text: Our cybersecurity risk management program is informed by industry standards, intended to address the fundamental principles of information security. Our program leverages the expertise of third-party information technology providers and solutions, and includes periodic simulated attacks, penetration testing, third-party risk evaluations, and threat monitoring to identify, assess, and mitigate cybersecurity risks a formalized incident response and notification plan that establishes an organizational framework and guidelines to assist us in identifying, responding to, and recovering from cybersecurity incidents.

companyName: SpringWorks Therapeutics, Inc.


text: Approach and Strategy Our corporate information technology, accounting and financial reporting platforms, and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We engage a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management efforts and shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk management.

companyName: GENERATION INCOME PROPERTIES, INC.

ticker: GIPR

secItem: Item 1C


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Information Officer. The Chief Information Officer has extensive experience working in and leading the Company's information systems. In addition, a dedicated Cybersecurity team, including the Chief Technology Officer and Cybersecurity Manager, provide regular updates to the Chief Information Officer.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and CEO. Our CFO and CEO work with the Company's Incident Response Team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the Audit Committee for certain cybersecurity incidents.

companyName: GENELUX Corp

ticker: GNLX


text: In the event of a potential material cybersecurity incident or ransomware demand, Howmet has adopted a policy to respond to such event, which includes protocols and procedures to, among other things, escalate the incident or demand, form a core cross-functional response leadership team (including the CISO and CIO) to assess severity, formulate response and remediation, and determine any required reporting or notifications.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: The Audit Committee of the Board has primary responsibility for overseeing our cyber security risk management process. Our cybersecurity risk management processes are integrated within our established Enterprise Risk Management System. On a regular basis, the Audit Committee and the Board receive updates on cybersecurity matters from the Chief Information Officer ("CIO"). These updates include, but are not limited to, cybersecurity program updates, results of third-party assessments, results of tabletop 'drill' exercises, end user awareness training, and recoverability and resilience. The Audit Committee also receives quarterly reports from our internal audit department.

companyName: SUPERIOR ENERGY SERVICES INC


text: Likewise, the Partnership's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Partnership with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Partnership assets and information.

companyName: CVR PARTNERS, LP

ticker: UAN


text: We leverage people, processes, and technology with an in-depth, layered, defensive strategy as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program. Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Management is also responsible for upholding our cybersecurity processes. To this end, we have established a global cybersecurity management team, led by our Vice President, Cybersecurity. Our Vice President, Cybersecurity reports directly to our Senior Vice President and CFO and is primarily responsible for cybersecurity oversight and for developing strategies to mitigate risks from cybersecurity threats, monitoring policy compliance and educating staff on security practices. In carrying out his duties, our Vice President, Cybersecurity provides periodic reports to the Director of our Internal Audit Department, who, in turn, briefs the Audit Committee of the Board of Directors on the contents of such reports, including incident reports, compliance status and updates on cybersecurity initiatives.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Incident Response Planning: The Company has established and maintains incident response plans that address the Company's response to a cybersecurity incident, and such plans are tested on an ongoing basis.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Our management is responsible for the oversight and administration of cyber security protocols. Our management team relies on our third-party providers on administrating cybersecurity assessments to identify, manage, mitigate, and respond to cybersecurity threats. Management updates the Board as necessary, regarding any significant cybersecurity occurrences.

companyName: Linkhome Holdings Inc.

ticker: LHAI


text: Key members of senior management, including our Chief Information Officer ("CIO"), are accountable for our cybersecurity and data privacy programs and is supported by the Board of the Directors (the "Board"). Under the guidance of the Board, our IT department, under the direction of our CIO, manages day-to-day operations of the security and data privacy functions and proposes changes to our cybersecurity strategy, which is part of our overall information technology strategy. The senior management, including our CIO, and the Board meet frequently to discuss cyber and data operations, privacy programs and risks. Our CIO has extensive information technology and program management experience and has served many years in our corporate information security organization.

companyName: BGSF, INC.

ticker: BGSF


text: Our CCO, is responsible for developing and implementing the cybersecurity risk management program and reporting on cybersecurity matters to the Board. Additionally, members of the third-party service providers have cybersecurity experience and/or certifications. We view cybersecurity as a shared responsibility across our management team and periodically perform simulations and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity training at least annually and have access to more frequent cybersecurity training through online events.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Chief Executive Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents and reporting any such incidents to our Board of Directors, and periodically briefs our Board of Directors on our cybersecurity and information security posture and on any cybersecurity incidents deemed to have a moderate or higher business impact. In the event of a material cybersecurity incident, our cybersecurity consultant has extensive information technology and program management experience. We believe that we have implemented a governance structure and processes that are equipped to assess, identify, manage and report cybersecurity risks. Refer to "Item 1A. Risk Factors" for a discussion of certain of the cybersecurity risks that our business is subject to. As a smaller reporting company, with respect to compliance with Form 8-K incident disclosure requirements, we were required to comply with the reporting requirements beginning June 15, 2024.

companyName: Sphere 3D Corp.

ticker: ANY


text: Our management team supervises cybersecurity risk management efforts to prevent, detect, mitigate,and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment. The cybersecurity risk management program also includes tools and activities to prevent, detect and analyze current and emerging cybersecurity threats and plans and strategies to address threats and incidents.

companyName: Lite Strategy, Inc.

ticker: LITS


text: IT Team provides updates to upper Management on a routine basis or as potentially critical risks from cybersecurity threats or incidents arise. In addition, the audit committee is notified of any material cybersecurity concerns that may impact internal controls, data storage, or the integrity of our financial reporting.

companyName: AppTech Payments Corp.

ticker: APCX


text: Many cybersecurity policies and standards across the Southern Company system are governed by multiple regulatory requirements. Portions of these policies and standards are audited by the FERC, the Transportation Security Administration, and the NRC, as appropriate, and are periodically evaluated by third parties such as cybersecurity insurance carriers. Certain members of senior management have high-level security clearances to facilitate access to critical information, and the Southern Company system participates in pilot programs with industry and the U.S. government to share additional information and strengthen cybersecurity and business resiliency.

companyName: SOUTHERN CO GAS


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of risks related to cybersecurity.

