text: The Company has an internal committee that is responsible for conducting regular assessments of its information systems, existing controls, vulnerabilities and potential improvements.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Forza X1, Inc.

secItem: Item 1C


text: We have implemented incident response and business continuity and resilience plans for our operations, which are regularly tested with respect to our business-critical infrastructure and systems. We employ data backup procedures that seek to ensure that our key business systems and data are regularly backed up, and can be restored promptly if, and as needed. In addition, we generally store backup information at off-site locations, in order to seek to minimize our risk of loss of key data in the event of a disaster. Our recovery plans involve arrangements with our off-site, secure data centers and cloud infrastructure. We believe we will be able to utilize these plans to efficiently recover key system functionality in the event that our primary systems are unavailable due to various scenarios, such as natural disasters.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: Based on information known to us, we do not believe any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.

companyName: Edwards Lifesciences Corp

ticker: EW


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have only begun to conduct comprehensive risk assessments, establish an incident response plan, and engage with external cybersecurity consultants for assessments or services. As of the date of this report, we have adopted an incident response plan which governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors. Our Chief Executive Officer has been designated as the lead for implanting our incident response plan.

companyName: MDWerks, Inc.

ticker: MDWK


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by a team that includes our Chief Information Security Officer ("CISO"), who reports to our Vice President ("VP") of Information Systems. The CISO is supported by a SOC team, an Incident Response Manager, a Governance Risk and Compliance Manager, and cybersecurity architects. These individuals and groups are responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure our cybersecurity program functions effectively in the face of evolving cybersecurity threats. The individuals involved generally have significant experience in cybersecurity and related information technology, including responding to incidents and developing security policies, with our three most senior leaders having an average of 25 years of experience in cybersecurity. In addition to the day-to-day management of these risks, we hold a monthly meeting of an Information Risk Committee, which is comprised of representatives from our legal, human resources, compliance, and information technology departments. On a quarterly basis, we also hold a meeting of our Executive Information Technology ("IT") Steering Committee, which is comprised of members of the executive leadership, so that they can receive regular briefings on cybersecurity matters, including threats, events, and program enhancements.

companyName: Keenova Therapeutics plc


text: Our Senior Leadership Team's Qualifications Our current Chief Information Security Officer has served in various roles in information technology and information security for over 15 years, including as the Director of Information Security at the Colombian operations of a telecommunications company operating throughout Latin America and as the Head of Information Security in the Colombian operations of a large retail company operating in South America. Our Chief Information Security Officer holds undergraduate, graduate and master's degrees in risk management, business administration and information technology, as well as professional certification as a Certified Information Security Manager.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee has duties and responsibilities with respect to the oversight of the Company's cybersecurity risk protocol (which includes oversight of risk assessment, risk management plan and process to control/monitor, business continuity plan, incident response, and disaster recovery).

companyName: Chiron Real Estate Inc.

ticker: XRN


text: We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have implemented mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: The Company maintains a Cybersecurity Incident Response Plan (CIRP) providing a framework for identifying, evaluating and escalating potential or actual cybersecurity events. The CIRP assigns responsibilities and provides a workflow between the Company's IT security department; members of an Executive Cybersecurity Committee comprised of the chief executive officer and senior management; and the board of directors regarding the detection, assessment and response to a cybersecurity event.

companyName: RLI CORP

ticker: RLI


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk factors related to information technology and cybersecurity" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cyberattacks, data security incidents or other failures in our telecommunications or information technology systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption, legal liability, damage to our reputation, and significant disruption of our business operations which could materially affect our operating results, financial condition, and business."

companyName: Atai Beckley N.V.

ticker: ATAI


text: Our cybersecurity risk management program includes the following key elements, among others: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: We have insurance coverage for losses and expenses related to liability, privacy and regulatory actions, incident response, business interruption, data recovery, hardware replacement, extortion, and reputational harm arising from potential cybersecurity incidents.

companyName: International Seaways, Inc.

ticker: INSW


text: Our board of directors and our audit committee are actively engaged in the oversight of our global cybersecurity program. Our audit committee receives regular, quarterly reports on these matters from our CSO and leadership from our global product and technology organization, including on the status of projects to strengthen the company's cybersecurity systems and improve cyber readiness, as well as on existing and emerging threat landscapes. Concurrent and in addition to these reports, our chief administrative officer ("CAO") (who oversees legal, security and compliance matters) provides a legal, regulatory and ethics update at each meeting of the audit committee of our board of directors, which includes matters of cybersecurity, as appropriate. In addition, important actual or emerging cybersecurity events are communicated to the board of directors by our CAO and Chief Legal Officer, even if immaterial to us.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: The Company's CISO directs the company's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is also responsible for the Company's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CISO, the Information Security team examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. In 2023 our CISO reported to our CIO; however, for 2024 the CISO will report to our CRO, who in turn reports to our CEO.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. Our cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the DOE to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of our security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, we have established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: elements of our cybersecurity risk management program include: assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; our external service providers, where appropriate, to assess, test, monitor or otherwise assist with aspects of our security controls;

companyName: Biofrontera Inc.

