text: Cybersecurity threats are identified and mitigated by cybersecurity incident response plans that detail the actions to be taken when a cybersecurity incident occurs. The cybersecurity incident response plans define the organization, roles and responsibilities of the teams tasked with mitigating the impact of the cybersecurity incident. They define repeatable processes for responding to cybersecurity incidents; ensure communication to the CTO and CNO, as appropriate; minimize the impact to customer and business operations; coordinate response activities with external organizations; decrease the likelihood of reoccurrence and ensure regulatory reporting occurs, among other objectives. In addition, the Evergy Companies share network traffic with federal and state agencies to assist with the identification and mitigation of cybersecurity incidents. The Evergy Companies participate in federal and industry information sharing programs, such as the Cybersecurity and Infrastructure Security Agency to assist in the exchange of cybersecurity-related information, analysis and incident mitigation techniques. On at least an annual basis, cross-functional teams and executive management participate in a simulated cybersecurity incident exercise and the Evergy Companies regularly simulate cybersecurity incidents, including phishing attacks, to assess organizational readiness. In addition to a bi-annual internal assessment, the NRC inspects Wolf Creek's processes to validate the effectiveness of the program to protect Wolf Creek from cybersecurity threats.

companyName: Evergy, Inc.

ticker: EVRG


text: Our operations and other aspects of our bus iness rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our operations and the integrity of the Company's information systems.

companyName: Crucial Innovations, Corp.

secItem: Item 1C


text: The assessment of cybersecurity risk is integrated into our overall risk management processes and cybersecurity is identified as a key risk within our Enterprise Risk Management ("ERM") program. The Company strives to implement cybersecurity policies, standards, processes and controls for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity attacks that are aligned with industry best practices and applicable frameworks.

companyName: GameStop Corp.

ticker: GME


text: Our Vice President of Engineering, Product and Platform reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks. The Head of Internal Audit and the Chief Operating Officer provide an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. We have also established a Cyber Incident Disclosure Committee, which is responsible for assessing the impact and materiality on the Company and its stakeholders of any significant cybersecurity incidents and any disclosure obligations arising from any such incidents, as applicable. The findings of any incidents by the Cyber Incident Disclosure Committee are reported to the Audit Committee by the Vice President of Engineering, Product and Platform.

companyName: ThredUp Inc.

ticker: TDUP


text: We continue to evaluate internal systems, processes, and controls to identify potential vulnerabilities and mitigate potential loss from cyber-attacks. We undertake an annual tabletop exercise to assess our response proficiency. We monitor critical and high risks and associated mitigation plans as well as a forward-looking information security roadmap that is aligned with the six functions set forth in NIST's Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond, and Recover. The goal of this framework is to implement effective information security risk techniques and strategies, minimize operational and fraud losses, and enhance our overall performance. In addition, we have invested, and plan to continue investing, in resources to protect our information security ecosystem against cyber-attacks, other security-related incidents, and data breaches and to investigate and remediate any information security vulnerabilities.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Conduct periodic vulnerability assessments and mitigate vulnerabilities for our systems and processes that include sensitive data Conduct regular security awareness trainings and phishing simulation attacks for our employees Maintain cybersecurity risk insurance that provides an aggregate insurance policy coverage amount for protection against covered losses arising from a cybersecurity incident Perform periodic gap analyses to review our cybersecurity controls for gaps and implement the closure actions;

companyName: 5&2 Studios, Inc.


text: Cybersecurity risk management is one component of our information security program that guides continuous improvement to, and evaluates the confidentiality, integrity, and availability of our critical systems, data, and operations.

companyName: MARA Holdings, Inc.

ticker: MARA


text: We have not identified any cybersecurity threats during the last two fiscal years that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Please refer to our Risk Factors in Item 1A for more information on the risks associated with cybersecurity attacks.

companyName: AIR T INC

ticker: AIRT


text: The Company's information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees', customers' and end users' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: Apyx Medical Corp

ticker: APYX


text: Cybersecurity threats and risks, to include any previous cybersecurity incidents, have not materially affected, or are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. We have not, as of the date of this filing, experienced a cybersecurity breach that has materially affected our business or financial condition. However, because our business involves the collection, transmission, and storage of certain customer and employee data, it is possible that we could be susceptible to various cybersecurity threats, including cyberattacks, unauthorized access, and similar events.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Board of Directors Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity risk management matters to the Audit Committee. The Audit Committee reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks on at least an annual basis, and more frequently, as appropriate. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the company's cybersecurity risk management, including our Information Technology, Legal and Financial Reporting management teams, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee and such members of our management team also report to the Board at least annually on data protection and cybersecurity matters. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: SILVERBOW RESOURCES, INC.


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our security information and event management system and team, in coordination with our edge security, monitor the events, analyze threats, and coordinate with our incident response team pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, assessing and prioritizing risks, employing various tools and techniques, including vulnerability scanning and penetration testing. Based on the risk assessment, appropriate security measures are implemented. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.

companyName: Silvaco Group, Inc.

