodically, we engage third-party consultants to assess the maturity of our cybersecurity controls using the NIST Cybersecurity Framework. The assessment covers our risk management processes, people, and technologies. The findings are shared with our Chief Information Security Officer ("CISO"), senior management, and the Board of Directors, and the results are used to refine or enhance our risk management practices relating to cybersecurity.

companyName: StoneX Group Inc.

ticker: SNEX


text: Role of the Board of Directors T he Audit Committee has responsibility for overseeing our cybersecurity risk management. In accordance with the Audit Committee's charter, the Audit Committee at least annually reviews and discusses with management, including the CIO and CISO, our processes, policies, procedures, and protocols related to cybersecurity and information security. In addition, the Audit Committee regularly reviews and discusses with management, including the CIO and CISO, cybersecurity program assessments and audits, planned improvements and the status of any information security initiatives, as well as risks from cybersecurity threats pertinent to us and any previous cybersecurity incidents experienced by us, including any material impact or reasonably likely material impact on the Company, our business strategy, results of operations, or financial condition. The Audit Committee provides reports to the Board at each regularly scheduled Board meeting of the matters it has recently addressed, including relating to the oversight of our cybersecurity risk management, and the full Board may participate, as warranted, in the Audit Committee's sessions on cybersecurity risk management. Outside advisors also may meet from time to time with the Audit Committee or Board, as warranted, to review and discuss cybersecurity matters.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Impact of Cybersecurity Risks on Business Strategy, Results of Operations or Financial Condition Substantially all of the Company's business is conducted online. Accordingly, there is a risk that a cybersecurity incident that impacts our ability to conduct business online (including any loss of confidence by consumers and counterparties in our information security practices or capabilities) could have a material adverse impact on our business strategy, results of operations or financial condition. The Company's approach to the management and mitigation of cybersecurity risks reflects the online nature of our business. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. As part of the Company's overall risk mitigation strategy, we maintain cyber liability insurance coverage. Such coverage, however, may not be sufficient to cover us against related claims. For additional information, see "Risks Related to our Business and Industry," in Item 1A, "Risk Factors" in this Annual Report.

companyName: QUINSTREET, INC

ticker: QNST


text: Nasdaq's brand and role as a critical infrastructure provider for global financial markets, and operator of The Nasdaq Stock Market, make us an attractive target for cybersecurity risks, including from international political opponents, hacktivists and ransomware or other financially motivated criminals targeting the financial sector. Our cybersecurity risks include financial and reputational damage, along with collateral damage from loss of customer confidence in our exchange, products or offerings, as applicable, potential regulatory enforcement actions or litigation, either from governmental authorities, shareholders, or other litigants, or the failure to comply with contractual breach notifications. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business, our business strategy, our results of operations or financial condition. For further information, see "Our role in the global marketplace positions us at greater risk for a cyberattack" and "Expanded cybersecurity regulations, and increased cybersecurity infrastructure and compliance costs, may adversely impact our results of operations" in "Item 1A, Risk Factors" of this Annual Report on Form 10-K.

companyName: NASDAQ, INC.

ticker: NDAQ


text: The Company has an Information Technology ("IT") Risk Governance Program that aligns with our enterprise risk management framework and assists with fulfilling oversight responsibilities for major IT risks, including cybersecurity risks. An enterprise Cyber Governance, Risk, and Compliance function manages overall Company cyber risk, coordinating risk management functions with each business. Business and IT leaders conduct cyber risk reviews monthly within each business. These monthly reviews include the evaluation of new and evolving risks, management of risk mitigation plans, and a review of all cybersecurity incidents meeting certain criteria.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure, or those of our vendors or others with which we do business, could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation."

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: As a large, multinational transportation and logistics company, we face a range of risks from cybersecurity threats in connection with our operations due to our inherent dependence on interconnected advanced information systems, software, and digital technologies to operate safely, efficiently, and effectively. Such risks include, but are not limited to, those related to cyberattacks, network breaches, ransomware, malware or denial-of-service attacks, phishing and other scams, theft, and unauthorized disclosure, any of which, if successful, could result in the disclosure of confidential customer or commercial data, loss of valuable intellectual property, or systems disruption, and subject us to civil liability, fines, penalties, damage of our brand or reputation, or otherwise harm our business, any of which, could be material. We are exposed to such risks both through direct attacks on our own information systems and, indirectly, as a result of our engagement of third-party service providers, software vendors, and independent contractors, such as cloud computing providers. Certain of our third-party service providers or software vendors provide us with computing services which, in certain cases, involve hosting our data or processes on third-party servers, which exposes us to the risk that our data may be compromised or our operations disrupted if such third-party servers are compromised. Other third-party service providers provide us with contracted labor to whom we necessarily grant access to certain of our information systems, which indirectly exposes us to additional risks of network breaches and cybersecurity threats. In addition, because the trucking industry has been designated by the federal government as part of the critical U.S. infrastructure, as a leading provider of truckload, intermodal, and logistics services, we face increased risks from cybersecurity threats, cybercriminals, and bad actors, both foreign and domestic.