ticker: BFRI


text: We maintain an extensive presence with cybersecurity threat operations functioning continuously and uninterrupted with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.

companyName: BOYD GAMING CORP

ticker: BYD


text: The Company uses third-party assessors, auditors, and consultants to independently evaluate security practices through penetration testing, vulnerability assessments, and vendor evaluations. Despite these measures, the Company acknowledges that cybersecurity incidents cannot be fully prevented.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: In order to manage identified cybersecurity risks, we evaluate a range of remediation options and determine the appropriate course of action for effective monitoring, mitigation and treatment. Areas that have a higher level of likelihood and potentially higher level of impact are prioritized. Periodic monitoring, self-assessment and reporting to the Audit Committee are performed by senior management to evaluate, among other things, the effectiveness of mitigation strategies in minimizing or managing identified risks. In addition to critical risk management, we work to upgrade our existing technology systems, enhance our overall security posture and provide employee training around cyber risks, which are constantly evolving.

companyName: Frontier Communications Parent, Inc.


text: We completed our forensic investigation on December 13, 2023. We determined that an unauthorized third-party accessed certain of our systems, deployed a type of malware that is not self-propagating and exfiltrated certain data. We have no evidence that any customer-owned system was directly impacted in the incident, and no customer has reported that this has occurred. The last confirmed date of unauthorized third-party activity in our network occurred on November 20, 2023.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Role of the Board Dow's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. The Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee of the Board. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders, including the Chief Information and Digital Officer and Chief Information Security Officer, with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with significant experience and/or expertise in technology or cybersecurity, including information systems.

companyName: DOW INC.

ticker: DOW


text: We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "A cyber-attack or security breach could cause a loss of confidential consumer data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, common law and other legal theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, adversely impact our financial results, and otherwise be disruptive to our business." included in Part I, Item 1A of this Form 10-K.

companyName: Addus HomeCare Corp

ticker: ADUS


text: Although we develop and maintain processes and tools designed to prevent cybersecurity threats from occurring, and to identify and mitigate threats, the possibility of these events occurring cannot be eliminated entirely. As we engage in more electronic transactions, rely more on cloud-based information systems, and utilize outside vendors or service providers that have access to our electronic information, the related security risks will increase, and we will likely need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our information technology systems will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.

companyName: XBiotech Inc.

ticker: XBIT


text: The capital allocation and risk management committee of the Company's Board of Directors assists the Board in the periodic review and evaluation of the Company's risk profile and related risk management processes which identify and manage the Company's key financial, strategic and operational risks. The audit committee of the Company's Board of Directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. Further, our CIO reports on cybersecurity matters, including material risks and threats, to the Company's audit committee on a quarterly basis, and the audit committee provides updates to the Company's Board of Directors at regular board meetings. In addition, the audit committee and capital allocation and risk management committee hold a joint meeting annually during which the CIO provides a comprehensive update regarding the assessment and management of material cybersecurity risks. Our CIO also provides updates as appropriate to the Company's Board of Directors.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Our CISO has 43 years of experience in a diverse array of information and security technologies and has managed various domains, with expertise in enterprise resource planning, finite scheduling, middleware technologies, network control, operational control, identity access and governance and data center management. He and our other dedicated cybersecurity personnel collectively hold numerous certifications, including in relation to forensic investigation, threat hunting and digital forensics, risk and information system controls, Google cybersecurity, information security auditors and fraud examiners. Additionally, the collective cybersecurity team members have substantial experience in information technology disciplines and prioritize remaining educated on current threats.

companyName: Pactiv Evergreen Inc.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Specifically, our Security Steering Committee ("SSC"), a cross-functional team of employees chaired by our CIO, is responsible for providing strategic guidance and execution oversight to Amwell's privacy, risk and security programs and policies. Management has instituted an Information Security Management System ("ISMS"). The ISMS establishes risk-based safeguards that are designed to adequately protect the Company and information acquired through business operations. Amwell maintains its ISMS in accordance with ISO 27001 standards. Amwell is audited annually by a third-party assessment firm that determines the effectiveness of the procedures and processes of its ISMS. Amwell also self-assesses the performance and effectiveness of the ISMS through monitoring, measurement, analysis, and evaluation of controls and control objectives. The SSC ensures the workforce complies with the ISMS policies, procedures and controls through many channels, including annual review of audit and risk assessment results, multifactor authentication, annual employee training and company-wide communications.