ticker: SVCO


text: Board of Directors' Oversight of Risks from Cybersecurity Threats and Management's Role The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity, information security and information technology risks, as well as management's actions to identify, assess, mitigate and remediate those risks. The Audit Committee assists our Board of Directors in exercising oversight of the Company's cybersecurity, information security and information technology risks. At least annually, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Administrative Officer ("CAO") is responsible for upward reporting of emerging cybersecurity incidents to our Audit Committee, who in turn reports to our Board of Directors.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: The CISO and information technology security team conduct regular risk assessments to assess the overall technology infrastructure and related business processes, identify and address potential security gaps and vulnerabilities, and identify areas requiring additional focus. These risk assessments extend to our supply chain, where cybersecurity health assessments are employed for our critical suppliers. The results are used to calculate a Cybersecurity Risk Score, a key component of our Supply Chain Scorecard used to proactively identify and manage potential risks. Additionally, we require certain third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, as appropriate. Risk assessments are also performed on new products and software as part of our new product development process.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: The Company's Managing Director of Information Security has more than 25 years of cybersecurity experience throughout various industries, including the utility sector, and reports directly to the Company's Senior Vice President and CIO. The Senior Vice President and CIO, who has over 30 years of work experience in the information technology field, is responsible for the Company's information technology program and oversees the management and development of all business technology and security for the Company and its subsidiaries. The Senior Vice President and CIO is also responsible for compliance with applicable federal standards and critical infrastructure protection and reports to the Company's President and CEO.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Information Security Officer is responsible for information security and cybersecurity risk management. He has over 20 years of financial services related experience in cybersecurity program strategy, security architecture and security team leadership. Our Chief Technology Officer, among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the Chief Information Security Officer. He has over 25 years of experience building and leading technical organizations of various sizes, including in the banking industry.

companyName: SANDY SPRING BANCORP INC


text: As of the date of this annual report, we have not experienced any cybersecurity incident that has materially affected our business. See "RISK FACTORS" for a discussion of cybersecurity risks that may affect us.

companyName: OGLETHORPE POWER CORP


text: The Company, its vendors and service providers and their respective vendors and service providers face various security threats on a regular basis, including ongoing cybersecurity threats to and attacks on its and their information technology infrastructure that are intended to gain access to the Company's proprietary information, destroy or modify data or disable, degrade or sabotage systems. Cyber incident techniques change frequently, may not immediately be recognized and can originate from a wide variety of sources, including as part of the supply-chain of software and computer code that supports the software and systems on which the Company and such parties rely. There has been an increase in the frequency, sophistication and ingenuity of the data security threats the Company and these vendors and service providers face, with attacks ranging from those common to businesses generally to those that are more advanced and persistent.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: The CDIO and CISO provide reports to the Audit Committee at least semi-annually on the Company's cybersecurity program, including the external threat environment, the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and the results of evaluation of the Company's cybersecurity program by external experts. The Audit Committee, as well as the Board of Directors, is also promptly informed about any information security incidents that may pose significant risk to the Company.

companyName: Garrett Motion Inc.

ticker: GTX


text: Ameren employs a third-party cybersecurity risk management program, which extends the governance elements of Ameren's cybersecurity program, in addition to other diligence measures, to our critical third-party providers and suppliers. The supply chain and third-party risks introduced to Ameren are evaluated prior to the commencement of any new engagement or relationship, monitored closely throughout the lifecycle of the supplier and managed through privacy and cybersecurity provisions within the respective commercial contracts. Procedures have been established to address supplier incidents as well as supplier off-boarding at the expiration of the relationship.

companyName: AMEREN CORP

ticker: AEE


text: Cybersecurity is a critical component of the Company's Enterprise Risk Management program. The Company has established an information security framework to help safeguard the confidentiality and integrity of, and access to its information assets and to ensure regulatory, contractual, and operational compliance.

companyName: International Seaways, Inc.

ticker: INSW


text: These reports are then shared with the Company's cybersecurity oversight committee to inform and augment the Company's risk management processes. Additionally, each business unit is required to maintain an incident reporting process to report significant cybersecurity events to the Company. The Company and its business units discuss and partner with third parties to assess, mitigate, audit, educate, implement, operate, protect, and remediate various cybersecurity related elements.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Our board of directors provides direct oversight over cybersecurity risk and receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have a process to review risks to our company in connection with certain third-party providers and vendors, which we assess through vendor questionnaires, as appropriate.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the Information Technology Steering Committee and our board of directors.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Our Audit and Risk Committee is responsible for the oversight of data security, privacy and cybersecurity related risks. Our CIO has a Bachelor of Science in Computer Engineering and over 26 years of experience in senior leadership privacy, information technology and cybersecurity oversight roles, including within the grocery retail industry. Our CIO reports to our Chief Operations Officer who also has decades of information technology experience, including with retailers such as Walmart, Inc., Family Dollar Stores, Inc. and Gap, Inc. Under the direction of our information technology department, we have implemented policies and controls in line with the requirements of the International Organization for Standardization and have assessed our cybersecurity maturity levels against the National Institute of Standards and Technology framework to set appropriate standards and guidelines. We monitor and remediate threats through our managed detection and response, and our vulnerability management programs. We provide regular employee communications and mandatory training, periodically review our incident response and breach notification plan, and leverage third-party expertise for testing, assessments and improvements. We have an onboarding and periodic security review process of all third party vendors who have or will have access to our confidential information. We also have established business continuity disaster recovery plans that are designed to limit downtime and data loss in the event of a security breach.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks, threats or incidents. The potential consequences of a future material cybersecurity incident may include reputational damage, litigation with third parties, government enforcement actions, penalties, disruption to our systems or operations of our facilities, unauthorized release of confidential or otherwise protected information, corruption of data, diminution in the value of our investment in research, development and engineering, increased cybersecurity protection costs and unplanned remediation costs, which in turn could adversely affect our business strategy, results of operations and financial condition. See Item 1A under the caption "A breach of our security systems or a cyberattack that disrupts our operations or results in the breach of confidential information about us, our technology, or our customers could harm our business and expose us to costly regulatory enforcement and other liability." for additional information on cybersecurity risks applicable to the Company.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: Our audit committee is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. Our Head of IT, or a delegate, informs the COO of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The COO is also primarily responsible for advising our CEO and Chief Financial Officer regarding cybersecurity disclosures in public filings. The COO also notifies the audit committee chair of any material cybersecurity incidents.