companyName: Schneider National, Inc.

ticker: SNDR


text: The Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company's cybersecurity, information security, and information technology risks. On an annual basis, the Audit Committee reviews and discusses with the Chief Financial Officer, who leads our cybersecurity program, the Company's policies, procedures, and practices with respect to cybersecurity, information security and information and operational technology, including related risks.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: We use various mechanisms to detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually. We also conduct tabletop exercises to simulate responses to cybersecurity incidents. During these exercises, our team of cybersecurity professionals collaborate with technical and business stakeholders across the organization to further analyze the risk to the company and form detection, mitigation, and remediation improvements. We also engage third parties, including assessors, consultants, and auditors to assess our cybersecurity control environment and to test the vulnerability of our cybersecurity infrastructure at least annually.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Historically, risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations, or financial condition. As previously disclosed, in November 2023, the Company initiated its cyber response protocol in response to a cybersecurity incident that resulted in a disruption of portions of its information technology systems. Promptly after detecting the issue and per LivaNova's cyber response protocol, the Company began an investigation with assistance from external cybersecurity experts and coordinated with law enforcement. The Company implemented remediation measures to mitigate the impact of the incident. The Company also assessed the nature and scope of the affected data, analyzed its statutory notification obligations, and notified affected individuals and regulators as required by applicable law. The incident has been contained, and the Company's mitigation efforts are considered complete, but any future cybersecurity event has the potential to materially affect the Company's results of operations, cash flows, and financial condition. For further information, please refer to "Part II, Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" and "Note 11. Commitments and Contingencies" in LivaNova's consolidated financial statements in this Report. Additionally, for a description of the Company's evaluation of its disclosure controls and procedures, management's report on internal control over financial reporting, and changes in internal control over financial reporting, see "Part II, Item 9A. Controls and Procedures. "

companyName: LivaNova PLC

ticker: LIVN


text: We provide mandatory training and resources for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: The CIO and CFO are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CIO reports to the CFO and is responsible for implementing and maintaining the enterprise cybersecurity organization. The CIO has over 20 years of experience in Information Security and Cybersecurity for public and private institutions in the pharmaceutical, insurance, manufacturing, healthcare, and non-profit industries. The CFO also brings over 20 years of experience with a focus on small to mid-size public companies in the life science and technology fields.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Technical Safeguards—We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including rate-limiting and web application firewalls, anti-malware and anti-phishing technology, access controls, and threat detection systems including posture management tooling. We conduct regular security reviews of our technical components, code, libraries, and environments.

companyName: Redfin Corp


text: Our board of directors does not have a standing risk management committee, but rather administers this oversight function directly through our board of directors as a whole, as well as through various standing committees of our board of directors that address risks inherent in their respective areas of oversight. While our board of directors has a fiduciary duty to monitor and assess strategic risk exposure, our audit committee is responsible for overseeing our major financial risk exposures and the steps our management has taken to monitor and control these exposures, overseeing cybersecurity risks and assisting the board of directors in its oversight over enterprise risk management. The audit committee also approves or disapproves any related person transactions. Our nominating and corporate governance committee monitors the effectiveness of our corporate governance guidelines and manages risks associated with the independence of the board of directors. Our compensation and leadership development committee assesses and monitors whether any of our compensation policies and programs has the potential to encourage excessive risk-taking.

companyName: Senmiao Technology Ltd

ticker: AIHS


text: We depend on a variety of information systems and technologies to maintain and improve our competitive position and to manage the operations of our business, including supply chain, merchandising, point of sale, e-commerce, marketing, finance, accounting, and human resources. Our core business systems consist mostly of purchased software programs that integrate together with our internally developed software solutions across a company-wide network that connects all corporate users, stores, and our distribution center infrastructure.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: Risk Management and Strategy BancPlus' cybersecurity program is integrated into its overall enterprise-wide risk management program and based on guidance established by the National Institute of Standards and Technology ("NIST"), the Federal Financial Institutions Examination Council ("FFIEC") and other applicable regulatory standards, as described below.