companyName: PRUCO LIFE INSURANCE CO


text: Cyber Risk Management and Strategy In today's interconnected environment, information is inherently exposed to a wide range of risks, threats, and vulnerabilities. As a provider of products and services to financial institutions, Jack Henry integrates industry-standard frameworks, policies, and procedures to securely process and store sensitive information, prioritizing the protection of our associates, clients, and their private data in an ever-evolving cyber threat landscape.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, including contracted 24/7/365 Security Operating Center monitoring services and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and conduct cybersecurity awareness testing for our employees. Our program leverages industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: We recently established the Executive Cybersecurity Committee (ECC), which is comprised of our Chief Financial Officer, Chief Information Officer, Chief Legal Officer, Chief Accounting Officer, and Global Head of Cybersecurity, with the goal of providing oversight of the Company's cybersecurity program. The ECC is responsible for, among other things, evaluating and determining the materiality of cybersecurity incidents as well as reviewing and approving any public disclosures with respect to material cybersecurity incidents. Our cybersecurity incident response policy is designed for our cybersecurity operations team, which is led by our Global Head of Cybersecurity who works in conjunction with the cross-functional incident response team, to escalate certain cybersecurity incidents to the ECC depending on the circumstances. The ECC also has the responsibility of reporting to the Board and/or the Audit Committee.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: The Board of Directors of the General Partner, along with the Board's Audit Committee, oversees the management of cybersecurity risks, receiving regular reports from management on the prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as on material security risks and vulnerabilities. The Audit Committee is updated on cybersecurity risks, risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant cybersecurity incidents within our industry. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff or external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: ICAHN ENTERPRISES L.P.

ticker: IEP


text: We have implemented and continue to maintain a robust cybersecurity program intended to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Leslie's, Inc.

ticker: LESL


text: We have recently implemented additional security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. All employees have recently (subsequent to December 31, 2023) begun receiving cybersecurity training and other education regarding their use of computers, information technology, and sensitive data including specifically how to recognize common attack strategies. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third parties applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: Oversight and Governance Our CISO, assisted by our Information Security team, has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Company's Board of Directors and members of executive management. Our CISO has extensive experience managing information technology systems and information security systems, previously served as the Company's Chief Information Officer, and holds the Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") certifications. Our CISO regularly updates members of executive management on developments surrounding cybersecurity. The CISO reports to the Risk Committee of the Board of Directors and provides regular reports to the Board of Directors and Risk Committee on emerging cybersecurity issues and the Company's cybersecurity infrastructure.

companyName: BROOKLINE BANCORP INC


text: Our board of directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The audit committee of the board of directors oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The audit committee engages in regular discussions with management regarding our significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: To manage cybersecurity risk introduced from our supply chain, depending on the nature of a supplier's work and the sensitivity of our and our customers' information provided to the supplier, we also require suppliers to complete our security questionnaire and provide evidence of security accreditations, and we evaluate supplier compliance with security requirements using internal and third-party resources.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: All business-requested technologies and third-party service providers must successfully complete a thorough cybersecurity and contract review before being approved for use, after which they become part of our continuous risk monitoring program. Cybersecurity risks and potential costs are evaluated as a part of business operations, and the respective business impacts are continuously assessed to address evolving threats and vulnerabilities. We engage a third-party global firm to conduct an annual cyber assessment using the CSF, and we engage external vendors to validate our security controls and procedures through periodic penetration tests.

companyName: ALBEMARLE CORP

ticker: ALB


text: Additionally, the cybersecurity management team regularly consults with additional resources, to include attorneys, accountants, human resources personnel, and other information technology specialists, to determine materiality for cybersecurity related risks and incidents. There is an established Incident Response Plan that clearly identifies escalation measures based on the impact to our organization.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: We have established an Information Security Management Committee to manage information security in accordance with the ISO 27001 standard to ensure the consistent application of security principles, policy statements and controls. By adhering to this industry standard, we manage and mitigate material risks from threats to our systems and data through the following actions: • Partnering with reputable, recognized security firms • Conducting regular internal and external audits and risk assessments • Providing ongoing employee security awareness training • Conducting tabletop exercises • Running anti-phishing campaigns and simulated phishing exercise • Deploying tools for continuous vulnerability monitoring • Performing penetration testing and continuous system monitoring activities • Conducting recovery simulations for core systems and data centers Our comprehensive policies and procedures address critical areas including: • Vulnerability management • Business continuity planning • Encryption of sensitive data • Backup and recovery SUN COMMUNITIES, INC.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: At least annually, we conduct a cybersecurity risk assessment that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations of our environment by third parties and consultants). The results of the assessment are used to develop plans for, and prioritization of, initiatives to enhance our security controls, and to make recommendations to improve processes.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each participate in relevant discussions on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed, to the extent applicable.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: CRH's leadership team has also identified the Risk Committee, which is made up of our Chief Financial Officer, Group General Counsel, Chief Operating Officer and the Presidents of CRH Americas and CRH Europe, as the executive oversight body for risk management, including cybersecurity risks and the work of the CISO, GIS and related teams. The Risk Committee meets quarterly with the Head of ERM to assess risks facing CRH, and, on an as-needed basis, meets with other members of CRH management regarding cybersecurity risks and developments. The Risk Committee also reviews the half-yearly risk updates that are provided to the Audit Committee prior to dissemination.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: The Company maintains an enterprise monitoring and reporting program, which identifies key risk indicators for tracking and identifying trends. The key risk indicators are presented to the Company's Information Technology Committee ("IT Committee") and th e Board of Directors on a monthly basis.

companyName: Investar Holding Corp

ticker: ISTR


text: The Board is aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee is responsible for board-level oversight of cybersecurity risks. The Audit Committee reports back to the full Board about cybersecurity and other areas within their responsibility.

companyName: Titan Machinery Inc.

ticker: TITN


text: We have devoted, and expect to continue devoting, significant financial and personnel resources to maintain and improve our digital risk and security program.

companyName: Premier, Inc.