companyName: RYVYL Inc.

ticker: RVYL


text: Cyber Security Risk Management and Strategy Our cybersecurity program focuses on the following areas: • Vigilance: Our cybersecurity threat operations function 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: We deploy systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: We provide periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on an regular basis. • Communication, Coordination and Disclosure: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, financial, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Krystal Biotech, Inc.

ticker: KRYS


text: Our management IT Steering Committee has established an Information Security Program, which includes appropriate security risk assessments, security monitoring, incident response, policies, operating standards, compliance, and employee training. The underlying controls of this security program are based on the guidelines and frameworks provided by the Office of the Comptroller of the Currency (the "OCC"), the Federal Financial Institutions Examination Council (the "FFIEC"), and the National Institute of Standards and Technology ("NIST"), as well as industry best practices and standards. The Information Security Program focuses on the following key areas: • IT Governance, Risk & Compliance – As discussed in further detail under the "Governance" section below, we have established programs, policies, and procedures for security oversight, including risk assessments for business processes and applications. These cyber and information security programs, policies and procedures are reviewed annually by a third-party. • Identity & Access Management – We have established controls to mitigate risks related to unauthorized access, identity theft, and data breaches. Process and technology controls include identity, authentication, authorization, account management, and access, along with monitoring and logging for tracking events. • Security Architecture & Engineering – Our security is tailored around industry best practices and guidance. This establishes the foundation for secure resilient systems that can withstand and mitigate cyber risks effectively. • Security Operations – We use various tools to assess, monitor, and analyze the vulnerability of our operating systems, and have established an incident response plan for addressing identified threats and incidents. • Resiliency, Safety & Security – We have established policies and procedures to withstand and recover from disruption, protect our people and environment, as well as protect our systems and information from threats and unauthorized access. • Vendor Risk Management – We use a risk-based approach to assess and monitor cybersecurity risks presented by our vendors, third-party service providers, and other third-party users that we partner with. • Security Awareness Education – We use current cybersecurity and information security threats to develop our education program. This training focuses on information security, privacy, cybersecurity best practices (e.g., social engineering, incident reporting, maintaining strong passwords), identity and access management, and physical security. All employees receive education and awareness training throughout the year. In addition, some of this education is extended to our customer base, with current cyber activity and hygiene highlighted.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business—Failure of a key information technology system, process or site, cyberattacks, or other deficiencies in our cybersecurity could have an adverse effect on our business and operations."

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Additionally, we maintain cyber coverage through our insurance carrier to mitigate risks associated with cybersecurity incidents, subject to customary terms and exclusions.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: Management is responsible for assessing and managing our material risks from cybersecurity threats on a day-to-day basis and keep the Board of Directors informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents.

companyName: EvoAir Holdings Inc.

ticker: EVOH


text: We design and assess our security program using an internally-developed risk management framework based on recognized industry security standards. The framework is the basis for our cybersecurity policy, cybersecurity standards, and our processes for managing exceptions to those policies. Additionally, a third-party assessment of our framework maturity is performed regularly by a professional advisory firm with cybersecurity expertise. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use recognized standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Hyatt Hotels Corp

ticker: H


text: Jacqueline Friesner. Ms. Friesner was appointed Controller and Chief Accounting Officer of RBI in December 2014. Ms. Friesner served as Vice President, Controller and Chief Accounting Officer of Burger King Worldwide and its predecessor from March 2011 until December 2014. Prior thereto, Ms. Friesner served in positions of increasing responsibility with Burger King Corporation. Before joining Burger King Corporation in October 2002, she was an audit manager at Pricewaterhouse Coopers in Miami, Florida.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our internal security team is augmented with a 24/7 Security Operations Center with analysts available to respond to alerts and protect data based on continuous monitoring for indicators of compromise including elevation of privilege, suspicious access, and data exfiltration.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under

companyName: Gamida Cell Ltd.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our head of Information Technology evaluates material risks from cybersecurity threats and reports periodically to the Audit Committee of our Board, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers such as Crowdstrike, cybersecurity service providers such as Mimecast, penetration testing firms, auditors, and professional services firms, including legal counsel. These relationships enable us to leverage specialized knowledge and insights, enabling our cybersecurity strategies and processes to remain consistent with industry best practices.

companyName: GERON CORP

ticker: GERN


text: We devote resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer ("CIO") who in turn reports to our Chief Executive Officer, to manage cybersecurity risk. We received ISO 27001 certification for our cybersecurity function and functionality for streaming media through Dolby Millicast in 2024 and are subject to annual ISO 27001 standard compliance monitoring audits in connection with that certification. We also take part in periodic security audits by our clients and partners.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: Our Chief Financial Officer, or CFO, together with our Incident Disclosure Committee, or IDC, Security Incident Response Team, or SIRT, which is led by our head of information technology, or IT, and composed of two employees who have direct work experience in network security, and third-party service providers, help identify, assess and manage the Company's cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, automated and manual tools, third-party threat assessments and intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, evaluating the Company's and the industry's risk profile, evaluating reported threats, coordinating with law enforcement relating to threats, conducting threat assessments for internal and external threats, conducting red/blue team testing and tabletop incident response exercises jointly with external third parties.