companyName: BANCPLUS CORP


text: The Company has in place a documented cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Cybersecurity threats and incidents are analyzed by the security operations center and based on the severity of the event, promptly reported by the Chief Information Security Officer to the Vice President Compliance & Audit to initiate cross-functional response team support. The role of the response team includes evaluating compliance with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. As part of the Company's documented response plan, management members of the Board of Directors, who have been delegated responsibility for cybersecurity, are notified of significant cybersecurity events and provide strategic direction through the incident response and communication. The management members of the Board of Directors are regularly briefed on cybersecurity threats relevant to the Company as well as the Company's cybersecurity program, incident response and remediation efforts. The Company's cyber incident response plan is tested periodically through third-party conducted executive and technical tabletop exercises. A summary report identifying strengths and areas for improvement is provided to tabletop exercise participants and utilized by the Company to enhance its response plan.

companyName: BURLINGTON NORTHERN SANTA FE, LLC


text: Protection of Client Information Data privacy and cybersecurity laws and regulations concerning the collection, storage, handling, use, disclosure, transfer, protection and other processing of client information (including personal information) affect many aspects of the Company's business, and are continuing to evolve. Data privacy and cybersecurity are currently areas of considerable legislative and regulatory attention, with new or modified laws, regulations, rules and standards frequently being adopted and potentially subject to divergent interpretation or application in a manner that may create inconsistent or conflicting requirements for businesses.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: The CISO coordinates all aspects of the Information Security Program and presents a report on the Information Security Program to the Information Cyber Security Subcommittee on a quarterly basis so that the Subcommittee is made aware of a wide range of topics including recent developments in the Information Security Program, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the company, including its business strategy, results of operations or financial condition.

companyName: MARCUS CORP

ticker: MCS


text: Effective risk mitigation dependents on a robust risk assessment process that identifies, measures, controls, and monitors cybersecurity threats. These threats include any unauthorized activities within the Company's information systems that could compromise the confidentiality, integrity, or availability of data. The Company's Information Security Program incorporates a comprehensive information security risk assessment, which includes: • Identification of reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information or information systems. • Evaluation of the likelihood and potential damage of these threats, considering data sensitivity. • Assessment of the sufficiency of existing policies, procedures, information systems, and other controls in mitigating risks.

companyName: First Financial Northwest, Inc.


text: The Company will continue to develop and implement its Cybersecurity Policy framework as part of its overall enterprise risk management. It will spell out the protection requirements in several key cybersecurity and technology areas such as managing risks arising from engaging with third parties.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: The Chief Information Security Officer ("CISO") reports to the CSO and oversees the Company's Security Operations Center ("SOC"). The CISO establishes and oversees the execution of prioritized cybersecurity mitigation plans for the Company. Zebra's current CISO was appointed to the role in 2018 and has held multiple leadership roles overseeing IT functions since joining the Company in 2004, including driving efforts within the cybersecurity function.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Management and Strategy Our information systems consist of computer systems used by the Company's Chief Executive Officer and Chief Financial Officer. They actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats they discover or that are reported to them, and reports and services that identify threats. They monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: The Cybersecurity and Risk Management Team, as described below, is responsible for the operationalization of the Company's cybersecurity practices, which consists of, but are not limited to: (i) updating and enhancing the Cybersecurity Risk Management Program, (ii) overseeing third-party assessors, consultants, auditors, and other experts, and (iii) assessing, identifying, managing and addressing potential threats or incidents.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: To date, risks from cybersecurity threats have not materially affected our Company or our business strategy, results of operations or financial condition. However, if we were the subject of a significant cyber-attack or security breach in the future, it could materially affect our Company, as discussed in further detail under "Item 1A. Risk Factors— Risks Related to the Business of the Company—A security breach or a cyber-attack could adversely affect our results of operations and financial condition."

companyName: Finance of America Companies Inc.

