text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: At least annually, our Vice President, Information Technology discusses with our Board a report on cybersecurity, including an update regarding our cybersecurity risks, mitigation activities and industry developments. In addition, our internal audit function provides regular updates to our Audit Committee on the results of our cybersecurity audits and related mitigation activities. In 2024, as part of our enterprise risk management update to our Board, our Vice President, Information Technology discussed risks and trends associated with information technology, including cyber-attacks, and current and future planned actions to mitigate such risks. In addition, in 2024, our Vice President, Information Technology reviewed with our Board updates related to our operational and resource readiness with respect to cyber incidents, our incident response processes and emerging cybersecurity risks.

companyName: MASCO CORP /DE/

ticker: MAS

secItem: Item 1C


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024.

companyName: Qrons Inc.

ticker: QRON


text: Effects of Cybersecurity Incidents from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Kayne DL 2021, Inc.


text: Our cybersecurity program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, Conference of State Bank Supervisors Ransomware Self-Assessment Tool, the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Federal Reserve and the Arkansas State Bank Department to review our cybersecurity program and discuss the changing threat landscape.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: Our management team will periodically receive information on our cybersecurity program designed to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include periodic briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Governance and Oversight EQT's cybersecurity governance structure is led by the CISO, responsible for EQT's cybersecurity program. The CISO has 15 years of experience working with cybersecurity, business continuity, risk management and technology across several industries and holds a Master and a Bachelor of Computer Science and Engineering. The CISO heads the Security and Platform Engineering Team ('SPET') of dedicated information security professionals and site reliability engineers, concentrating on the security and stability of the technical platform. SPET collaborates closely with other technology teams, such as the EQT information technology operations team. The CISO reports to the Information Security Steering Committee (the 'Steering Committee'), comprised of select Executive Committee members of EQT. The Steering Committee receives quarterly updates from the CISO. Furthermore, the CISO also reports annually to EQT's Audit Committee and twice a year to a member of EQT's board appointed to oversee cybersecurity risk. In addition, the Group Risk Function reports to the Risk Committee at least three times per year.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: We have adopted an Information Security Policy (the "Info-Sec Policy") and an Incident Response Plan (the "Response Plan") that establish administrative, physical, and technical controls and procedures to protect sensitive data throughout the Company. These policies also outline processes to assess, identify, manage, and report cybersecurity risks and incidents. The Info-Sec Policy applies to all persons working for the Company and any third parties working with us in any capacity.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: While robust cybersecurity measures have been implemented, the Bank has not experienced any material impacts from cybersecurity threats to date. This is not a guarantee that potential future events will be immaterial. The evolving nature of cyber threats means that new risks will emerge. These threats could potentially affect the Bank's business strategy, operations, or financial condition. For potential impacts of future threats, refer to "Item 1A - Risk Factors - Technology and Operational Risks."

companyName: FB Financial Corp

ticker: FBK


text: In an effort to deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention trainings, which cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Generation Bio Co.

ticker: GBIO


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: BlueRiver Acquisition Corp.


text: usage of secure software or platforms designed to protect our IT systems against cybersecurity risks, such as two-factor authentication systems, anti-virus and ransomware programs or the usage of secure cloud platforms for computing our IT systems;

companyName: Viewbix Inc.

ticker: VBIX


text: The Company is subject to various privacy laws in the jurisdictions where it operates including CCPA and GDPR, as well as U.S. Federal regulation by the FTC, for certain privacy-related aspects of its business, and the Sarbanes-Oxley Act of 2002. The

companyName: MOODYS CORP /DE/

ticker: MCO


text: To date, we have not experienced any material cybersecurity incidents affecting our operations or financial condition. We continue to monitor risks and adjust our security measures as necessary.

companyName: BIOREGENX, INC.

ticker: BRGX


text: Over the past fiscal year, the Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations or financial condition. See "Risk Factors – We are subject to laws and regulations relating to the handling of personal information and we rely on information technology to sustain our operations. Any failure by us to comply with applicable requirements or material failure, inadequacy, interruption or breach of the Company's privacy or information systems, or those of our vendors or other third parties, could materially adversely affect the Company's business, results of operations and financial condition".

companyName: ESSEX PORTFOLIO LP


text: The Global Director of Information Technology (GDIT) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The GDIT has over 25 years of experience as a security professional, and has completed the Prince 2 risk management certification at the practitioner level. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Company's IT infrastructure are appropriately secured and managed. It also encompasses ensuring that all employees are educated in IT best practices around incident management and security, ensuring the security of the internal and external IT systems, as well communicating to senior management and planning for future IT strategy and security.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: information security training program that includes annual information security training; and cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident to management.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: We provide mandatory cybersecurity training to employees and contractors on an annual basis. We test our employees' response to simulated phishing scenarios on a regular basis. We also conduct enhanced training for certain groups of employees that may pose higher risk.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: The Corporation has an information security program that is primarily managed by the Information Security Department, which is led by the Chief Risk Management Officer and the Director of Information Security and supported by the Information Technology Operations Department, which is led by the Chief Information Officer. The Information Security Department is led by the Director of Information Security, and is responsible for day-to-day management of the information security program including system monitoring, vulnerability scans, employee security training including phishing exercises, security controls, and building strong relationships with security vendors. The Chief Risk Management Officer, the Chief Information Officer, the Director of Information Security and the other members of the Information Security Department are qualified by years of experience, post-secondary education, industry certifications and regular continuing education. A network penetration test and vulnerability assessment are performed at a minimum annually by a third-party vendor. The Information Security Committee is the management committee responsible for the oversight of the Information Security Program and is also responsible for policy development and information security risk assessment. This committee meets at least quarterly to discuss and review the information security program. The Information Security Program is updated at least annually and the Board of Directors, with input from the Risk Management Committee, approves all material changes.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Capability Officer (CCO), Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.