companyName: NGM BIOPHARMACEUTICALS INC


text: The Company's process for assessing, identifying, evaluating and managing cybersecurity risks as part of its broader ERM program includes: • Risk Identification and Prioritization: The Company employs various methods to assess and identify cybersecurity risks, which methods may, from time to time, include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests, and engaging third parties to conduct analyses of our information security program. This process includes evaluating the likelihood and impact of potential cybersecurity incidents. The company engages third parties in connection with risk management processes. • Continuous Risk Monitoring: The Company actively monitors cybersecurity risks including third-party risk from vendors and suppliers. Significant fluctuations in the prevalence or impact of such risks are reported to the Risk Committee on a quarterly basis. • Mitigation Strategies: While continuous backups to a warm failover site are performed, the Company's Incident Management and Information Security Plan is designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution. In general, our incident response process follows the framework established by the National Institute of Standards and Technology ("NIST") and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. We also conduct mandatory annual cybersecurity training for all employees.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of its business. We do not believe that any incidents that have occurred prior to the date of this report have had or will have a material adverse effect on our business strategy, results of operations, reputation or financial position. Future cybersecurity incidents could, however, materially affect our strategy, results of operations, reputation or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.

companyName: CONDUENT Inc

ticker: CNDT


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, and Chief Financial Officer. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems. The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: The head of information technology and the CSSC have primary responsibility for assessing and managing our cybersecurity program. The head of information technology, who reports to the Chief Operating Officer, has more than 25 years of experience in building and leading information technology and security teams.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further actions, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate to take.

companyName: BIOETHICS LTD

ticker: BOTH


text: Our organization employs a comprehensive process to oversee and identify cyber threats associated with third-party service providers. For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures. We also maintain an incident response plan that coordinates internal teams and third-party providers to triage, investigate, escalate, contain, remediate and recover from incidents, and to meet applicable legal and contractual obligations.

companyName: Inotiv, Inc.

ticker: NOTV


text: Board and Management Oversight of Risks Associated with Cybersecurity Threats The Technology Committee provides the board of director-level oversight of our information technology and information security practices and cyber-risk profile and serves as a liaison between our board of directors and the CISO and the Chief Privacy Officer with respect to such matters. The Technology Committee reviews our key initiatives and practices relating to information technology, information security, cybersecurity, disaster recovery, business continuity, data privacy and data governance, and monitors compliance with regulatory requirements and industry standards. The Technology Committee helps to ensure that our strategic business goals are aligned with our technology strategy and infrastructure and that management has adequate support for the Company's internal technology and information security needs.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Cybersecurity is a critical component of the Company's overall enterprise risk management program. Howmet has implemented a framework of principles, policies and technology designed to protect our systems and data from cybersecurity threats. The Company's Board of Directors (the "Board"), through its Cybersecurity Committee, is actively engaged in overseeing and reviewing the Company's cybersecurity programs and risk management. Although past cybersecurity incidents did not have a material impact on the Company, including our strategy, financial condition or results of operations, the scope and impact of any future cybersecurity threat or incident cannot be predicted. See Part I, Item 1A. (Risk Factors) for more information on how material cybersecurity incidents may impact the Company.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: Cybersecurity is a critical element of our information security program. Security controls are implemented in a manner that protects the confidentiality, integrity and availability of our information assets without hindering business operations. Management is responsible for the day-to-day administration of our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (the "NIST") and management's knowledge of best practices in the cybersecurity industry. In general, we seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity and availability of our information systems or the information that we collect and store, by proactively monitoring for cybersecurity threats and assessing, identifying and managing cybersecurity issues as they occur.

companyName: Scilex Holding Co

ticker: SCLX


text: Reviewing the security measures in the Company's Cybersecurity Policy annually or when there is a change in applicable laws or regulations or in business activities of Equus; and Conducting training as necessary for all Equus personnel; and Reporting cybersecurity matters to our Board of Directors who provide oversight of our Information Security Team.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: Response plans for cyber incidents, Regular system testing and incident simulations, and Routine reviews of policies and procedures to identify risks and enhance practices.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Board of Director Oversight The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats. The Board receives an annual cybersecurity update while the Audit Committee receives reports from the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") regularly. The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks. The Audit Committee then briefs the Board on these matters. Ad hoc updates occur as needed.

companyName: MOSAIC CO

ticker: MOS


text: Security Control: The IT department has implemented and continually monitors security controls, including firewalls, end-point detection and response, intrusion detection/prevention systems, file integrity monitoring and data encryption, to protect against cybersecurity threats. These tools and controls are regularly updated to address vulnerabilities and ensure the security of information technology infrastructure.

companyName: DallasNews Corp


text: In order to mitigate risks of cybersecurity incidents, critical business and operational data are backed up at night and stored offsite for security purposes and to restore data in the event of a breach. Additionally, we provide cybersecurity awareness training of our employees, incident response personnel, and senior management.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our Chief Financial Officer is primarily responsible for the assessment and management of our material risks from cybersecurity threats, and the oversight of our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Financial Officer and our IT consultant collectively have significant prior work experience in various roles involving managing information security and implementing effective information and cybersecurity programs. They are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. Our information technology general controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents that could have an impact on our business operations, including prompt escalation and communication of major security incidents to senior leadership and our board of directors.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: The Company 's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.

companyName: INNOVATIVE SOLUTIONS & SUPPORT INC

ticker: ISSC


text: We design and assess our program based on industry standard cybersecurity frameworks published by the International Organization for Standardization and the National Institute of Standards and Technology. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we may source controls applicable to our industry from these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Peakstone Realty Trust

ticker: PKST


text: Oversight of our cybersecurity program is performed by our executive management and board of directors. Specifically, our executive management includes our Vice President of Network IT and Applications, who serves as our Data Protection Officer and has over 25 years of experience in IT systems, cybersecurity and risk management, as well as our Chief Executive Officer and Chief Financial Officer. Our Vice President of Network IT and Applications is responsible for reviewing cybersecurity risks, controls, policies and processes. This includes training, policy development and updates, while also keeping senior leadership informed on cybersecurity matters. We also have a department dedicated to monitoring our systems to prevent cybersecurity attacks. The Board of Directors receives information from management regarding any significant changes to the Company's cybersecurity policies and procedures, as well as recently identified risks and other recent information relative to cybersecurity, and on at least an annual basis our Data Protection Officer presents the Company's cybersecurity program to the Board of Directors.