ticker: FOA


text: Our cybersecurity management team includes our CISO, Data Privacy Officer, CLRO, Chief Financial Officer, and Head of Internal Audit. The CISO, in coordination with the team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The cybersecurity management team meets regularly to review cybersecurity and data privacy strategy, receive updates, and consider the Company's current risk posture. The team meetings also build leadership consensus on cybersecurity risk management and tolerance. In the event they become aware of a cybersecurity threat or incident, employees are expected to follow established lines of communication to notify the relevant members of the cybersecurity management team and allow the relevant team members to coordinate the evaluation and response to such threats and incidents as necessary. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the rest of the cybersecurity management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to other members of senior management and the Audit Committee when appropriate. Such plans also dictate notification responses to Company management based on the severity of the incident.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: Our management team meets regularly with our IT service provider to review current cybersecurity issues. These discussions may cover efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including: threat intelligence from governmental, public private, and external sources alerts and reports generated by security tools deployed in the IT environment, including a spear-phishing report. Our Board incorporates cybersecurity risks into its broader risk oversight responsibility.

companyName: Hour Loop, Inc

ticker: HOUR


text: Role of the Board The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk, at least annually. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including cybersecurity.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: Markel participates in the Financial Services Information Sharing and Analysis Center to share information about the latest cyber threats and preparedness measures. Markel also shares threat intelligence information with other partners. Markel has a cybersecurity incident response plan, as well as a crisis management plan, that cover cyber events, including a process for determining the materiality of cyber events that includes evaluation by a cross functional crisis management group including security, information technology, finance, legal and business and escalation to Markel Group senior management as warranted by the severity of the situation. An internal team engages in tabletop exercises on a regular basis to enhance preparedness for such situations.

companyName: MARKEL GROUP INC.

ticker: MKL


text: We monitor our environment using tools designed to detect security events on an ongoing basis and we engage with third parties to audit our information security program and to perform regular penetration tests of our applications and infrastructure environments. In addition, our third-party risk management program oversees and identifies service provider risks through pre-onboarding security evaluations, ongoing monitoring, and conducting regular reassessments, with an emphasis on those service providers that have access to our systems or networks or that receive or store non-public information. Any risks identified by or to us through these activities are reported in an internal risk register and actively managed. We work to remain vigilant with respect to new and emerging risks utilizing these tools, and our security team continues to review and make strategic investments in our information security program in support of our efforts to keep our data and systems secure.

companyName: Oportun Financial Corp

ticker: OPRT


text: Describe the registrant's processes, if any, for assessing, identifying and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes. In providing such disclosure, a registrant should address, as applicable, the following non-exclusive list of disclosure items: Whether and how any such processes have been integrated into the registrant's overall risk management system or processes. Whether the registrant engages assessors, consultants, auditors, or other third parties in connection with any such processes.

companyName: Energy & Water Development Corp

ticker: EAWD


text: Cyber risk monitoring also includes the Company's arrangements with and exposure to third party service providers. We identify the criticality of our third -party service providers, in part, by determining their use of and access to confidential customer information. We conduct comprehensive cybersecurity reviews on all third parties that have access to confidential information. Our third -party reviews make use of technology that provides significant visibility into third party organizations, in real time, to assess third party compliance with a host of globally recognized IT security standards and frameworks and the likelihood of a cyberattack on a third party.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to management's Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. Management's Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by management's Cybersecurity Risk Committee, with material issues raised with our Board.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: Board and Management Oversight The Company's management is involved in assessing Security Incidents to the extent discussed in the IRP above. The Board and Audit Committee are notified and updated on any Security Incidents on a regular basis. The Board actively oversees our enterprise risk management, including cybersecurity risks. Our cybersecurity policies and procedures are integrated into our overall risk assessment program. Additionally, the Audit Committee is responsible for overseeing our cybersecurity risk management and strategy and regularly meets with the CTO about the Company's ongoing compliance and risk management and reports to the Board regularly.

companyName: ContextLogic Inc.


text: Alcoa's CISO has twenty-five years of experience in Information Technology, carries multiple certifications in information security, and has extensive cybersecurity risk management experience in manufacturing organizations. The CISO closely collaborates with the CIO and Chief Financial Officer (CFO) in managing material risks from cybersecurity threats. Alcoa also maintains an information security steering committee, which oversees current and emerging cybersecurity risks to the Company. The steering committee is comprised of a cross-functional team of leaders from across Alcoa's business groups, including the CISO and CIO.