companyName: ROSS STORES, INC.

ticker: ROST


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, threats, risks and mitigation. Our Audit Committee also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. We approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required. Our layered approach to cyber security risk mitigation includes the following: • Secure architectural solution design of processes and system configuration. • Assessment and remediation of cybersecurity events with potential impact on business processes. • Proactive monitoring and mitigation of active exploits through managed services. • Evolution of the information security governance program.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.

companyName: Jingbo Technology, Inc.

ticker: SVMB


text: We maintain policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these policies and processes into our overall risk management strategy. Our cybersecurity program is informed by standards established by the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS).

companyName: Absci Corp

ticker: ABSI


text: Development and Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity threat, and such Plans are tested and evaluated annually. Our annual testing of these plans include a wide range of activities, such as audits, tabletop exercises, threat modeling, vulnerability assessments, penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

companyName: POTBELLY CORP

ticker: PBPB


text: In the normal course of business, we collect and store personal information and other sensitive information on our information systems. To protect our information, our existing cybersecurity policies require continuous monitoring and detection programs and network security precautions.

companyName: Inari Medical, Inc.


text: Our Audit Committee is responsible for reviewing cybersecurity risks and our cybersecurity program. It oversees and reviews our cybersecurity and other information technology risks, controls, policies, and procedures. Our information security team annually performs a cybersecurity enterprise risk assessment and presents the results to management and the Audit Committee. The Audit Committee periodically reports on its review of cybersecurity risks and our cybersecurity program to our Board of Directors. In 2023, our CISO or his team met with the Audit Committee four times to discuss cybersecurity risks and threats.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents.

companyName: Enstar Group LTD


text: from Cybersecurity Threats To date, no known cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, due to our limited cybersecurity measures, we acknowledge that our company could be at higher risk of material impact from cybersecurity threats. We are actively working to mitigate these risks.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors—Risks Related to our Business and Industry—We rely significantly on the use of information technology, as well as those of our third-party service providers. Any significant failure, inadequacy, interruption or data security incident of our information technology systems, or those of our third-party service providers, could disrupt our business operations, which could have a material adverse effect on our business, prospects, results of operations, financial condition and/or cash flows."

companyName: Solo Brands, Inc.

ticker: SBDS


text: Information security risks have been deemed by our Board to be of critical importance to Equinix, and thus the Nominating and Governance Committee receives quarterly updates on cybersecurity and the full Board receives a briefing on cybersecurity at least annually. These briefings are conducted by our CISO and members of the InfoSec leadership team and cover topics such as key risk indicators, the status of strategic programs, operational updates and key initiatives, past and future action plans, and InfoSec functional updates.

companyName: EQUINIX INC

ticker: EQIX


text: Registrant has adopted a cybersecurity incident response policy, plan and set of specific instructions, which are annually reviewed by the IT cybersecurity team members. Registrant is also taking actions intended to strengthen its cybersecurity posture and to improve its cybersecurity incident response plans and operating procedures. Despite the actions Registrant has taken and is taking and the fact that, to its knowledge, it has yet to experience a cybersecurity incident, there can be no assurance that Registrant will not experience a cybersecurity incident.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Management has adopted a Cybersecurity Incident Response plan which lays out the roles of IT personnel, senior leadership, and legal resources in responding to a cybersecurity incident. This plan is shared with our Board of Directors and reviewed annually. These risks could materially impact the business of the Company. To date, the Company has not experienced a material cybersecurity incident.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: We have established and implemented a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our critical information technology ("IT") systems and sensitive information.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: The Sponsor's Chief Compliance Officer is responsible for overseeing the development, implementation, and ongoing management of the Fund's Cybersecurity Policies and Procedures including the monitoring of our systems for potential cybersecurity events and the implementation of preventive and mitigative measures.

companyName: Amplify Commodity Trust

ticker: BDRY


text: The Company has a comprehensive cybersecurity management and oversight program designed to identify, manage, and mitigate potential risks. This program is integrated into our overall risk management systems and processes and includes continuous monitoring of cybersecurity threats, regular assessments of information systems, vulnerability management, penetration testing, employee training on cybersecurity best practices, and ongoing assessments of risk.

companyName: Science Applications International Corp

ticker: SAIC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO. Guy Shamilov, our CISO for the last seven years, has been a chief information security officer for eight years and is certified by Certified Information Systems Security Professional (CISSP), among other technical certifications he holds with respect to cybersecurity. He has worked over the last twenty years in the security industry, and prior to working with us, he was CISO of Tata Consultancy Services, Deputy Chief Information Security Officer of Traiana, Information Security Manager of Logic Industries, Senior Information Security Specialist of Migdal Group and Information Security and System Administrator at Matrix. Our CISO oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: We believe cybersecurity is critical to advancing our company's mission to be the catalyst for massive, measurable, data-informed healthcare improvement. We face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized groups and challenges specific to the healthcare industry. Our clients and suppliers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: An integral component of Adtalem's Incident Response Plan is our Privacy Incident Response Plan (the "Privacy Response Plan") which addresses privacy of our students' records, including under the FERPA. The Privacy Response Plan requires annual training for our employees on how to recognize and report potential privacy incidents.

companyName: Covista Inc.

ticker: CVSA


text: We do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Board's Risk Management Committee has a Cybersecurity and Technology Subcommittee that provides dedicated oversight to cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board typically holds an annual cybersecurity education session, which features the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level cybersecurity exercise to test its cyber incident response, completeness of playbooks, and communication protocols. This exercise involves Board members, managing committee members, third-party companies, and regulators as appropriate.