companyName: Globalstar, Inc.

ticker: GSAT


text: Review and reassess the adequacy of the Cybersecurity Committee's written charter annually and recommend to the board any changes the Cybersecurity Committee determines are appropriate; and Perform any other activities required by applicable law, rules, or regulations (including the Securities Exchange Act of 1934 and the NYSE American Stock Exchange regarding reporting and disclosure obligations related to cybersecurity risks, costs, and incidents), and take such other actions and perform and carry out any other responsibilities and duties delegated to it by the board or as the Cybersecurity Committee deems necessary or appropriate consistent with its purpose.

companyName: Cohen & Co Inc.

ticker: COHN


text: Risks from Cybersecurity Threats Our business relies on secure and continuous processing of information and the availability of our IT networks and IT resources, as well as critical IT vendors that support our technology and data processing operations. Security breaches, computer malware and computer hacking attacks have become more prevalent across industries and may occur on our systems or those of our third-party service providers. Attacks upon IT systems are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. We may face increased risks from cybersecurity threats due to our reliance on internet technology and the increased frequency of employees working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.

companyName: Outset Medical, Inc.

ticker: OM


text: As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients, including products and services that utilize the cloud and artificial intelligence (AI), among other emerging technologies. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see "Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption" in Item 1A. Risk Factors of this report.

companyName: KEYCORP /NEW/

ticker: KEY


text: Role of the Board of Directors The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives regular reports from our President & COO on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. Our President & COO is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Audit Committee has the opportunity to report to the Board on cybersecurity risks and other matters reviewed by the Committee. Furthermore, all Board members are provided with updates on key points discussed during each Audit Committee meeting and may access the materials for each Audit Committee meeting.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer, who has more than 20 years of cybersecurity experience working with large financial institutions and actively maintains multiple information security certifications. Additionally, our Chief Information Security Officer oversees our cybersecurity incident disclosure and communications. Our Chief Risk Officer separately chairs our Risk Management Steering Committee. Our Chief Risk Officer has served in her position since 2014 and is an accomplished banking professional with more than 40 years of experience in compliance and risk management.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: We conduct periodic risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems and safeguards in place to manage such risks.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: While everyone at the Company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by the Board, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: Our Chief Operating Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: Precipio, Inc.

ticker: PRPO


text: As part of our process to continuously improve, we utilize internal functions such as our internal audit and risk functions to evaluate security controls and risk management practices. We also engage third-party subject matter experts to independently assess our programs, processes and technical controls, as needed. For our regulated cyber assets associated with critical infrastructure, such as those within the scope of NERC and the NRC, regulatory auditors and inspectors monitor our adherence to mandatory cybersecurity requirements on a regular frequency using a variety of compliance monitoring and enforcement mechanisms.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Cyber Risk Management and Strategy Safeguarding the confidentiality, integrity and availability of customer and sensitive financial data, records and transactions is essential to Timberland and Timberland Bank. Our risk management program is designed to identify, assess and mitigate risks across various aspects of the Bank, including financial, operational, regulatory, reputational and legal.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: The Audit Committee of the Board of Directors is the primary governing body that is tasked with the evaluation and confirmation of the Company's cybersecurity threat mitigation processes. More specifically, they review the Company's annual IT audits and discuss any potential threats in quarterly meetings.

companyName: Epsilon Energy Ltd.

ticker: EPSN


text: We have elected to outsource our information technology function to a third-party managed service provider, or the MSP, that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our hosted services, all of the computer and computer-related hardware and software we use, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Our business, brand, and reputation may be harmed as a result of security breaches, cyber-attacks, employee or other internal misconduct, computer viruses, or the mishandling of personal data" and should be read in conjunction with the information above."

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our Board provides oversight for cybersecurity risks primarily through its ERM committee. The Company's Chief Information Officer (CIO) provides information quarterly to the ERM committee on cybersecurity risks. The CIO has 30 years of experience in technology both on the company and consulting sides and a B.A. in Economics.

companyName: ICC Holdings, Inc.


text: The Company is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. Refer to the "Risk Factors" section, which appears in Item 1A of this Report for more information regarding these risks. In response to these risks, we have implemented cybersecurity processes, technologies, and controls detailed below to aid in our efforts to assess, identify, and manage cybersecurity risks. Our Global Cyber Security team works to identify, assess and manage cybersecurity threat risks, their severity, and potential mitigations.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: Cybersecurity threats and computer crime pose a risk to the security of the Company's information technology ("IT") systems and those of third-party service providers with whom it does business, as well as the confidentiality, integrity and availability of the data stored on those systems. As part of our overall risk management framework, the Company has developed and maintains an information security program consisting of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risks.

companyName: DallasNews Corp


text: As part of the above processes, we regularly engage with third parties to review our cybersecurity program and help identify areas for continued focus, improvement and compliance.

companyName: Molecular Templates, Inc.


text: We engage certain external parties to enhance our cybersecurity processes and strategies. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture of such providers according to the perceived level of risk and in accordance with industry standard best practices.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Company's Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: TerrAscend Corp.

ticker: TSNDF


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our Chief Information Officer ("CIO"), who reports to the Chief Executive Officer, and our CISO, who reports to the CIO, at each of our regular meetings, which occur at least four times per year. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CIO and CISO.

companyName: Baker Hughes Co

ticker: BKR


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board and its Corporate Governance, Nominating and Ethics Committee are responsible for oversight of our cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols, while our Chief Information Officer (CIO) is responsible for our cybersecurity strategy and execution.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with Company management to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks. The Manager's Chief Technology Officer and Chief Information Security Officer have extensive knowledge and skills, and collectively bring decades of experience in the cybersecurity industry.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10K for more information.