text: Cybersecurity Incidents: In our fiscal year ended June 30, 2025, we did not identify any cybersecurity incidents that have materially affected our business strategy, operations, or financial condition. We continue to monitor and seek to manage these risks proactively to protect the ongoing security and resilience of our organization. A cybersecurity incident could result in (i) an interruption in our services, (ii) the loss of ability to control or operate our equipment, (iii) misappropriation of personal data and (iv) the loss of critical data that could interrupt our operations, any of which could, among other things, adversely impact our reputation and brand and expose us to increased risks of violation of applicable law, governmental and regulatory investigation and enforcement actions, or private litigation or other liability, including potentially significant financial losses.

companyName: IREN Ltd

ticker: IREN


text: We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. We conduct and maintain a regular enterprise risk management program that is overseen by the audit committee of our board of directors, and efforts to address cybersecurity risks are an important component of our overall approach to enterprise risk management.

companyName: UPWORK, INC

ticker: UPWK


text: management and strategy engage and implement risk management strategies for identification and management of material risks rising from cybersecurity threats and alerts. Our method involves a systematic evaluation of all potential threats reported and discovered, vulnerabilities, and their possible impacts on the Company's operations, data, and systems health. Our cybersecurity risk management strategy includes: Identify the risk to our environment; to identify and resolve the threat; cybersecurity training to our staff; and cybersecurity incident response plan.

companyName: PORTSMOUTH SQUARE INC

ticker: PRSI


text: Annual risk assessments of our Information Security Program are conducted to identify emerging information security and third party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks. We also conduct independent audits on both the design and operational effectiveness of security controls and consult with external advisors on best practices to address new challenges.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: We invest in a comprehensive cybersecurity program that applies a recognized framework, utilizes industry standard tools, relies on expert partners, connects associates across the organization and leverages communication to protect our systems and our data.

companyName: US Foods Holding Corp.

ticker: USFD


text: The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The Investment Advisor engages a third-party IT provider who provides cybersecurity resources for the Investment Advisor and the Company. These resources include a dedicated monitoring platform that provides real time threat detection and mitigation. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Advisor.

companyName: Steele Creek Capital Corp


text: Our advisor's Information Technology Director has 15 years of prior management experience in digital technologies. He has nine years of experience in creating and implementing procedures for managing Payment Card Industries Security Standards (PCI), SOX Cybersecurity measures to include ransomware, email phishing, and data breaches, and bringing into effective action the five pillars of the NIST Cybersecurity Framework.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Board receives regular reports from management about the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents, including analysis of material security risks or information security vulnerabilities. Our Audit Committee directly oversees our Information Security Program. The Audit Committee is composed of Board members with diverse expertise, including risk management, technology, and finance experience, which provides them with the necessary qualifications to effectively oversee cybersecurity risks. The Audit Committee receives on a quarterly basis, or as needed, comprehensive updates from management on cybersecurity risks, including risk assessments, cybersecurity maturity assessments, progress of risk reduction initiatives, enhancements to cybersecurity programs and initiatives, business continuity planning, PCI compliance, any relevant internal or industry cybersecurity incidents, and compliance with regulatory requirements and industry standards, as applicable.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: As of the date of this Form 10-K, there have not been any cybersecurity incidents that have materially affected our business strategy, critical business operations, results of operations or financial condition. There can be no guarantee that our policies and procedures will be followed or, if followed, will be effective in protecting our systems and information. As such, this could impact, among other considerations, the execution of our business strategy and business operations, our financial condition and/or results of operations, and the security and effectiveness of our information technology systems. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, which should be read in conjunction with this Item 1C.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: While management is responsible for day-to-day risk management, the Board of Directors is responsible for the Company's overall risk oversight function, including cybersecurity risks, and includes oversight by several committees. The NGC, comprised solely of independent directors, supports the Board of Directors by overseeing cybersecurity risks, policies and objectives. As a part of its duties, the NGC regularly provides reports to the full Board of Directors.

companyName: PERRIGO Co plc

ticker: PRGO


text: Apart from the measures implemented to decrease the possibility of a material cyberattack being successful, we have created clear incident response protocols to deal with any cyber events that may arise. Our program provides for the coordination of different corporate functions and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any incidents. Testing, training and exercising of our incident response capabilities are carried out routinely and After Actions Reports are prepared to continuously improve these practices. We also have processes to evaluate potential disclosure, comply with applicable legal obligations, and mitigate reputational damage.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: In the last two fiscal years, we have experienced no material cybersecurity incidents, and the expenses we have incurred from any cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: DURECT CORP


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section entitled " Risk Factors —Failure in our information technology, storage systems or our clinical laboratory equipment could significantly disrupt our operations and our research and development efforts " included within this Report.

companyName: VOLITIONRX LTD

ticker: VNRX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, including professional services firms, cybersecurity consultants, managed cybersecurity service providers and penetration testing firms.

companyName: ENZO BIOCHEM INC


text: Under the ultimate direction of our Chief Executive Officer and our executive management team, with oversight from our Audit Committee of the Board of Directors ("Audit Committee"), we maintain a security governance structure to evaluate and address cyber risk. Our executive management team regularly consults with our third-party IT consultant who has expertise in cybersecurity to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements.

companyName: Motus GI Holdings, Inc.

ticker: MOTS


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. We have experienced, and may continue to experience, cybersecurity incidents that could have a material adverse effect on our business, financial condition, results of operations, and prospects. For example, in 2019, we were a victim of a wire fraud scheme, in which a fraudulent party compromised the email account of one of our employees and sent a fraudulent wire transfer request to our bank. We believe the bank did not follow its verification procedures and executed the wire transfer without our authorization. Please see Legal Proceedings section for more information. After this incident, we implemented multi-factor authentication (MFA) across all our systems and email accounts, to prevent unauthorized access and impersonation. We also enhanced our internal controls and training to prevent and detect wire fraud and other cyber risks.

companyName: urban-gro, Inc.