companyName: US BANCORP \DE\

ticker: USB


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by PAR's Information Security & Privacy team, is designed to identify, assess and manage risks from cybersecurity threats, and it provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework that has been established by our internal audit team.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: Our Senior Director of IT Infrastructure & Security also functions as our information security officer ("ISO"). The ISO (as part of our security function), along with our broader internal cybersecurity, IT infrastructure, and digital technology automation functions, as well as third-party service providers, all help identify, assess and manage our cybersecurity threats and risks. Our security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, responding to proactive outreach from CISA and FBI, internal and/or external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Our cybersecurity risk management program has its own governance channel and processes for monitoring and reporting risks. The current enterprise risk management framework is tailored to address risks around governance, process, technology, financial reporting, and fraud which could impact our financial statements. An enterprise effort to expand and integrate risks across all channels is underway.

companyName: Viant Technology Inc.

ticker: DSP


text: The Company has adopted a cybersecurity risk management program that includes processes designed to identify, assess, manage, and monitor risks from cybersecurity threats. We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management. Those processes include conducting an assessment of internal and external threats to the security, confidentiality, integrity and availability of Company data and systems along with other material risks to Company operations, at least annually or whenever there are material changes to the Company's systems or operations and responding to risks identified. The Company's information security program is developed using industry standards as a guide, including the National Institute of Standards and Technology Cybersecurity Framework. As part of our risk management process, the Company also engages outside providers to conduct periodic internal and external penetration testing and security assessments. As part of our third-party risk management program, we conduct assessments of vendor cybersecurity risks, including risks associated with our cloud vendors and other third parties.

companyName: NOVAVAX INC

ticker: NVAX


text: Both internally and through third-party experts, we routinely assess our information technology, or IT, environment with reference to the NIST CSF. We also assess risks related to third-party vendors, suppliers and contractors. Our risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We provide regular training to our employees regarding cybersecurity threats and best practices, and we have established policies for the responsible use of our IT and information resources. We also maintain a cyber insurance policy to mitigate and cover cybersecurity risks.

companyName: ALPINE IMMUNE SCIENCES, INC.


text: The information systems, data, assets, infrastructure, and computing environments of our third-party service providers are also at risk of cybersecurity incidents. We manage third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third-party risk assessment processes.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents. The Board of Directors is responsible for overseeing the company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Leatt Corp

ticker: LEAT


text: The cost to mitigate, investigate and respond to potential security incidents, breaches, disruptions, network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures to protect our data and information technology systems, our efforts to address these potential risks may not be successful, and could result in unexpected interruptions, delays, cessation of service and other harm to our business and competitive position.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: The Company continues to invest in cybersecurity and the resiliency of its networks and to enhance its processes and procedures, which are designed to help protect its systems and infrastructure, and the information they contain. For example, the Company is in the process of further developing its cybersecurity incident response processes and procedures to enhance its ability to identify, assess, and respond to potential cybersecurity threats. Although the Company faces cybersecurity risks in connection with its business, as of the date of this Report, such risks, including as a result of any previous cybersecurity incidents, have not materially affected (and are not reasonably likely to materially affect) the Company, including its business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: The Company engages third parties to test and advise on the Program, including to conduct our annual external penetration test. At times, the Company may engage external experts to support the Program by, for example, facilitating an internal audit, advising on a cybersecurity incident, or advising on legal and regulatory requirements.

companyName: PJT Partners Inc.

ticker: PJT


text: We assess third-party cybersecurity controls through a cybersecurity questionnaire and include information security and privacy addendums to our contracts, where applicable. We also require that our vendors and other third parties report cybersecurity incidents to us so that we can assess the impact of the incident on us.

companyName: Chemours Co

ticker: CC


text: The Company's Board has an active role, as a whole and at the committee level, in overseeing the management of the Company's risks. The Audit Committee of the Board is responsible for (i) overseeing the Company's policies and practices with respect to risk assessment and risk management, including with respect to cybersecurity and the use of AI, (ii) overseeing the Company's financial and other major risk exposures and the steps taken to monitor and control them, and (iii) providing guidance to the Board on such matters.

companyName: Fox Corp

ticker: FOXA


text: Our cybersecurity risk management program and our IRP is led by our Director of Security, who is supported by a multi-tier incident response team comprised of security, technical, and legal experts across our business who are responsible for coordinating and managing data security efforts, including incident response. This cross-functional team of specialists operates under the supervision of our executive management team with oversight from the Audit Committee of our Board of Directors and holds briefings to ensure the executive group is attuned to matters of data security impacting us. Our Director of Security has 14 years of experience working in the IT, infrastructure, and security domains. Before that, he worked for 6 years at Microsoft and 4 years at Garmin in similar roles.

companyName: ContextLogic Inc.


text: 7. Board Expertise in Cybersecurity N o Board members currently hold formal cybersecurity certifications or direct experience in cybersecurity risk management. The Company continues to enhance Board education on cybersecurity trends and governance practices.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Our cybersecurity management strategy consists of utilizing a combination of preventative controls and detective controls. For instance, suspicious emails are quarantined by our email service provider and must be reviewed before they are downloaded to an individual computer. Our process and cybersecurity posture will continue to be refined.

companyName: Safe Pro Group Inc.

ticker: SPAI


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate board-approved management committees, as discussed further below, and to the IT/Cybersecurity Committee of our board of directors. The Incident Response Plan is coordinated through the CISO and key members of management are embedded into the plan by its design. This pIan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: On January 31, 2022, certain of our computer systems related to the Aurora acquisition that had not yet been integrated into our main systems were the victim of a cybersecurity attack. We immediately took steps to isolate those systems and implemented measures to prevent the spread of the attack, including taking systems offline in an abundance of caution. Together with an outside cybersecurity forensics firm, we investigated the attack to determine its nature, scope, duration, and impacts, as well as our vulnerability to another such attack and whether there was any exfiltration or misappropriation of data. There was no evidence that the attack extended beyond the Aurora acquisition's systems, and it was determined that no critical data was accessed. We have subsequently taken steps to integrate the acquisition's systems with our main systems, which we expect to complete in the first half of 2024.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.