companyName: Vigil Neuroscience, Inc.


text: The Company does not have its own cybersecurity policy, but it contracts with CROs that handle all of its data and software. Our CRO's data systems are 21 CFR 11 (Part 11) compliant, which means that they have implemented controls to ensure the reliability and integrity of electronic records and signatures. Our CRO also runs industry standard antivirus and antimalware software on their networks and have written procedures for cybersecurity management, incident response, backup and recovery, and employee training. We have reviewed the cybersecurity policies and procedures of our CRO and require them to report any cybersecurity breaches or incidents that may affect our data or systems.

companyName: TELIX QSAM INC.


text: Although we have never experienced a material information security breach nor have we incurred any expenses related to such a breach, we take a proactive approach to managing information security risk. Our process for managing existing and new service providers evaluates the degree to which such service providers will interface with our systems. This process dictates minimum insurance requirements and increased security documentation and protocols as interaction with our systems increases. We also have an information security training and compliance program which includes cybersecurity updates, notices, reminders, and simulated cyber-attacks emailed to all employees bi-weekly and that all employees are required to participate in at least annually. Further, we have a documented business continuity plan that is updated and tested on an annual basis and we carry an information security risk insurance policy.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Management is responsible for assessing and managing risk at the Company, including communicating the most material risks to the Board of Directors and its committees. The Board of Directors has primary responsibility for risk oversight, with a focus on the most significant risks facing the Company. With respect to cybersecurity risks, the Risk Committee of the Board of Directors ("Risk Committee") provides oversight for matters specifically relating to cybersecurity and other risks related to information technology systems and procedures, including but not limited to data security and privacy.

companyName: OPENLANE, Inc.

ticker: OPLN


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: Axogen, Inc.

ticker: AXGN


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the review of vendors' SOC 2 Type 2 reports if available, and a vendor security questionnaire. We are in the process of expanding the use of the security questionnaire to additional vendors.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "General Risks Governance and Role of Management and the Board Our Chief Operating Officer leads our cybersecurity program and reports, with respect to cybersecurity incidents, to the Company's Chief Financial Officer. Our Chief Financial Officer reports directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversight, including cybersecurity risks. The Chief Financial Officer or Chief Operating Officer briefs the Board and Audit Committee on the effectiveness of our cybersecurity program quarterly. The Chief Operating Officer oversees the operation of our cybersecurity program and has over 20 years of executive experience overseeing risk management and internal controls. The Chief Financial Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Financial Officer's oversight of the Company's information technology function and supervision of the Company's IT administrator. We have not experienced any cybersecurity threats or incidents that have had a material impact on our business to date.

companyName: FEMASYS INC

ticker: FEMY


text: As of December 31, 2024, there were no cyber incidents that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Our Chief Information Officer ("CIO") is responsible for implementing our cybersecurity strategy, developing policies and procedures, and ensuring that appropriate resources are allocated to cybersecurity initiatives. The CIO and senior network and security resources at Hawkins have decades of experience in cybersecurity practices and compliance. The CIO is continually informed about the latest threats and developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO implements and oversees processes based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and is responsible for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. Management reports at least twice yearly to the audit committee on the status of our cybersecurity efforts, including assessments of significant risks identified and actions designed to mitigate such risks.

companyName: HAWKINS INC

ticker: HWKN


text: Engagement of Third Parties As part of our Cyber Risk Program, we engage outside independent auditors, consultants, and professional advisors. We use independent auditors to certify compliance with internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework. We also conduct reviews for compliance with data protection regulation such as Europe's GDPR and regulation of various U.S. states as the California Consumer Privacy Act (CCPA). We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.

companyName: E2open Parent Holdings, Inc.


text: As of January 31, 2025, we had not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: The Chief Information Officer ("CIO") works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. The CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the ITSC and CRMC.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: The Company's risk management team collaborates closely with its internal IT team to evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures to ensure the prompt escalation of cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive timely and appropriate information.

companyName: Energy Services of America CORP

ticker: ESOA


text: The Company's information technology team is led by the Vice President of Information Technology. He has overall responsibility for developing, implementing, and maintaining the Company's technology strategy, systems, and operations. The current Vice President of Information Technology has been employed in the Company's information technology department for 10 years, previously as a Director of IT Development and a Business Analyst. He has a Master of Science in Information Systems Degree from DePaul University of Chicago. The leadership team also includes our Director of IT Infrastructure and Security, who is responsible for managing the Company's cybersecurity strategy, including management of firewalls, identity and access management, endpoint protection, and backups. The current Director of IT Infrastructure and Security has been employed in the Company's information technology department for 12 years, previously as a Technician and Network Administrator. He has a Master of Science in Information Management Degree from the University of Illinois.

companyName: SIGMATRON INTERNATIONAL INC


text: For the year ended June 30, 2024, the Company had no material cybersecurity incidents or cybersecurity threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Cybersecurity is critical to Patrick's ability to drive its vision and operational initiatives. Patrick faces a range of cybersecurity threats including attacks common to most industries, such as ransomware and denial-of-service, and attacks from more advanced and persistent, highly organized adversaries. Our customers, suppliers, consultants and subcontractors face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: The Company contracts with reputable third parties to conduct annual external assessments of its cybersecurity program and its components. Government agencies and their contracted agents also conduct periodic reviews in certain jurisdictions where the Company operates. Insurance agents, customers and other market participants routinely assess the Company's security posture relative to their own standards.