companyName: Alcoa Corp

ticker: AA


text: The Company's Information Security Steering Committee ("ISSC"), further described below under "Governance", oversees information and cybersecurity risk management for the Company. The ISSC assists the board of directors in fulfilling its oversight responsibilities concerning the role of information security and cybersecurity in executing the Company's business strategy and complying with regulatory requirements. The ISSC is responsible for managing and enforcing the Company's information security program, development of cybersecurity policies, strategies, and plans, monitoring control statuses and program gaps, facilitating program assessments which include risk assessments and business impact analysis, and evaluating risk mitigation strategies to address cybersecurity threats. The Company's cybersecurity framework includes an assessment of critical systems, physical security, and information resources both within and outside the Company that exposes it to cybersecurity threats. The ISSC employs policies, systems, and safeguards to manage those cybersecurity risks. The Company continues to expand investment in information technology and cybersecurity infrastructure, including enhanced threat monitoring and detection services.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: We work in partnership with our human resources team to provide mandatory training for our employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: VINEBROOK HOMES TRUST, INC.


text: As of March 15, 2024, the Partnership's business strategy, operations, or financial condition have not been materially affected by and are not likely to be materially affected by, any cybersecurity threats or incidents.

companyName: Summit Midstream Partners, LP


text: We conduct technical risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We conduct programmatic risk assessments, including identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Peraso Inc.

ticker: PRSO


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners, and employees toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, procedures, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Our board of directors has overall oversight responsibility for our enterprise risk management, and delegates cybersecurity risk management oversight to its Security Committee, which was established this past year. The Security Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. On a quarterly basis, the Security Committee meets with our Chief Information Security Officer, ("CISO"), and other senior executives to perform more in-depth reviews of the Company's cybersecurity programs, as well as relevant cybersecurity risks and mitigation strategies. Ahead of each such quarterly meeting, management, including the CISO and our information security team, prepares and provides cybersecurity reports that cover, among other topics, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies, legislative developments affecting MongoDB's information security program, and notable security incidents and investigations. The Security Committee subsequently reports material cybersecurity matters to our full board of directors. In addition, our management follows a risk-based escalation process to notify the Security Committee outside of the regular reporting cycle when they identify an emerging cybersecurity risk.

companyName: MongoDB, Inc.

ticker: MDB


text: The Company recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats and is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: Management and Strategy have established cybersecurity risk assessment procedures to ensure effectiveness in cybersecurity management, strategy and governance and reporting cybersecurity risks. The process is in alignment with our strategic objectives and risk appetite.

companyName: Singularity Future Technology Ltd.

ticker: SGLY


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, employee training, access controls, cyber insurance, and systems monitoring.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: The Audit Committee provides oversight of our cybersecurity risk management, as the security of athlete and teammate data continue to be Company-wide priorities. Our cybersecurity risk management is led by our CISO, who has more than 24 years of experience leading cybersecurity capabilities and management of cybersecurity risk. The CISO reports to the Company's Chief Technology Officer, who reports directly to the Company's Chief Executive Officer. The CISO provides quarterly (or more often, if necessary) updates to the Audit Committee and periodic updates to the full Board, regarding existing and new cybersecurity risks, including how management is mitigating those risks. The CISO and the broader cybersecurity team is responsible for detecting, containing, and responding to cybersecurity incidents as documented within the IR Plan.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: Our Audit Committee is responsible for overseeing information security and cybersecurity risk. Senior leadership communicates with the Audit Committee at least quarterly regarding information security and cybersecurity risk and formally reports to the entire Board on information security and cybersecurity risk at least annually.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Given the data-driven nature of our business and the prevalent use of technology in operating our business, we face cybersecurity risks that could materially affect our business strategy, results of operations and financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Risks from Cybersecurity Threats We face a number of cybersecurity risks in connection with our business. We do not currently believe that any current cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, Hilltop, including its business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see Item 1A., "Risk Factors — Our operational systems and networks have been, and will continue to be, subject to an increasing risk of continually evolving cybersecurity or other technological risks, which could result in a loss of customer business, financial liability, regulatory penalties, damage to our reputation or the disclosure of confidential information."

companyName: Hilltop Holdings Inc.

ticker: HTH


text: We have implemented and maintain various information security processes designed to mitigate risks on a case-by-case basis from cybersecurity threats to our critical computer networks, third party-hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials (IT Assets). The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations. The Company's information security program evaluates threats posed by internal and external factors and supports daily operational functions that prevent unauthorized access or compromise.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Board is responsible for overseeing risk management. Our Board understands the critical nature of managing risks associated with cybersecurity threats, and, accordingly, cybersecurity is an integral part of the Company's overall risk management program. The Board's Audit Committee has primary responsibility for overseeing cybersecurity and privacy risks. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Boxlight Corp

ticker: BOXL


text: For discussion of our risk factors relating to cybersecurity and data privacy, see the "Risks Related to Data Privacy" section included in Part I, Item 1A, "Risk factors" of this Annual Report on Form 10-K.