ticker: UGRO


text: Our cybersecurity risk management program includes an incident response plan ("IRP"). Our IRP provides us with a plan for identifying, responding to, reporting and remediating cybersecurity incidents. Our IRP has been established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. Our Information Services Breach Response Team ("ISBRT") takes a central role in developing and maintaining our incident response framework in coordination with our Cybersecurity Response Team ("CRT") that is dedicated to proactively addressing and managing potential breaches and incidents to ensure that our cybersecurity defenses are well designed and managed. Our Incident Management Team ("IMT") handles the response process for all cybersecurity incidents.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: The Company takes a layered approach to the governance of its cybersecurity risk management. The first line of defense against cybersecurity risk is the company's information security team, led by the CISO. This team is primarily responsible for promptly identifying cybersecurity risks associated with our existing and anticipated operations and, once identified, assessing as to the level that each cybersecurity risk poses to us, and then controlling or mitigating to the extent reasonably possible (in the context the Company's operations and resources, and competitive factors affecting how banks and other financial services companies conduct operations, among other things).

companyName: RENASANT CORP

ticker: RNST


text: Ongoing monitoring and evaluation of our cybersecurity posture and performance through regular vulnerability scans, simulated phishing tests, and penetration tests; Oversight of third -party service providers by conducting vendor due diligence upon onboarding and ongoing monitoring;

companyName: FutureFuel Corp.

ticker: FF


text: PPL has established an Executive Crisis Team comprised of PPL's executive leadership, including the Chief Executive Officer, Chief Financial Officer, Chief Human Resources Officer, Chief Legal Officer, Chief Operating Officer, VP – Public Affairs and Sustainability, VP – Corporate Communications, and additional officers as circumstances may warrant, to allow the company to respond quickly to a crisis, including a cyber event. This team governs and manages corporate crisis preparedness across the business lines, operations, and functions. Material or potentially material risks are escalated to the Executive Crisis Team and other appropriate leadership for review and action.

companyName: PPL ELECTRIC UTILITIES CORP


text: As part of the Company's overall risk management system, the Company has diligently protected and secured physical, virtual, and cloud assets. To defend against cybersecurity incidents, the Company has implemented cybersecurity monitoring tools for its virtual and cloud environments to monitor network traffic within the Company for abnormalities and for any potential intrusions. For the Company's user devices, the Company has implemented a software-based Zero-Trust virtual private network (VPN) and a software-based firewall to ensure the Company's data is protected. Additionally, the Company has deployed monitoring systems, multifactor authentication (MFA), and single-sign-on (SSO) to ensure user accounts are protected from external cybersecurity threats. The Company regularly monitors third-party service providers, such as those that provide cloud-based and VPN services, to identify and mitigate risks from cybersecurity threats.

companyName: ELECTRAMECCANICA VEHICLES CORP.


text: Our CFO is informed about and coordinates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the professionals on our cybersecurity team. In addition, we have an escalation process in place to inform our C EO and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: With respect to third-party service providers, we perform assessments of their information security capabilities prior to entering into a contractual agreement. We also perform periodic information security capabilities reviews for existing third-party service providers based on the risks identified in the initial review, or if events and circumstances necessitate a review.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer and internal security staff as part of the Board's continuing education on topics that impact public companies.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: In addition, LivaNova routinely engages with third-party service providers to conduct evaluations of its security controls, whether through penetration testing or consulting on best practices to address new challenges. The Company receives threat intelligence from industry peers, government agencies, industry-specific information sharing and analysis centers, and cybersecurity associations. The Company relies heavily on its supply chain to deliver products and services to its customers, and a cybersecurity incident at a supplier, subcontractor, or service provider could materially adversely impact the Company. The Company assesses third-party cybersecurity controls through its information security program and includes security and privacy addendums to its contracts where applicable.

companyName: LivaNova PLC

ticker: LIVN


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of sensitive customer and employee personal information, which if impacted by cyber threats could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management, and the Board on our response to a cybersecurity incident.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: Our Advisor has identified a Cyber Incident Response Team, or Response Team, who is responsible for providing appropriate oversight, strategic direction, and decision making for an event that potentially could cause a material impact to the business. The Response Team includes the Chief Financial Officer, Chief Compliance Officer and General Counsel, and our Vice President of Operations and these individuals are responsible for coordinating the incident response, including any required notification to the Audit Committee or Board of Directors.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our incident response processes include reporting to the Executive Compliance Committee, which includes our executive officers and leaders from the IT, compliance and legal teams, as well as to the Board for certain cybersecurity incidents.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: Our IT team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: Our global cybersecurity team helps ensure the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program. Programs to address key cybersecurity risks have been put into place including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations. We also employ automated detection and event correlation techniques and alerting as well as integrate cyber threat intelligence into our processes. Our security operations center serves as the front line of these alerts and investigates and remediates threats as necessary. We also perform regular vulnerability assessments and penetration tests. Although it is difficult to determine the potential impacts from a cybersecurity incident, we may experience negative impacts such as reputational harm, inability to retain existing customers or attract new customers, exposure to legal claims and government action, among others. Previous attacks on our operating systems have not had a material financial impact on our operations, but we cannot guarantee future attacks will have little to no impact on our business. Furthermore, given the interconnected nature of the supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks. The impact of a cybersecurity incident may have a material adverse impact on our financial condition, results of operations, availability of our systems, and growth prospects, which makes cybersecurity risk management of critical importance to our organization.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Our board of directors also works with the chief financial officer to assess and respond to cybersecurity threats. The chief financial officer meets with the third-party vendors regularly to discuss any issues and updates related to the Company's information technology environment and reports to the chief executive officer and Audit Committee on a regular basis, with a minimum frequency of once per year.

companyName: Enveric Biosciences, Inc.

ticker: ENVB


text: Risks from Cybersecurity Threats The Company's information and operational technology systems and its third-party providers' systems have been, and will likely continue to be, subject to cybersecurity threats, such as computer viruses or other malicious codes, ransomware, unauthorized access attempts, business email compromise, cyber extortion, denial of service attacks, phishing, social engineering, hacking and other cyberattacks attempting to exploit vulnerabilities.

companyName: ENTEGRIS INC

ticker: ENTG


text: Our information security team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through a variety of means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: It is management's judgment that the processes in place for monitoring cybersecurity risk, including the services provided by the IT consultant, are appropriate given the nature of our systems and our business. We have not encountered cybersecurity incidents or challenges that have materially affected or are reasonably likely to materially affect our company, strategy, results of operations or financial condition.

companyName: CKX LANDS, INC.