companyName: MOODYS CORP /DE/

ticker: MCO


text: In addition, the Corporation has established a Cybersecurity Materiality Assessment Team ("CMAT") for the purpose of evaluating specific cyber incidents or a series of related incidents. It includes certain of the Corporation's senior managers with cross-functional representation from operations, finance/accounting, information technology, risk management and human resources. CMAT is responsible for assessing the potential materiality of a cyber-incident based on the actual and anticipated potential impact to the Corporation's results of operations, financial position and cash flows; operations including disruptions and downtime; strategic plans; confidential information; employee and community health and safety; customers and vendors; investors; regulatory compliance; and reputation.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: Our Vice President of Information Technology and Director of Technical Infrastructure have a combined 65 years of experience designing, implementing, and supporting information technology systems with a security-first mindset. In particular, prior to joining Culp, our Director of Technical Infrastructure gained experience leading cybersecurity teams at a managed security service provider, where he provided cybersecurity support to outside organizations.

companyName: CULP INC

ticker: CULP


text: Senior management, in coordination with the Company's third-party service providers specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through ongoing communications with third party service providers, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: Management's Role in Assessing and Managing Cybersecurity Risk BBSI's Chief Information Security Officer ("CISO") leads our enterprise information security program and is primarily responsible for the assessment and management of the Company's cybersecurity risks. The CISO has extensive experience in information technology and cybersecurity, including at another publicly traded company. The CISO oversees our cybersecurity risk management framework and manages a team of IT security professionals to identify and prioritize cybersecurity risks. The CISO also utilizes the expertise of third-party security partners to provide threat detection support, vulnerability management, incident response, penetration testing, and consulting services.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: Since at least January 1, 2021, we are not aware of any cybersecurity incidents that have materially affected the Company. Based on our current understanding of the cyber risk environment and our preparedness level, we do not believe it to be reasonably likely in the near term that a cybersecurity threat will materially impact our business strategy, results of operations or financial condition.

companyName: REGENCY CENTERS LP


text: As part of our Enterprise Risk Management program, ADT identifies, assesses, and develops risk mitigation plans for the company, including those relating to cybersecurity risks. The Company's Chief Information Security Officer ("CISO"), who is designated as a Certified Information Systems Security Professional ("CISSP"), is responsible for developing and implementing plans and strategies to mitigate these risks. The CISO also leads the Company's cybersecurity risk assessment, which includes security posture scoring, vulnerability assessments, process maturity, and tooling coverage. As part of this process, ADT uses the following tools and procedures: • utilizing "SecurityScorecard" (a third-party information security company that rates cybersecurity postures of corporate entities for the purposes of third-party management and information technology ("IT") risk management), which provides an independent external enterprise view of ADT's security posture with a focus on publicly exposed systems; • assessing, and continuously developing and executing on our preventative and detective controls aligned with the National Institute of Standards and Technology ("NIST") cybersecurity framework, including an annual audit of these internal controls; • conducting third-party penetration testing; • performing attack and breach simulations; and • working with our cybersecurity vendors to ensure tooling and processes are fully adopted to provide the highest levels of protection.

companyName: ADT Inc.

ticker: ADT


text: As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and service providers. Our process includes a security assessment informed by vendor questionnaires and contractual security requirements related to data privacy for certain vendors.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: Our Information Security Program is built on a three lines of defense model integrated into our overall Enterprise Risk and Compliance Management Program ("ERCM Program"). It shares common methodologies, reporting channels, and governance processes that apply across the ERCM Program to other legal, compliance, strategic, operational, and financial risk areas. The Program is governed by the Technology, Information Security, and Privacy Risk Management Committee and overseen by our Board of Directors ("Board") and its Audit, Risk and Compliance Committee ("ARC Committee").

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures;

companyName: VICTORY CLEAN ENERGY, INC.

ticker: VYEY


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools, processes, and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are integrated into our decision-making processes to monitor and manage risk. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risk. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Audit Committee receives reports, briefings and presentations from senior management, including our Chief Information Officer, at periodic committee meetings, including, more in-depth presentations on specific areas of risk and regular enterprise risk management updates.

companyName: Lovesac Co

ticker: LOVE


text: As we grow, we plan to refine our cybersecurity strategy in line with global best practices and standards. Importantly, our Board receives regular updates from our Company's Chief Operating & Technology Officer, Christodoulos Tzoutzakis, regarding potential cybersecurity risks and monitors these risks closely. All potential incidents, regardless of their materiality, are required to be reported immediately to the Board. To date, our proactive risk management has allowed us to navigate cybersecurity challenges without material impairment to our operations or financial condition.

companyName: Elvictor Group, Inc.

ticker: ELVG


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Governance

companyName: Lifeward Ltd.

ticker: LFWD


text: We have implemented an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our program utilizes various security tools to safeguard our information systems, aiding in prevention, identification, escalation, investigation, resolution, and recovery from vulnerabilities and security incidents. Examples of such security tools include internal reporting systems, monitoring and detection tools, third -party penetration testing and security assessments and a bug bounty program engaging security researchers. In addition, we have adopted a comprehensive incident response plan and process for detecting, mitigating, and investigating cybersecurity incidents, which employees, under the leadership of the Company's Chief Information Security Officer ("CISO"), regularly test through table-top exercises, testing of our security protocols through additional techniques such as penetration testing, debriefing after security incidents to improve our security and responses, and regular briefing to our directors and officers on our cybersecurity risks and preparedness.

companyName: Skillsoft Corp.

ticker: SKIL


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations and actions litigation fines and penalties disruptions to our business operations reputational harm loss of revenue and profits loss of customers and sales and other adverse consequences."

companyName: Immunocore Holdings plc

ticker: IMCR


text: We have a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure you that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.

companyName: CoreCivic, Inc.