companyName: Hughes Satellite Systems Corp


text: We also employ processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, or customer, or otherwise implicating the third-party technology and systems we use. Such security measures include, without limitation: A security solution designed to safeguard customer data and systems. Security assessments of our major vendors. Risk assessments by an insurance company.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: The Vice President of Information Technology has been with the Company for over 25 years in various roles in information technology and information security. The Company's Interim CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: We work with industry-leading security consulting and technology partners and employ a "defense-in-depth" approach that uses multiple security measures to protect the integrity of our proprietary and confidential information. This approach aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. We periodically review our strategy and modify its implementation based on threat trends, program maturity, assessment results, and the advice of third-party security consultants. We have documented information security policies, procedures, and guidelines, known as our "Written Information Security Program." Our program (i) balances responsiveness to rapidly changing threats with ensuring our IT security environment's sustainability and overall effectiveness and (ii) is reasonably likely to defend against risks of cybersecurity threats that would have a material impact on our business strategy, results of operations, or financial condition. This program focuses on the following six key areas to monitor various IT performance and security metrics: • Proactive cybersecurity processes, including vulnerability scanning, penetration testing, and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that we regularly evaluate using incident response and disaster recovery exercises based on realistic scenarios; • Endpoint technology that includes encryption, threat management, monitoring, investigation support, and backups; • Identity and access management controls that often include multi-factor authentication and additional safeguards for staff granted elevated privileges; • Employee cyber risk awareness, training, and testing that covers cybersecurity threats and actions to prevent or report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring, and contractual obligations. We review third-party control environments when possible and practical, aligning the risk exposure with our business requirements and risk tolerances.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: g. Reporting data breaches, as required by law, to the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), and various state agencies; our reports are publicly available, free of charge, and can be obtained through the OCR Portal at https://ocrportal.hhs.gov/ocr/breach.

companyName: HUMANA INC

ticker: HUM


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, data associated with our clinical trials or manufacturing campaigns, and other confidential information that is proprietary, strategic or competitive in nature. We perform periodic assessments of our information security processes, and the results of these assessments are reported to the audit committee of the board of directors (Audit Committee) as part of a cybersecurity update report conducted at least annually.

companyName: aTYR PHARMA INC

ticker: ATYR


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERRF and are based on recognized frameworks established by NIST, the International Organization for Standardization ("ISO") and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Audit Committee of our Board of Directors provides oversight of our cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents Our Senior Director of Information Technology's leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help us prepare our employees to address cybersecurity risks. Our Senior Director of Information Technology has over sixteen years of experience in information technology, ten years of experience in information technology for life sciences companies, and a relevant bachelor's degree in information technology. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: Employee Trainings All Company employees must complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics: the Company's Information Security Policy; Information Security Incident Response Plan; HIPAA, PCI Compliance; General Data Protection Regulation ("GDPR") and CCPA; Security Awareness and Incident Response Training covering Social Engineering Phishing (identification and common red flags), Social Media safety best practices, Internet Security best practices, and Incident response training for end-users; and Phishing. In addition, our developers must complete Secure Code / Secure Application Development Training based on Open Web Application Security Project top 10 standards.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: As of the date of this report, we did not identify any cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: We have implemented several processes with the assistance of third parties that we engage to help us manage our overall information technology function. These include certain processes for assessing, identifying and managing cybersecurity risks and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack, as well as to secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and periodic review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and governance experts, to enhance our cybersecurity oversight and to gain valuable insights into the ever-evolving cybersecurity landscape.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: Our information security program also addresses cybersecurity risks associated with our use of third-party service providers. We use systems and processes designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analysis regularly.

companyName: Simply Good Foods Co

ticker: SMPL


text: We believe our ongoing training and awareness campaigns reinforce the importance of employees in preventing cybersecurity incidents, and further the goal of continuously promoting Weatherford's culture of safety, security and compliance.

companyName: Weatherford International plc

ticker: WFRD


text: Risks from cybersecurity threats could materially affect the Combined Company's business strategy, results of operations or financial condition as described under Item 1A in this Form 10-K. There are no known risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant as of the date of this filing.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: Our Global Data Privacy Program continues to align with environmental, social, and corporate governance standards and considers both risks and benefits of privacy-driven spending. The program operating model is based on the General Data Protection Regulation, which is adjusted for specific local requirements. The operating model is scalable to manage strategic, operational, legal, compliance, and financial risks and benefits, and uses technology to automate portions of the program, such as data subject access requests and consent and preference management.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti - malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. We use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi - factor authentication, perform regular penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices.

companyName: SEELOS THERAPEUTICS, INC.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other information technology risks to the Board's Audit Committee as well as hiring a third party vendor that specializes in cybersecurity to oversee and provide an assessment on the Company's IT controls. The Audit Committee meets at least quarterly to discuss matters involving cybersecurity risks.

companyName: American Bitcoin Corp.

ticker: ABTC


text: To respond to the threat of security breaches and cyberattacks, we have developed a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats to all information and systems owned by us. We maintain certain risk management processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impacts to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our information systems and the information residing therein.

companyName: Streamex Corp.

ticker: STEX


text: We have implemented a cybersecurity risk management program intended to protect the security and availability of our critical systems and information. Our risk assessment process is modeled after the National Institute of Standards and Technology ("NIST") Guide for Conducting Risk Assessments and is performed annually. We may also elect to perform assessments more often based on material changes in business activities or other factors. The results of our cybersecurity risk assessment aid in identifying potential cybersecurity risks and guiding the adoption of appropriate risk mitigation measures. Our cybersecurity threat defense approach incorporates certain guiding principles from the NIST Cybersecurity Framework (the "NIST Framework"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program includes a cybersecurity incident response plan that consists of incident identification, classification, investigation and diagnosis, response, and recovery.