companyName: CHEGG, INC

ticker: CHGG


text: The Company's cybersecurity team manages all facets of the security monitoring and incident program, coordinating with Company engineers and other staff, along with third parties as needed, across our operating companies. All company employees are provided cybersecurity awareness training, which includes topics on the Company's policies and procedures for reporting potential incidents. The Company's cybersecurity team evaluates emerging risks, regulations, and compliance matters and updates the policies and procedures accordingly on an ongoing basis.

companyName: Dave Inc./DE

ticker: DAVE


text: Company's board of directors oversees our cybersecurity strategy and risk management, ensuring that cybersecurity remains a priority as our company evolves. We believe that a proactive and adaptive approach to cybersecurity is essential to safeguard our company's assets, reputation, and the trust of our stockholders.

companyName: NEXIEN BIOPHARMA, INC.

ticker: NXEN


text: The audit committee receives reports concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them, including during audit committee meetings and other periodic updates. These reports are provided by members of the Company's management team responsible for such reporting, including the Cybersecurity Risk Management Committee. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: We have a management-level cybersecurity committee that has primary responsibility for our overall cybersecurity risk management program and oversees our internal cybersecurity personnel and retained external cybersecurity consultants. The cybersecurity committee includes our Chief Financial Officer, CIO) CLO and our Director of Internal Audit. Our CISO meets with the members of the cybersecurity committee regularly, together with other members of the internal cybersecurity risk management team, to provide updates on cybersecurity issues and risk management activities related to preventing, detecting and mitigating cybersecurity incidents.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Our CISO oversees our cybersecurity efforts and governance programs, tests our compliance with standards, remediates known risks, and provides regular guidance to management and the Board on these areas. In addition, to supplement this expertise, we periodically engage external experts, including cybersecurity consultants, to help us evaluate our risk management related policies and to help us to review and remediate cybersecurity incidents.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing and changing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office. Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.

companyName: Sharplink, Inc.

ticker: SBET


text: Integrated risk management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Key Risk Indicators, established in conjunction with Board approved Statement of Risk Appetite, are reported to the Information Technology Steering Committee, Risk Management Committee and the Risk Committee of the Board of Directors on at least a quarterly basis. The Board's Risk Committee is provided an information security update on an annual basis. This escalation process provides for communication of any needed mitigation and remediation efforts related to cybersecurity risks.

companyName: FB Financial Corp

ticker: FBK


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO), who reports to our Head of Enterprise Risk Management and receives input and support from our Head of Enterprise Risk Management and our Chief Technology and Transformation Officer. Our CISO has extensive experience leading and managing cybersecurity programs and in cybersecurity risk management. Our CISO has served in this position since 2014 and, before Genpact, was previously CISO at another US-listed public company. Our CISO is supported by our information security team, many of whom hold cybersecurity certifications and who collectively possess relevant experience in different areas of cybersecurity, and by our information technology team who operate several critical controls.

companyName: Genpact LTD

ticker: G


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from cybersecurity threats; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • controls designed to identify and manage cybersecurity threats associated with our use of third-party service providers, suppliers and vendors with respect to our critical systems and data.

companyName: FuboTV Inc.