ticker: CXW


text: Our management team is informed and monitors the prevention, detection, mitigation and remediation of cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-recognized certifications, such as CISSP, CISM, and CISA, decades of experience as part of our IT team, and previous cybersecurity leadership positions at various Fortune 500 companies and U.S. Defense contractors.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: We maintain comprehensive business continuity and disaster recovery plans, which update on at least an annual basis and we test through tabletop exercises on an annual basis. We do not maintain any on-premises data or servers.

companyName: LXP Industrial Trust

ticker: LXP


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, please see "Risk Factors – Cybersecurity, Data Protection and Technology Risks" in this annual report on Form 10-K.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: The underlying controls of our information security program are based on regulatory guidance, recognized best practices and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Corporate Information Security Officer and our Chief Information Officer, to whom the Corporate Information Security Officer reports, as well as key members of their teams, regularly collaborate with peer banks, industry groups and others to consider cybersecurity and incident response issues, trends and best practices. The information security program is periodically reviewed by these individuals and their teams with the goal of addressing evolving threats and conditions. Our enterprise information security team consists of information security professionals with varying degrees of education and experience who are generally subject to professional education and certification requirements.

companyName: Ameris Bancorp

ticker: ABCB


text: Cybersecurity risk is integrated into our Global Risk Management process. Cybersecurity risk continues to be identified as one of our key enterprise risks. Risk owners from the Management Committee, senior leadership and the Global Risk Management function have been assigned to develop risk mitigation plans, which are tracked and reported at least quarterly to the Finance and Risk Committee of the Board and annually to the Board. See "Item 1 – Business – Global Risk Management" for more information on the Global Risk Management function.

companyName: ASSURANT, INC.

ticker: AIZ


text: Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. Our VP of Information Security regularly briefs senior leadership on our cybersecurity and information security posture including on the prevention, detection, mitigation, and remediation of cybersecurity incidents, and senior leadership will then brief the Audit Committee. In the event of an incident, we intend to follow our incident response playbook, which outlines our planned response from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Our board of directors oversees our risk management processes and has tasked our Audit Committee with oversight of our cybersecurity and information governance, including periodically reviewing and discussing with management our risk exposures relating to data privacy and cybersecurity, and reviewing the steps we have taken to identify, assess, monitor, mitigate and manage such exposure and cybersecurity risks. At the management level, our Director of Cybersecurity is responsible for overseeing our cybersecurity processes and risk management, working together with our Chief Information Officer to implement our cybersecurity initiatives.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: In the ordinary course of our business, we receive, process, use, store and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary and personal information. We depend largely upon our information technology systems in the conduct of all aspects of our operations. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: Lastly, at least annually, the ISO reports directly to the board of directors the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: The Company maintains a cybersecurity risk management program, led by a Chief Information Security Officer (CISO), who is responsible for the Company's overall cybersecurity strategy, policy, architecture and cyber threat detection and response. The CISO, who reports to the Company's Chief Information Officer (CIO), has a Bachelor's degree in Information Systems and Master of Business Administration degree and is a Certified Information Systems Security Professional with over a decade of professional cybersecurity experience. The Company's program is aligned to industry frameworks and controls from the National Institute of Standards and Technology that allow the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain cybersecurity, including threat intelligence, multi-factor authentication, endpoint detection and response and security automation.

companyName: OSHKOSH CORP

ticker: OSK


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our CISO regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.

companyName: First American Financial Corp

ticker: FAF


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors".

companyName: Spok Holdings, Inc

ticker: SPOK


text: We engage outside consultants on a regular basis to help us design internal controls and processes to address cybersecurity risks. We also leverage these outside consultants and other third parties, when appropriate, to implement appropriate processes, policies, and internal controls designed to help prevent, detect, and/or mitigate these cyberthreats.

companyName: XOMA Royalty Corp

ticker: XOMA


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: The Cybersecurity Program includes controls designed to oversee and identify risks from cybersecurity threats associated with third parties as they are leveraged by Roper's businesses in their respective software code development processes or for other purposes that require third-party access to critical infrastructure. The controls include, as appropriate, regularly assessing management of access controls and the cybersecurity risks posed by third parties.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of insurance provider customers, third-party publishers, other service providers, or consumer referrals and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Item 1A. Risk Factors —Risks Related to Our Business and Industry— Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or our third-party service providers."

companyName: EverQuote, Inc.

ticker: EVER


text: The Audit Committee of our Board of Directors has overall responsibility for the oversight of cybersecurity and other technology risks. The Audit Committee receives updates, on at least a quarterly basis, from our Chief Information Officer (the "CIO") and our Chief Information Security Officer (the "CISO") regarding our enterprise-wide cybersecurity program, which may address a range of topics, including the health, efficacy and maturity of our cybersecurity programs, the results of various assessments periodically performed on our IT environment, emerging threats and trends, including regarding AI, and cybersecurity events.

companyName: Post Holdings, Inc.

ticker: POST


text: We recognize the significance of cyber-attacks and take steps to mitigate the risks associated with them. We invest in building and maintaining a mature cybersecurity program to leverage people, technology and processes to protect our systems and the data in our care. We have also implemented a program to help us better measure and manage cybersecurity risk, including those risks we face when we engage third parties for products and services.

companyName: STATE STREET CORP

ticker: STT


text: In addition, to aid its own security, the Company has adopted a number of cybersecurity policies including an Incident Response Plan, an Acceptable Use Policy for employees and a Service Provider Cybersecurity Management Policy (collectively, the "Cybersecurity Policies"), through which the Company ensures that key vendors with access to sensitive information have contractual terms obligating their compliance with the Company's processes, policies and procedures.

companyName: Chatham Lodging Trust

ticker: CLDT