companyName: Five Point Holdings, LLC

ticker: FPH


text: The underlying processes and controls of the bioAffinity cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity addition, bioAffinity maintains policies over areas, such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect bioAffinity IT assets, data, and services from threats and vulnerabilities. bioAffinity partners with industry-recognized cybersecurity providers leveraging third-party technology and expertise.

companyName: bioAffinity Technologies, Inc.

ticker: BIAF


text: CRH works closely with multiple external advisors specializing in cybersecurity to improve its ability to identify and detect, protect against, and recover from, cybersecurity incidents. In addition, CRH leverages certain managed service providers to aid in triaging and monitoring potentially malicious activities. CRH is dependent upon third-party service providers for certain IT-related services, and has systems of oversight to evaluate potential risks in certain critical third-parties on whom CRH has a material dependency. These systems would include the use of vendor security questionnaires, vulnerability assessments and annual audits.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Our SCI subsidiary has been certified under the U.S. Cybersecurity Maturity Model Certification (CMMC) program. We also engage third-party experts to improve our cybersecurity posture, including through penetration testing.

companyName: SANMINA CORP

ticker: SANM


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity and Data Privacy Oversight Subcommittee (the Privacy and Security Subcommittee) of the Nominating and Corporate Governance Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: For a description of risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A "Risk Factors" in this annual report on form 10-K, including the risk factors entitled "Security breaches, cyberattacks, and other disruptions to information technology systems owned or maintained by us or third parties, such as vendors or suppliers, could disrupt our operations, compromise the confidentiality of private customer data or our intellectual property, and adversely affect our business, reputation, operations, and financial results" and "Our business may be impacted by information technology system failures or network disruptions, and lack of redundancy."

companyName: SITIME Corp

ticker: SITM


text: Our risk management organization, which is led by our Chief Risk Officer, manages our information security program along with enterprise risk management, business continuity, internal audit and physical security. Our risk management team routinely reports on cybersecurity matters to our executive management team and our Board. Our Chief Information Security Officer, who reports directly to our Chief Risk Officer, leads a dedicated information security team that manages our information security program. The information security team is made primarily of full-time employees; however, we routinely engage consultants to provide supplemental labor and additional expertise in specific areas on an as-needed basis. Our information security team is organized based on industry best practices in alignment with NIST recommendations. All of the leaders in our information security team have over 10 years of cybersecurity experience and most of our information security staff maintain cybersecurity program certifications such as CMU Cybersecurity Executive Certification, ISACA Certifications (CISSP & CISM) and other relevant vendor certifications. Our information security team also regularly undergoes continuing education to ensure our implementation of best-in-class techniques.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: We have an established governance model to provide mechanisms to identify and escalate material risks from cybersecurity threats. This includes management processes across the information security program designed to monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents. Risk escalation and reporting paths are in place, including review of cybersecurity risks by management committees such as the Operational Risk Committees and Enterprise Risk Management Committee chaired by SHUSA's Head of Technology & Operations and Chief Risk Officer, respectively. The Company also maintains a dedicated Information Security and Data Management Committee chaired by SHUSA's Chief Technology Officer, which includes the CEO, the heads of the Company's businesses, representatives of the Company's second LOD, and Internal Audit representatives among its members. The members of the Board of Directors are senior individuals that are experienced in identifying and managing risks including running companies with IT functions, inclusive of cybersecurity, reporting to them.

companyName: Santander Holdings USA, Inc.


text: We have implemented processes for overseeing, identifying and managing material risks from cybersecurity threats and have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level and that cybersecurity risk remains a key component of management activities, including continuously assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity program is based on the U.S. National Institute for Standards and Technology standards and other applicable country-specific and industry frameworks.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and CSO. Our President of P&T has over 25 years of experience in senior executive roles that involved ownership of, and accountability for, cybersecurity matters, including Chief Information Officer, Chief Technology Officer, and Senior Vice President / General Manager. Our CDO has over 15 years of experience in IT and previously served as the Chief Information and Digital Experience Officer for a home automation company. Prior to that, she held various leadership roles at a computer software company. Our CSO has over 30 years of experience in computer science and engineering disciplines, and served as the Chief Information Security Officer at various companies prior to joining Procore.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: CMC recognizes the critical importance of a well-developed cybersecurity risk management program within an ever-changing threat landscape and has designed ongoing cybersecurity management protocols that are embedded into our global business processes and activities. These protocols include, but are not limited to, penetration testing, vulnerability scanning, attack simulations and appropriate internal controls, along with independent third-party audits conducted to evaluate compliance with security standards and best practices. The protocols are designed by our Chief Information Security Officer ("CISO") and implemented by an experienced team including our information security and various technology departments. We engage expert consultants and third-party service providers to review our cybersecurity controls and readiness, alert us to potential improvements and provide incremental industry knowledge and expertise. Additionally, employees are required to complete cybersecurity training at the start of their employment and annually thereafter and are regularly exposed to phishing awareness campaigns that simulate real-world threats.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: of any cybersecurity incidents that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: VPR Brands, LP.

ticker: VPRB


text: As part of its broader risk oversight activities, our Board maintains oversight of cybersecurity matters, including managing and assessing risks from cybersecurity threats. The Audit Committee also reviews the adequacy and effectiveness of our information security policies and practices and the internal controls regarding information security risks. The Audit Committee and the Board receive regular information security updates relating to cybersecurity risk from management, including from our Director of Information Security.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are shared with executive management and, as needed, the Audit Committee and the Board. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: Our board of directors has ultimate oversight of our risk management policies and strategies. Our executive team, which is responsible for our day-to-day overall risk management practices, present to the board of directors on the various material risks to our Company, including risks related to information technology and cybersecurity.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Management is responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents as well as the Company's overall information security strategy, policy, and operations. The cybersecurity program is executed by the Company's Senior Vice President of IT Governance, Risk, and Compliance, who has over 15 years of cybersecurity experience in overseeing and managing cybersecurity risk. He is also responsible for maintaining and, in the event of an actual or suspected security incident, executing the Company's incident response plan.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer actual or suspected security or privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations, and potentially significant delays in our delivery to market," and "Restrictive laws and regulations govern the collection, use, transfer, and other processing of personal information."