ticker: FUBO


text: Our cybersecurity risk management process, which is discussed in greater detail above, is led by our IT Manager. Such individual has over twenty five years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Cybersecurity is a component of Diversified's ERM Program. The ERM program entails risk identification, assessment, prioritization, monitoring and mitigation processes, which are continually evaluated and enhanced. The risk assessment process takes into account broader risks such as strategic, operational and regulatory and financial implications. Additionally, the ERM program risk assessment is discussed with members of Diversified's Senior Leadership Team and its Audit Risk Committee, which includes members of Diversified's Board of Directors. In addition to Diversified's ERM Program, Diversified's governing policies and procedures create a structured approach to managing cybersecurity risk. Diversified's network is designed using a Zero Trust Approach ( ZTA) and is segmented to include several layers of security, including least privilege access, conditional access policies, and multi-factor authentication ( MFA). The ZTA encompasses identity, endpoints, infrastructure, data, and applications for enhanced visibility, intelligence and automation for Diversified's security team. Diversified network environment is completely cloud based and is therefore continuously tested from both trusted and untrusted sources - both external and internal to its networks, rather than relying on a one-time penetration testing approach. Additionally, Diversified's employees are subject to annual cybersecurity training and e-learning sessions as employees are viewed as the first line of defense against cybersecurity attacks.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: The Audit Committee and its Technology Subcommittee are also responsible for overseeing risks related to our cybersecurity, technology and information security programs and reviewing emerging cybersecurity, technology and information security developments and threats and our strategy to mitigate such risks. The Audit Committee and its Technology Subcommittee provides another level of cybersecurity oversight through engagements at each Technology Subcommittee meeting with senior management, including our CIO and CISO. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters. The Technology Subcommittee regularly reports to the Audit Committee regarding these matters. Further, the Audit Committee regularly reports to the Board regarding these matters, including the matters discussed at the Technology Subcommittee.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: We face significant and persistent cybersecurity risks due to the need to protect our business, our confidential information and information concerning our personnel and others with whom we conduct business. As with other technology companies, we occasionally face threats from actors who seek to disrupt our business as well as others who are engaging in malicious activities for profit, to make a political point or for no particular reason other than creating disruption. Disclosure of certain information as a result of a cybersecurity breach may result is a breach of privacy laws. The substantial level of harm that could occur to us and our suppliers and customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components requires us to maintain robust governance and oversight of these risks and to implement mechanisms, technologies and processes designed to help us assess, identify, and eliminate these risks.

companyName: Wetouch Technology Inc.

ticker: WETH


text: Fortress also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Fortress conducts regular phishing tests and provides additional training as appropriate.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—General Risks—We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: We follow a cross-functional approach to addressing the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, enterprise risk management, internal audit and other key business Cybersecurity | Cybersecurity Risk Management and Strategy functions in an ongoing dialogue regarding cybersecurity threats and incidents. As described in "Board Oversight"

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges with a material impact on our strategic plan, operations, or financial standing. For additional information, see "Item 1A. Risk Factors - We are subject to security risks related to our products as well as our information and technology systems".

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. The Enterprise Security Director has over 26 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: Oversight of Third Parties The Company has processes to oversee and identify material risks from cybersecurity threats associated with the Company's use of third-party service providers. In this regard, the Company's cybersecurity risk management program takes into account third-party systems whereby the Company could be impacted by the compromise of the security of vendors or other business relations of the Company, and the Company has a comprehensive third-party access management system. In addition, the Company conducts risk-based due diligence on the profiles of third-party service providers with respect to cybersecurity risks prior to engagement, and providers of critical services are continuously monitored with respect to security risks. The Company also requires service providers to provide prompt notification of any actual or suspected breach impacting Company data or operations.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Management, and specifically our Chief Financial Officer, reports to our Audit Committee on cybersecurity, including initiatives and strategies, and incident reporting and any lessons learned. Beginning in 2024, our Chief Financial Officer will make this report on a quarterly basis.

companyName: MICROVISION, INC.

ticker: MVIS


text: Our enterprise risk management committee, which operates within our risk department and comprises certain of our senior leaders including operations, finance, information technology, government relations, legal, marketing, health plan leadership, health operations, and communications meets at least four times per year to discuss significant risks to the Company identified by our enterprise-wide risk management process, including cybersecurity risks identified by our cybersecurity risk management program. The enterprise risk management committee also discusses the steps management has taken to identify, monitor, assess, and control or avoid such exposures and reviews performance measures against the Company's risk appetite and tolerance and provides recommendations of corrective action where appropriate.

companyName: CENTENE CORP

ticker: CNC


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Manager and other third-party service providers. The Investment Manager manages our day-to-day operations and has implemented the Investment Manager's Information Security Program ("ISP") that applies to the Company and its operations.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: Our internal compliance organization, through its involvement in the ISPEC, the Enterprise Compliance Counsel ("ECC") and Internal Audit Department, works closely with our cybersecurity team in assessing and managing our cybersecurity risk.

companyName: RADIUS RECYCLING, INC.


text: While we have not experienced any material cybersecurity threats or incidents to our knowledge in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems."

companyName: City Office REIT, Inc.


text: The Company maintains a cyber risk management program that is designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program addresses both the corporate information technology ("IT") environment and customer facing products. In line with our dedication to upholding strong corporate governance standards and safeguarding the security of our operations, we maintain a continuous effort to assess and mitigate cybersecurity risks that could impact our business, stakeholders and the integrity of our systems. Additionally, we maintain a similar risk-based approach to our third-party vendor management program including identifying and overseeing cybersecurity risks they present.