ticker: CKX


text: Company maintains an incident plan that addresses the Company's response to a cybersecurity event, which is periodically reviewed and updated.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: Our Board oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives in the areas of strategy, operations, reporting, and compliance without exposing the organization to undue risk. While our Board has the ultimate oversight responsibility for the risk management process, the Board Risk Committee also has responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Additionally, as part of our cybersecurity governance, we annually purchase cybersecurity insurance customary for companies in our industry. While our Board and the Board Risk Committee oversee our cybersecurity program, management is responsible for implementing the program.

companyName: HOPE BANCORP INC

ticker: HOPE


text: We engage in regular assessments of our infrastructure, software systems, and network architecture utilizing third-party cybersecurity professions, including annual penetration testing and audits of our information technology systems to identify vulnerabilities and areas for additional enhancement.

companyName: Bank7 Corp.

ticker: BSVN


text: The Company understands that the effective management of cybersecurity risks requires continuous assessment and improvement. Security benchmarking is a critical component to assess how well our security investments and processes compare with internal and external standards and objectives.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Use of Third Parties Oversight of Third-Party Service Providers The company uses third-party service providers to support its operations and many of its technology initiatives, and evaluates its third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following such evaluation, the company determines and prioritizes service provider risk based on the potential threat impact and likelihood, and such risk determination drives the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Security Committee.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: We have a cybersecurity program that is intended to assess, identify, and manage material risks from cybersecurity threats to our business. Our program includes policies and procedures for detection, assessment, response, mitigation, remediation, and reporting of cybersecurity incidents and threats. Overall, our cybersecurity program is a strategic component of our company-wide risk management framework and activities.

companyName: ROSS STORES, INC.

ticker: ROST


text: We use information technology and third-party service providers to support our global business processes and activities, which exposes us to cybersecurity risks. We have from time-to-time experienced cybersecurity incidents. In the event of a cybersecurity incident, we respond in accordance with our policies, processes, applicable laws, and regulations. When necessary, we also engage third parties, such as cybersecurity advisors, to assist in investigating and remediating incidents. To date, the cybersecurity incidents have not had a material effect on our business strategy, results of operations, or financial condition.

companyName: FOOT LOCKER, INC.


text: The Audit Committee reports to the full Board regarding Cybersecurity activities. The full Board also receives briefings from management on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from Cybersecurity threats. The team has primary responsibility for developing and maintaining our overall Cybersecurity risk methodology and supervises both our internal Cybersecurity personnel and our retained external Cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate Cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: JFB Construction Holdings

ticker: JFB


text: The Audit Committee is updated at least annually by the CFO on the status of cybersecurity matters. Contemporaneous reporting is provided on an as needed basis to the Audit Committee and to the full Board of Directors on significant cyber events including response, legal obligations, and outreach and notification to regulators, and third parties when needed.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: Company's Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats. Our senior management is responsible for the day-to-day management of the material risks we face. Our VP Of Information System is scheduled to report to the CFO on a weekly basis and the Audit Committee on a quarterly basis on cybersecurity matters to include updates on cybersecurity threat management, strategy processes, system updates and cybersecurity risks activities, including but not limited to any recent cybersecurity incidents and related responses. Our Board is also engaged in discussion with senior management and the Audit Committee at least on a quarterly basis on cybersecurity matters to discuss any updates to our cybersecurity risk management and strategy program. Each member of our Board has a working knowledge and/or experience with cybersecurity, IT strategy and IT risk assessment.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: PetMed Express, Inc. ("PetMeds") and PetCareRx maintains an enterprise-wide cybersecurity program designed to identify, assess, manage, and mitigate information security risks across the organization. Our program encompasses governance, policy, prevention, detection, incident response, and recovery mechanisms in alignment with industry standards.

companyName: PETMED EXPRESS INC

ticker: PETS


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Information Security Steering Committee ("ISSC") is responsible for oversight of matters related to information security and currently consists of professionals in legal operations and risk management, information governance, human resources operations, internal audit, computerized systems, global security and technical operations, and research technology, all whose input bring significant value when assessing and managing cybersecurity risk. Our ISSC meets periodically and is presented with an update on cybersecurity matters from our CISO. Our CISO is responsible for facilitating the implementation of the plans and decisions made by the ISSC and directly provides updates to the Audit Committee as detailed above.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely on our information technology (IT) and a number of complex business systems to assist with the management of our business and customer and supplier relationships, and a disruption of these systems, including from cyber-attacks, could adversely affect our business."

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Adviser, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Adviser and Apollo), including risk mitigation, compliance and controls.

companyName: Apollo Debt Solutions BDC


text: Our Chief Information Officer (CIO) has over 30 years of experience in cybersecurity and has primary management oversight of the Company's cybersecurity and cyber risk management activities. The CIO administers our cyber risk assessments, oversees ongoing risk management processes, and regularly reports to the Audit Committee. During fiscal 2025, the Audit Committee received regular briefings from the CIO on cybersecurity matters, including updates on current and emerging threats, progress on information security initiatives, assessments of the Company's cybersecurity program, and the results of internal and third-party evaluations.

companyName: Magnera Corp

ticker: MAGN


text: Our information security program aims to manage these cybersecurity risks and threats that we can reasonably anticipate using different methods, such as third-party assessments, internal IT audits, governance oversight, and risk and compliance reviews. We use various security tools designed to help protect our information systems from cyberattacks and to address any vulnerabilities or incidents in a timely manner, and we rely in part on third-party services to identify, prioritize, assess, reduce, and remediate cybersecurity threats and incidents.

companyName: ARKO Corp.

ticker: ARKO


text: Enhance logging, detection and response capabilities; and Revisit our risk assessments and incident response playbooks to address emerging threat vectors.

companyName: ALEXANDER TECH CORP


text: Process We have developed and continue to enhance our cybersecurity program to help secure our computer systems, software, networks, and data against material risks from cybersecurity threats, and help manage the material cybersecurity risks associated with our use of third-party service providers.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: We employ an in-depth, layered, defensive strategy that embraces a "security by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: We periodically assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity processes, and practices as part of our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our senior management, in consultation with our third-party information technology, or IT, vendor assesses risks based on probability and potential impact to our business and information systems and processes. Any identified risks that are considered high are monitored and tracked as part of our overall risk management program overseen by our board of directors.