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: Principle of Least Privilege (PoLP): We enforce strict access controls, granting system access only to individuals who require it for their roles. Regular audits ensure compliance and minimize security risks.

companyName: Health In Tech, Inc.

ticker: HIT


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated as part of the Adviser's program. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Stone Point Credit Corp


text: As cybersecurity risks arise, our Information Security team executes the incident response procedure and communicates the appropriate details to management in alignment with the escalation steps in the procedure. In addition, our Chief Information Officer, Vice President, Information Security, and Manager, Information Security, conduct monthly cybersecurity program status reviews with the Information Security team that includes KPI tracking, risk assessment, escalation actions, and project status.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to maintain stakeholder trust. Our Chief Financial Officer is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CFO has over eight years of information technology, information technology audit, and cybersecurity experience, and is involved in following the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Cybersecurity Risk Assessment Our cybersecurity and risk management programs are part of our continuously evolving enterprise-wide risk management practices. Aligned and measured against the National Institute of Standards and Technology (NIST) Cybersecurity Framework, recognized best practices and standards for cybersecurity and information technology, industry and government standards and other guidelines, our cybersecurity and risk management programs utilize policies, processes, and technologies to identify, assess, manage and mitigate cybersecurity risks and threats we face. We also conduct periodic reviews and updates to uphold our security standards, including implementation of tabletop crises exercises. Our management implements ongoing and annual risk assessment processes to identify and manage risks that could affect our ability to safeguard sensitive data or provide reliable transaction processing and to minimize financial risk exposure. These risks include, but are not limited to, regulatory compliance; third-party management, including risks from business partners and software providers; mergers and acquisitions; system availability and disruption of business operations; data use and security; vulnerability and configuration management; fraud and extortion; and reputation risk.

companyName: Elevance Health, Inc.

ticker: ELV


text: In addition to our Cybersecurity Committee, an information security operations team is in place, which monitors the environment for cybersecurity incidents on a continuous basis. We have also established incident response plans to assess and manage cybersecurity incidents. These plans, which are tested at least annually, include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to the company, are escalated to the Cybersecurity Committee. The Cybersecurity Committee, in coordination with internal and external advisors and legal counsel, is responsible for determining the materiality of cybersecurity incidents and coordinating any necessary disclosures. A materiality decision framework, which includes both quantitative and qualitative factors, is in place to guide the materiality decision. Critical cybersecurity incidents which are determined to be material are escalated to the Audit Committee, and when appropriate, to the Board of Directors.

companyName: MARCUS CORP

ticker: MCS


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including credit, market, treasury, operational, compliance, model and data, and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a key member of the organization, reporting directly to the Chief Information Officer and, as discussed below, periodically to the Innovation and Technology Committee of our board of directors. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: The Audit Committee of our Board of Directors has primary responsibility for overseeing our cybersecurity risks and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.

companyName: FLEX LTD.

ticker: FLEX


text: We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, we assess third party cybersecurity controls through the review of systems and organizational controls audit reports performed by independent auditors of certain of our information system related third-party service providers.

companyName: Prairie Operating Co.

ticker: PROP


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The responsibility for oversight of risks from cybersecurity threats rests with our entire Board, but the Audit Committee oversees certain cybersecurity related items as described below. At least twice per year the entire Board receives an overview from management on our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, and cybersecurity threat risks or incidents and developments, as well as the steps management took to respond to such risks. Additionally, our Chief Information Officer attends Audit Committee meetings to present cybersecurity information for consideration in financial reporting, as necessary, and attends private Executive Sessions with the Audit Committee. Our Director of Internal Audit reports to the Audit Committee regarding attack and penetration exercise results and remediation. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news or events and discuss any significant updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of matters such as enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters. In 2023, the Board participated in a tabletop exercise associated with cyber threats and in 2024 the Board received a presentation from the former Chief of Staff of the Cybersecurity and Infrastructure Security Agency.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we do not believe are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay distributions".

companyName: NEXPOINT DIVERSIFIED REAL ESTATE TRUST

ticker: NXDT


text: Our cybersecurity risk management processes are integrated into our overall risk management strategy. As part of our risk management strategy, our cybersecurity framework encompasses the following key processes:

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: The Board of Directors, directly and through the Audit Committee, actively engages in reviews of cybersecurity risks. The full Board of Directors meets with the Company's Vice President, Information Technology and Operating Initiatives and Director of IT Infrastructure and Security at each of the Board's regularly scheduled meetings to discuss the Company's cybersecurity posture, including malicious activity experiences and vulnerabilities for potentially material cybersecurity threats and incidents. The results of disaster recovery exercises, penetration testing, and other external audits are also presented to the Board. The Audit Committee is responsible to review and evaluate the Company's cybersecurity and other information technology controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to threats. In addition to being represented on the oversight committee under the Incident Response Plan, the Audit Committee meets regularly with the Company's information technology leadership team and reviews with them any specific cybersecurity issues that could affect the adequacy of the Company's internal and disclosure controls.