companyName: NBT BANCORP INC

ticker: NBTB


text: The Audit Committee reports to the Board of Directors regarding its activities related to cybersecurity. In addition, the Board of Directors also directly receives reports from management on our cybersecurity risk profile and on the performance of our data privacy and cybersecurity risk management program, semi-annually in alternating quarters with the Audit Committee.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Our Information Technology Lead is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual is working in that role for more than 10 years for the company. We also engaged with third-party IT service providers, who specialize in the field of cybersecurity risk management, for targeted employee training and system risk assessments.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: While we have experienced a cybersecurity incident in the past, as of the date hereof, none have materially affected us or our business strategy, financial condition, results of operations, and/or cash flows. We continue to invest in cybersecurity and resiliency of our networks to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information which they contain. For more information about cybersecurity risks relating to our business, refer to Item 1A, Risk Factors included in this Annual Report on Form 10-K.

companyName: Symbotic Inc.

ticker: SYM


text: The Audit Committee must also consider Arvana's cyber security measures and the back-up of information systems, along with what steps Arvana has taken to monitor and control cybersecurity exposure. Further, the Audit Committee is tasked with the responsibility for conferring with management and Arvana's auditors as to the adequacy and effectiveness of information safeguards, cybersecurity policies, and internal controls that impact information security. The Audit Committee will be briefed on any material cybersecurity incidents that might adversely affect our business at least once each year, such brief will include topics such as risk assessment, risk management, control decisions, service provider arrangements, security incidents, responses with recommendations for changes or updates to policies and procedures.

companyName: ARVANA INC

ticker: AVNI


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1A. Risk Factors – Risks Related to the Company - Cybersecurity risks and cyber incidents may adversely affect our business in the event we or any other party that provides us with essential services experiences cyber incidents" in this Annual Report on Form 10-K.

companyName: HG Holdings, Inc.

ticker: STLY


text: Annual Cybersecurity Plan. This plan is provided for the first quarter Audit Committee meeting and outlines the cybersecurity related strategic initiatives for the fiscal year. It outlines any new investments and projects and their alignment with the cybersecurity framework, as well as the expected timelines for the implementation of these activities.

companyName: Zumiez Inc

ticker: ZUMZ


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats and incidents, which is based on industry-recognized frameworks and takes a multifaceted approach to protecting our network, systems, and data, including personal information. To prevent cybersecurity incidents, we deploy a wide range of protective security technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. To maintain the effectiveness of this framework, we conduct periodic real-world simulation exercises to test, educate, promote awareness, and identify any refinements needed.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: As the Company implements various procedures and controls to monitor and mitigate such security threats and to increase security for its information, systems, facilities and infrastructure it may result in increased costs. Moreover, there can be no assurance that such procedures and controls will be sufficient to prevent security breaches from occurring. If any of these security breaches were to occur, they could lead to losses of, or damage to, sensitive information or facilities, infrastructure and systems essential to its business and operations, as well as data corruption, communication interruptions or other disruptions to its operations, which, in turn, could have a material adverse effect on its business, financial position, results of operations and cash flows.

companyName: New ERA Energy & Digital, Inc.

ticker: NUAI


text: Maintain policies that require the escalation of any suspected or actual material cybersecurity incidents to our Board of Directors, and Have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.

companyName: 5&2 Studios, Inc.


text: To meet these objectives and oversee the programs, we employ a Chief Information Security Officer ("CISO"). The CISO has over 28 years of cybersecurity experience, 26 years of cybersecurity leadership experience, an MBA in Information Systems, a Master of Science degree in operational analysis, a bachelor's degree in operations research and holds a Cyber Risk Oversight Certificate from the National Association of Corporate Directors and is a Certified Information Systems Security Professional ("CISSP"). The CISO works closely with the head of information technology and the data privacy officer to collectively manage our global cybersecurity, information technology and data privacy programs.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: Governance eHealth's Board of Directors oversees our enterprise risk management process, including cybersecurity, information security, governance, risk management, and compliance programs and strategies. The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team are responsible for the day-to-day management of the risks that we face. The Board administers its cybersecurity risk oversight both directly and through its Audit Committee. The Audit Committee is regularly briefed on eHealth's risk profile issues. These briefings are designed to provide visibility about identifying, assessing, and managing critical risks, audit findings, and management's risk mitigation strategies. Management briefs the Audit Committee periodically about eHealth's protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.

companyName: eHealth, Inc.

ticker: EHTH