companyName: Emmaus Life Sciences, Inc.

ticker: EMMA


text: Verizon's Management Audit Committee (VMAC), which includes our Chief Financial Officer, Senior Vice President of Internal Audit and other senior executives, is responsible for overseeing components of our overall risk management strategy. The VMAC receives quarterly updates from the CISO on Verizon's cybersecurity program.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: The Chief Technology Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security program and personnel and certain of our retained external cybersecurity consultants. She has over twenty-five years of experience in the technology industry. In addition, the Vice President of Engineering has involvement in managing cybersecurity risk and has over 30 years of experience in the technology industry.

companyName: Vroom, Inc.

ticker: VRM


text: Our Audit Committee assists the Board of Directors in its oversight of our policies, procedures and practices with respect to risk management and mitigation, including risks related to information security, cybersecurity, and data privacy and protection. The Audit Committee has delegated oversight of risks related to information security, cybersecurity, and data privacy and protection to its Information Security Subcommittee, which meets at least twice a year with our Senior Vice President, Information Technology and other members of our IT department to discuss our cybersecurity profile and related risks, as well as to discuss updates on relevant developments in the cybersecurity threat environment. The Information Security Subcommittee reports to the Audit Committee following each subcommittee meeting, and the Audit Committee reports to our Board of Directors.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: The Bank's cybersecurity risk management framework for assessing, identifying, and managing risks from cybersecurity threats is designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data and include specific controls for the monitoring, mitigation, and reporting on cybersecurity risk management. Those processes include information security policies, incident response and business continuity plans focusing on the Bank's appropriate response to threats and incidents and operations and business continuance.

companyName: Federal Home Loan Bank of Atlanta


text: All employees undergo security awareness training, with regular testing through simulated phishing emails. Certain employee positions require additional role-based, specialized security awareness or other cybersecurity training, as applicable. Simulations, drills and assessments are conducted to test our defenses from both a technical and an operational perspective.

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: Data encryption at rest and during transit and immutable data backups; and Business continuity, disaster recovery and incident response plans.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: As part of its broader risk oversight activities, the Board oversees risks from cybersecurity threats, primarily through delegation to the Audit Committee. As reflected in its charter, the Audit Committee assists the Board in reviewing our significant cybersecurity matters and concerns. The Audit Committee engages on cybersecurity matters with our management team, including our Vice President of Trust Engineering, who regularly provides presentations to the Audit Committee on our cybersecurity program and cybersecurity risks. These presentations address a range of topics including, for example, the threat landscape and cybersecurity events, vulnerability assessments, incident preparedness assessments, disaster recovery plans, and cybersecurity awareness training. Two additional members of our Board, who have cybersecurity experience but are not members of the Audit Committee, are invited to attend Audit Committee meetings when review of our cybersecurity program is on the agenda. In addition, the full Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight.

companyName: ROKU, INC

ticker: ROKU


text: As of December 31, 2024, the Company has not identified an indication of a cybersecurity incident that would have a material impact on the Company's business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: In the normal course of business, we may collect and store certain sensitive company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. Our access control policies are based on the principle of least privilege, limiting user access strictly to what is required for their roles. Additionally, we have general measures to identify potential threat actors, including the implementation of two-step verification processes to confirm the identity of all counterparties.

companyName: STRATEGIC ACQUISITIONS INC /NV/

ticker: STQN


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats, and has appointed a chief information security officer to lead our global cybersecurity organization for this purpose. Our executive management team and key members of our broader finance, legal, tech and operations organizations receive detailed monthly briefings from our chief information security officer on the status of our cybersecurity program and our readiness to prevent, detect, mitigate and recover from cybersecurity incidents.

companyName: COPART INC

ticker: CPRT


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over twenty years of experience in technology and information security and has served as Fidelity's CISO since May 2021. The CCO has been responsible for this oversight function as CCO to the Fund since the Fund's inception and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.

companyName: Fidelity Private Credit Co LLC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CIO and CISO, who are supported by other members of management, as necessary. Our CIO and CISO are responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. Our CIO has served in this role for four years and has more than twenty-nine years of relevant experience, including previous roles as the CIO for two companies and the divisional information technology leader for two companies. Our CISO, who reports to the CIO, has served in this role for three years and has more than twenty-nine years of relevant experience, including a focus on information security and cybersecurity for the last sixteen years. He previously served as the CISO for another automotive supplier. In addition, our CISO is engaged with the cybersecurity community through current and past involvement with organizations such as Automotive Information Sharing and Analysis Center, Michigan Infragard, Domestic Security Alliance Council and the European Association of Automotive Suppliers cybersecurity workgroup. In addition, we have an information security team comprised of dozens of experienced employees who address cybersecurity matters. The CIO and CISO are also responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating cybersecurity incidents.

companyName: LEAR CORP

ticker: LEA


text: The SOMC and SRMC are comprised of senior leadership and executive-level officers, including FHLBank's CRO and CIO. The SOMC is responsible for receiving reports on issues escalated from the Technology Committee. The SRMC is responsible for management of operational risk and implementation of the cybersecurity risk management framework within the ERM Program as approved by the board of directors and receives reports on issues escalated from the ORC.

companyName: Federal Home Loan Bank of Topeka


text: Cybersecurity Risk Management We, like other companies in our industry, face cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Inrad Optics, Inc.


text: With regard to personal information protection regulations and cybersecurity-related laws and regulations in various countries, in addition to current regulations, Honda collects and monitors information on regulatory trends that are expected to be enforced in the future. Data security incident response plans have been established at AHFC and HCFI that guide the analytical processes, response phases, and procedures to follow during a data security incident of personally identifiable information.

companyName: AMERICAN HONDA FINANCE CORP


text: The Audit Committee of the Board is charged with overseeing our cybersecurity risk management program. The CRC Chair and the CISO provide the Audit Committee with quarterly updates. These updates cover the overall status of the Company's cybersecurity program, as well as developments and potential new risks and trends. In the event of a significant cybersecurity threat or incident, the CRC would escalate communication frequency and intensity with the Audit Committee, Board, and the Company's Executive Committee (discussed below).