companyName: SIGMATRON INTERNATIONAL INC


text: The Company remains committed to preserving the integrity of its network, while remaining adaptable to identify new and emerging threats relying on both internal and external research and intelligence gathering. The Company has instituted a Cybersecurity Awareness Month program and the Cybersecurity Champion Network for continuous improvement via trainings and continued awareness on emerging cybersecurity risks.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: Our product development processes apply development, security and operations principles aligned with applicable government and commercial standards including DO-326 and NIST standards and guideline publications, and include vulnerability scanning and static and dynamic composition analysis. We regularly assess our product development processes, product cyber maturity and the teams providing our secure services in relation to cybersecurity. In addition, we strive to meet all security requirements mandated by government and commercial customers and adhere to regulatory guidance and standards for system security engineering. Many of our products also undergo industry audits and regulatory compliance certifications, and our products delivered to the Department of Defense (DoD) must comply with DoD risk management requirements where required.

companyName: RTX Corp

ticker: RTX


text: Compliance Officer leads day-to-day cybersecurity risk management in conjunction with third-party cybersecurity consultants. Our Compliance Officer oversees our cybersecurity protocols and is responsible for ensuring the effective execution of incident response and recovery processes. Reports regarding cybersecurity risk assessments, incidents (if any), and mitigation efforts are provided to the Board at regular intervals.

companyName: Eva Live Inc

ticker: GOAI


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee oversight of cybersecurity matters and other policies regarding information security risks. The Nominating and Corporate Governance Committee oversees management's implementation of our cybersecurity risk management program.

companyName: AMBARELLA INC

ticker: AMBA


text: We provide cybersecurity training to associates, which includes monthly phishing exercises, to help them protect sensitive information and follow best practices. We offer role-based training for regulatory compliance and work with external partners to develop and deliver education and training to mitigate cybersecurity risks. We continually evaluate trends within the industry, apply necessary controls and empower our leadership to make informed, risk-based decisions.

companyName: PVH CORP. /DE/

ticker: PVH


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: • Briefings from internal security personnel; • Threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and • Alerts and reports produced by security tools deployed in the IT environment.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: Vendors that have access to our information are required to manage such information in accordance with laws and appropriate privacy and security standards. Standards are applied on a per-contract basis and include requirements to have an information security program and report to us any incidents in which its confidential information or systems are compromised. Depending on the nature of the vendors' access to our information, we monitor and evaluate the controls and governance established with the vendors ranging from a continuous cadence to at least quarterly.

companyName: JOINT Corp

ticker: JYNT


text: Occidental's cybersecurity strategy is intended to mitigate cybersecurity threats identified in the risk management process and provide a framework for Occidental to have appropriate administrative, technical and physical safeguards to protect its systems and data and respond effectively to cybersecurity threats. The Company's cybersecurity program aligns with the NIST framework and leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. Occidental relies on continuous security monitoring, penetration testing, vulnerability scanning, personnel training and other tools to identify and mitigate potential cybersecurity threats. Occidental also has established cybersecurity policies that address its cybersecurity practices and controls. The Company conducts internal security audits, including audits conducted by third parties, and other assessments. In addition to its administrative and technical safeguards, Occidental has implemented physical safeguards intended to mitigate risks to its systems. Using a standardized written evaluation and other investigative processes, Occidental identifies and assesses cybersecurity risks flowing from its vendors and suppliers, and manages these using a risk-based approach.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: While management is responsible for the day-to-day management of cybersecurity policies and procedures, the audit committee of our Board is tasked with oversight of our risk management process, which includes risks from cybersecurity threats.

companyName: Arq, Inc.

ticker: ARQ


text: The threat posed by cyberattacks and other cybersecurity incidents is significant, notwithstanding our prevention and mitigation systems and processes. To date, we have not experienced cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition. For additional discussion of risks from cybersecurity threats, see "Cyberattacks or other security breaches could have a material adverse effect on our business. " in Item 1A., "Risk Factors."

companyName: Ameris Bancorp

ticker: ABCB


text: In addition, the Company uses (i) a Security Operations Center vendor with 24x7 monitoring and response capabilities to identify any suspicious activity on the Company's networks and (ii) a security consulting firm for assessments, penetration testing and incident response. In the event of a cybersecurity threat, the CTO and these parties would collaborate to assess and manage the risk with ultimate responsibility residing with the Board.

companyName: UNITIL CORP

ticker: UTL


text: Our CIO has more than 35 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, our CIO has led governance, risk, and compliance technology programs and information security programs. The CIO currently reports to the CFO.

companyName: HORTON D R INC /DE/

ticker: DHI


text: Our board of directors and our executive leadership team, through our Information Security Executive Charter, oversee our risk management program, of which cybersecurity represents an important component. Our Global IT Director is responsible for managing our risk management program, including our cybersecurity strategies and initiatives and the periodic review of our policies, standards, and risks. Our Global IT Director has over 25 years of experience in technology and security. Our executive leadership approves cyber security strategies, initiatives, and investments to ensure alignment with business objectives and risk tolerance.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: Our Senior Director of IT and Director of Security and Compliance have primary responsibility for assessing and managing cybersecurity risks. An internal team of cybersecurity experts execute our cybersecurity program while our VP of Information Services provides executive oversight. Combined, our experts bring multiple decades of cybersecurity experience and have earned cybersecurity-related certifications. Our internal team is bolstered by strategic third-party security partners leveraged to provide 24x7 monitoring and response. Third parties routinely assess our security practices providing tactical assistance or strategic guidance through audits and penetration tests. All members of the team routinely discuss emerging security threats and ways to mitigate risk.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Our cybersecurity risk management program aims to protect and preserve the confidentiality, integrity, and continued availability of our residents' and associates' data and includes controls and procedures for the identification, containment, and remediation of cyber threats.

companyName: Invitation Homes Inc.

ticker: INVH


text: Cyber Incident Response Plan The Company has adopted a written Cyber Incident Response Plan (the "Plan") to guide our response to cybersecurity incidents. The Plan established the Cyber Incident Response Team ("CIRT"), which is responsible for leading the Company's response in the event of a cybersecurity incident and is comprised of the Company's Chief Technology Officer ("CTO"), Chief Information Security Officer ("CISO") and Chief Operating Officer as well as other senior management.

companyName: PJT Partners Inc.

ticker: PJT


text: Oversight of Cybersecurity Risks The Board and our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Advisor, and the Dealer Manager and the measures we, the Advisor, and the Dealer Manager are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our and the Advisor's and the Dealer Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.

companyName: IPC Alternative Real Estate Income Trust, Inc.


text: For a discussion of potential cybersecurity risks affecting the Company, please refer to Item 1A - Risk Factors - Risks Related to IT in this report.

companyName: Toughbuilt Industries, Inc


text: Processes for assessing, identifying and managing material risks from cybersecurity threats We have a systematic and thorough risk management process, which is designed to identify, assess, prioritize and mitigate the risks that could negatively impact achievement of our strategic and operating objectives. A key component of this process is our Enterprise Risk Management ("ERM") Committee, which is led by our Chairman, President and Chief Executive Officer, and includes our Chief Financial Officer, Chief Legal Officer, Chief Information Officer and other members of senior management. The ERM Committee monitors both current and emerging risks facing the Company and meets at least quarterly to review the prioritization of identified risks. The ERM Committee has identified cybersecurity as a critical risk facing the Company. Each of the most critical risks identified is assigned to a member of senior management who oversees the management, mitigation and presentation of the risk to the senior leadership team and throughout the year to our Board of Directors. The risks relating to information technology, including cybersecurity, are overseen by our Chief Information Officer. Our Chief Information Officer then assigns the risks within the Information Technology risk category to others on his team. The cybersecurity risk is managed and overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer. Cybersecurity as a risk is presented to the full ERM Committee annually or more frequently as needed.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: For high priority incidents, the cybersecurity group will manage a risk-appropriate response, which may include the use of third-party vendors to support any investigation, response, and remediation efforts. Updates regarding any incidents are provided to management as appropriate.

companyName: New Fortress Energy Inc.

ticker: NFE


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks The Company's CIO, along with the director of cybersecurity and a designated security team of professionals, are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Jeffrey Wright is senior vice president and CISO for Allstate. He is responsible for the development and execution of the security strategy which protects Allstate's information from external and internal cybersecurity threats. Mr. Wright has more than 20 years of information security leadership experience.

companyName: ALLSTATE CORP

ticker: ALL


text: Our overall approach to cybersecurity risk management includes the following key elements: • Multi-layered defenses, coupled with in-depth and continuous monitoring – We utilize data analytics to detect anomalies and search for cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying and managing cybersecurity threats. We also periodically use our internal audit function to conduct additional assessments and reviews. • Insider Threats – We maintain an insider threat program, designed to identify, assess, and address potential risks from within Allegiant. Our program evaluates potential risks consistent with industry best practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration – We work with government, customer, industry and supplier partners including government-industry partnerships and critical infrastructure threat intelligence sharing platforms. These relationships enable the rapid sharing of threat intelligence and vulnerability mitigation across the industry and the defense industrial base and supply chain. • Third Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive information in our computing environments, and those managed by third parties. Our standard terms and conditions with third parties include contractual provisions requiring certain security protections. • Training and Awareness – We seek to create a culture of security. We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees are required to participate in cybersecurity training at least annually and our training includes spear phishing and other awareness training. We regularly remind our employees and partners of the importance of handling and protecting customer and employee data, including through annual privacy and security training. We also host periodic tabletop exercises and drills with management and other employees to practice rapid response to cyber incidents. • Supplier Engagement – We require our suppliers to comply with our standard information security terms and conditions and require them to complete information security questionnaires to enable us to review and assess any potential cyber-related risks depending on the nature of the services provided. • Scalability – We continue to invest directly in our cybersecurity program, as well as augmentation of those cybersecurity services through managed services and third parties, depending on the maturity and risk of the operating model of the business unit.

companyName: Allegiant Travel CO

ticker: ALGT


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity, and availability of customer and bank sensitive information. Any loss of confidentiality, integrity, or availability introduces operational, compliance, strategic, transactional, reputational, legal, and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Quant Oak Bancorp and Quaint Oak Bank. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use technical, administrative, and physical controls.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: We have an incident response program in place that is designed to enable a coordinated response to mitigate the impact of cyber-attacks, recover from the attack and to drive the appropriate level of communication to internal and external stakeholders, including timely reporting of material incidents in accordance with SEC rules.

companyName: STATE STREET CORP

ticker: STT


text: We use third-party service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. For example, these service providers include professional services firms, threat intelligence service providers, managed cybersecurity service providers, penetration testing firms and forensic investigators. We also have a public bug bounty program.

companyName: NETGEAR, INC.

ticker: NTGR


text: The Committee was formed in December 2024 and is responsible for cybersecurity, technology and innovation oversight previously performed by the Audit and Risk Committee. It is a committee of the Company's Board of Directors that actively participates in discussions with management regarding cybersecurity risks and receives periodic reports regarding the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, remedy audit findings, and review enhancements to the Company's defenses and management's progress on implementing its cybersecurity strategy. In addition, the Committee reviews key cybersecurity risks at least three times per year to help ensure such risks are incorporated into the Company's Enterprise Risk Management framework. The Committee also meets at least three times per year in executive session with the Company's Chief Information Security Officer. To assist with their oversight of the Company's cybersecurity programs and mitigation efforts as they relate to the broader cybersecurity landscape, our Committee will attend cybersecurity awareness training or other educational events presented by third-party cybersecurity experts.

companyName: UPBOUND GROUP, INC.

ticker: UPBD