companyName: REGENCY CENTERS LP


text: The Company depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Company's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Company. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Company further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Company's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Company's use of such entities.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: T he Audit Committee of the Board of Directors oversees risks from cybersecurity threats, including through quarterly reports to the Audit Committee by the Company's CISO and CIO and, as needed, special reports to the Audit Committee and/or the Chairperson of the Audit Committee. The Audit Committee includes members with technology and cybersecurity experience and certifications, including a Committee member with over 28 years of experience working for Hewlett Packard Enterprise Company and a Committee member with a Computer Emergency Readiness Team ("CERT") Certificate in Cybersecurity Oversight issued by the CERT Division of the Software Engineering Institute at Carnegie Mellon University and completion of the National Association of Corporate Directors Master Course in Cybersecurity.

companyName: CARTERS INC

ticker: CRI


text: Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: We may not currently be sufficiently protected against cybersecurity risks. Our existing resources may be insufficient to adequately protect us against, or to investigate and remediate any vulnerability from, cybersecurity incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our operations, business strategy or financial condition.

companyName: MOBIX LABS, INC

ticker: MOBX


text: The Management Company's cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of its ongoing cybersecurity vulnerability management, and it endeavors to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to its networks and applications, along with detection of potential unusual activity within its networks or applications. Any potential cybersecurity incident is immediately reported to the President and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: Third-Party Cybersecurity Risk Oversight Our cybersecurity risk management program extends to oversight of third parties that pose a cybersecurity risk to us, including lenders that use our systems and third-party service providers. In alignment with the NIST Cybersecurity Framework and FHFA regulatory guidance, we have established a risk-based framework for managing third-party risk that defines specified triggers for assessing and reporting cyber-related third-party risks and events. Pursuant to this framework, we have implemented both preventive and detective controls to mitigate cybersecurity risks posed by third parties.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have established strong governance practices to oversee cybersecurity and IT risks. The Board of Directors has delegated primary oversight responsibility for cybersecurity to the Risk Management Committee (RMC) of the Board, which is composed of several Board members. Our Chief Information Officer (CIO) and Information Security Officer (ISO) receive security reports and threat intelligence from the Security Operations Center, which apprises the CIO and ISO of any potential incidents and the status of ongoing preventive measures and they share this information at least quarterly with the RMC. They also brief the full Board as needed on cybersecurity matters.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing including disaster recovery exercises.

companyName: QXO, Inc.

ticker: QXO


text: Our PCO is an experienced embedded systems engineer and chief engineer with nearly 20 years' experience in the development, product assurance, and security of critical and highly regulated embedded and other computer systems in medical, aviation, and military products and services. In performing her role, she regularly reviews cybersecurity risks, controls, program policy and processes, including training, and oversees and advises teams performing policy and program development, implementation, and updates. Our PCO is regularly apprised of product and service cybersecurity events, threats, and activities including with respect to incidents, protection vulnerabilities, software update needs, and lifecycle status.

companyName: RTX Corp

ticker: RTX


text: The Information Security Program is overseen by the Company's Chief Information Security Officer (CISO), who reports directly to the Chief Risk Officer. The CISO is responsible for the implementation, maintenance, and enforcement of the Information Security Program and related policies and standards. The program is evaluated and adjusted at least annually based on the results of testing, monitoring, and the adoption of best practices. Reporting occurs annually on the status of the Information Security Program to the Board's Risk Management, Capital & Compliance Committee. Reporting includes the overall status of the program, material matters related to the program, Key Risk Indicators ("KRIs"), cyber risk assessments results, emerging risks, risk management and control decisions, control testing results, third party security assessments, penetration test results, security breaches or violations, and recommendations for changes to the program.

companyName: Beacon Financial Corp

ticker: BBT


text: The Chief Information Officer ("CIO") is a peer to the CSO, also reports to the CFO. The CIO and his team are responsible for executing cybersecurity risk mitigation plans. Zebra's current CIO was appointed to the role in 2022 and has nearly 20 years of experience in managing IT functions.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems. Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.

companyName: ROSS STORES, INC.

ticker: ROST


text: We have three management-level committees that support our cybersecurity, privacy and data governance efforts. They are led by our Data Security and Privacy Governance Committee, which provides management-level governance over cybersecurity matters, including discussion of cybersecurity priorities, emerging risks, awareness and training programs, risk mitigation efforts, and regulatory compliance. This committee is chaired by our Vice President – Internal Audit and Corporate Compliance and is composed of a cross-functional team of senior leaders, including our CEO. The committee generally meets quarterly and is supported by our Security and Technology Risk Leadership Committee and our Privacy and Data Governance Committee. The activities of the Data Security and Privacy Governance Committee are reported to the Board or the Audit Committee by the Chair of the committee, as appropriate.

companyName: HOME DEPOT, INC.

ticker: HD


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over four years and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: GOLUB CAPITAL DIRECT LENDING CORP


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

companyName: BOISE CASCADE Co

ticker: BCC


text: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;

companyName: Stereotaxis, Inc.

ticker: STXS


text: On an on-going basis, our information technology systems are monitored for anomalies, vulnerabilities and misconfigurations. Furthermore, all employees are required to take an annual security awareness training, with additional role-specific training for employees involved in security and risk management. With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures, and we perform vendor assessments, including their ability to protect data from unauthorized access.

companyName: Thoughtworks Holding, Inc.


text: Service Providers. Like many companies, we rely on third-party vendor solutions to support our operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, we maintain a Third-Party Risk Management Program, which is implemented through a Vendor Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive data. The Vendor Management Policy applies to any business arrangement between Cullman Savings Bank and another individual or entity, by contract or otherwise. The Vendor Management Program is audited as part of our annual Internal Audit Risk Assessment.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Operationally, the information security team employs numerous security tools such as threat detection, alerting and monitoring, data loss prevention, vulnerability remediation, anti-malware and email security protections. Consistent with our Business Continuity and Security Incident Response Policies, the Company engages in annual disaster recovery and information security tabletop exercises to simulate threats and events, and engages third-parties on an annual basis to conduct and report on penetration testing exercises. We administer mandatory annual security awareness training, routine employee email phishing testing, and provide regular updates across the Company to highlight recent examples of risks as they are identified.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: The Board of Directors receives periodic training related to cyber security and is responsible for approval and oversight of management's policies governing information system security and cybersecurity threats and incidents, as well as oversight of management's approach to secure our information systems. The Board of Directors delegates the primary oversight of risk management to the Bank's Audit Committee.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: We have established a process for management, including our Vice President, Head of Information Technology and Chief Financial Officer, to report to the Audit Committee on potential major cybersecurity risks, their potential impact on us, and the steps we take to manage them. The Audit Committee considers identified cybersecurity risks and the steps that the Company's management has taken to monitor and control such risks in connection with the Audit Committee's discussion of the Company's risk assessment and management guidelines, as appropriate. The Audit Committee has periodically reviewed and discussed the Company's cybersecurity risks, including the Company's information security and risk management programs, controls and procedures, as well as high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential security incidents.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls set by organizations such as the National Institute of Standards and Technology cybersecurity framework and the International Organization for Standardization;

companyName: 5&2 Studios, Inc.


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use industry standard frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We use an overall risk management process by coordinating with other departments such as human resources, legal, finance, accounting, and business operations.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: The Company's cybersecurity framework encompasses a proactive approach towards potential threats, focusing on prevention, detection, response, and recovery. Our cybersecurity risk management program is integrated into our overall risk management framework and shares common reporting channels and governance processes that apply across the risk management framework to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; and • a global incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: We contract with a third-party vendor who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by bank employees, customers, intrusion detection systems, third-party servicers, or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the IRTC.

companyName: CapStar Financial Holdings, Inc.


text: The Audit Committee receives regular reports at least twice annually from our Chief Information Security Officers ("CISO") on a wide range of cybersecurity topics, including our cybersecurity program's performance, results of assessments, emerging threats, capability enhancements, and recent developments and trends.

companyName: Crane NXT, Co.

ticker: CXT


text: Management is responsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its Audit Committee, oversees risk management, including cybersecurity risks.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: The Audit Committee is responsible for oversight of our cybersecurity program and related exposures and risks. The Audit Committee periodically reports to the full Board and consults with the Risk & Finance Committee on such matters. The Audit Committee's review and oversight generally encompasses data breach risk and impact, cyber protection and detection controls, privacy matters, third-party risks (including risks from cybersecurity threats associated with any third-party service providers), cyber trends and events, and other topics. The Risk & Finance Committee is responsible for oversight of risk generally and identifying significant risks, which may include risks relating to cybersecurity and privacy, business continuity risk (including the resilience of IT operations and physical infrastructure) and cyber underwriting risk. The oversight responsibilities of the Audit and Risk & Finance Committees with respect to cyber security and information technology risks are each set forth in their respective charters. Members of management, including our Chief Information Security Officer (CISO) and Global Chief Technology Officer (CTO), regularly provide updates to these committees in person and through written reports. The Audit and Risk & Finance Committees also conduct a joint meeting on ERM matters, which includes coverage of strategic risk priorities, as well as Chubb's actions and mitigation efforts in response to such risks.

companyName: Chubb Ltd

ticker: CB


text: Processes for managing cybersecurity risks The cybersecurity team tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, the cybersecurity team oversees mitigation plans with the risk owner. The plans communicated to necessary teams and remediation steps are taken.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: At least annually, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Financial Officer. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: NETLIST INC

ticker: NLST


text: The executive management team is also responsible for overseeing and identifying risks from cybersecurity threats associated with our use of any third-party service providers.

companyName: Dror Ortho-Design, Inc.

ticker: DROR


text: As part of our overall risk management system, we provide periodic mandatory training for personnel regarding cybersecurity threats as means to equip our employees with information and tools to address cybersecurity threats, and to communicate our information security policies, processes and practices. We also perform periodic email phishing tests to evaluate and maintain cybersecurity awareness among our employees.

companyName: AMBARELLA INC

ticker: AMBA


text: At Progyny, cybersecurity risk management is an integral part of our broader risk management system and processes. Our cybersecurity risk management program incorporates industry-standard frameworks, policies and practices designed to protect the security of our technology infrastructure and sensitive information.

companyName: Progyny, Inc.

ticker: PGNY


text: We rely heavily on third party service providers for our clinical development activities and cloud-based documentation and communications. A cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. We do not currently have a formal process in place for evaluating or reviewing third party vendor cybersecurity risks and procedures and rely on such third parties to implement adequate protectionary and detection measures.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: As part of our comprehensive risk management program, our cybersecurity risk management program includes methodologies, reporting channels and governance processes that apply across the enterprise to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Arteris, Inc.

ticker: AIP


text: The management team plays a crucial role in the cybersecurity process by setting the tone for the organization's approach to cybersecurity and ensuring that it is integrated into the overall business strategy. Key responsibilities of Microvast management in cybersecurity include: • setting security objectives: establishing clear security objectives that align with the organization's overall goals and risk tolerance. • resource allocation: ensuring sufficient resources, including budget, personnel, and technology, to effectively manage cybersecurity risks. • policy development: ensuring security policies and procedures align with industry standards and best practices. • risk Management: overseeing the organization's risk management program including conducting regular risk assessments and implementing controls to mitigate identified risks. • incident response: Providing oversight and ensuring that the organization has an effective incident response plan that has been tested and employees trained on how to effectively respond to cybersecurity incidents promptly and appropriately. • compliance: ensuring that the organization complies with relevant and applicable cybersecurity regulations and standards and stays abreast of emerging threats and best practices.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: Protection: Estrella employs Exchange Online Protection (EOP) for email filtering, Data Loss Prevention (DLP) to prevent accidental sharing of sensitive information, and basic email encryption to secure communications.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: As part of the above processes, we at least annually engage with assessors, consultants, and other third-parties, including by having an independent Qualified Security Assessor review our cybersecurity program quarterly to help identify areas for continued focus and enhancements regarding Payment Card Industry compliance. These third parties conduct penetration tests and scanning exercises to assess the performance of our cybersecurity controls, systems and processes and overall maturity by NIST categorization. As part of the assessment, they also conduct interviews with key personnel and review key controls. In addition, annually we review our cyber insurance premiums which includes a maturity assessment and the premiums are determined based on the Company's cybersecurity maturity assessment score.

companyName: Warner Music Group Corp.

ticker: WMG