companyName: American Well Corp

ticker: AMWL


text: We will engage consultants or other third parties in connection with our risk assessment processes. These service providers will assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: We are committed to protecting the confidentiality, integrity, and availability of our information assets and managing cybersecurity risks effectively. Our cybersecurity strategy focuses on proactive risk management, continuous improvement, collaboration and partnerships, and investment in security technologies.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: Our cybersecurity processes have been integrated into our overall risk management processes, and we engage assistance from third parties as we deem necessary or appropriate. We believe that we have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party services providers to our business.

companyName: Fathom Digital Manufacturing Corp


text: Our board of directors has approved committees including the Risk Committee, which oversees overall risk management activities and policies including those related to technological and cybersecurity risks, and the Technology Committee, which oversees the Company's technology strategy and approach to technology-related risks. The Risk and Technology Committees of the board are comprised of independent directors and receive regular reports from management, including the Chief Information Security Officer and Chief Risk Officer, on risk management, cybersecurity risks, actions taken to mitigate them, and technology and risk strategies. The Technology Committee reviews and approves our information security and technology budgets, policies, and strategies quarterly. The Risk Committee reviews our technology and cybersecurity risk profile on a regular basis.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: Our Information Security Program is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). Our CISO oversees the third-party consultants who help assess our security controls and penetration testing previously described. The CTO provides oversight, leadership and direction for data risks, technology risks and information security risks. Our CISO leads the Cybersecurity organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: Although we have experienced minor cybersecurity incidents in the past, as of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our internal computer systems, or those of any of our current or future collaborators and strategic partners or other contractors or consultants, may fail or suffer security breaches, which could result in a significant disruption and our ability to operate our business effectively."

companyName: Finch Therapeutics Group, Inc.

ticker: FNCH


text: The Company maintains a risk-based approach to identifying and overseeing risks from cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party system s.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our Board of Directors oversees the Company's risk management strategy with respect to cybersecurity threats as part of its general oversight function. The Board of Directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Grindr Inc.

ticker: GRND


text: A robust cybersecurity program to protect our assets from cyber and information security threats is critical to managing risk effectively. Our cybersecurity program is designed to align with internationally recognized information security standards and best practices. Our multi-layered data protection and information security programs and practices are designed to ensure the safety, security and responsible use of the information and data our stakeholders entrust to us. The approach blends defense-in-depth and zero-trust principles. Our cybersecurity program is periodically informed and assessed by third-party assessments and advice regarding best practices from consultants, business partners and advisors and incorporates benchmarking and other data from peer companies. We have processes for evaluating (among other things) the data protection and information security infrastructure of our third-party providers (including examining any relevant records such as service organization controls reports), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement.

companyName: Greenbacker Renewable Energy Co LLC


text: We assess and identify security risk to the organization by: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems and the related information processes, stored, or transmitted; • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by IT senior leadership, including the Company's Senior Vice President of Information Technology (SVP-IT); • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended, and producing the desired outcome; and • periodically scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: We rely on various third-party providers, such as vendors, suppliers and other business partners for certain aspects of our operations. These third parties are also susceptible to cybersecurity risks. We conduct due diligence on the cybersecurity practices and controls on these providers and include provisions in our contracts requiring appropriate cybersecurity measures. In addition, in the case of a third-party cybersecurity incident, we identify and mitigate risks to minimize impacts to us from third-party incidents.

companyName: Science Applications International Corp

ticker: SAIC


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. In the past three years, we have not experienced a material information security breach but may in the future. See Risk Factors in Part I, Item 1A in this Form 10-K for additional information.

companyName: W&T OFFSHORE INC

ticker: WTI


text: Protection Mechanisms. We currently adhere to the ISO 27001 information security framework and are advancing our program having achieved ISO 27001 certification in 2024. We continuously monitor our enterprise network and have deployed detective and preventative controls. In-depth third-party security assessments are conducted annually.

companyName: Ingevity Corp

ticker: NGVT


text: The Audit and Risk Committee ("Audit Committee") has oversight responsibility for risks and incidents relating to cybersecurity, including compliance with regulatory requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee receives regular briefings on our cybersecurity posture, cybersecurity trends and cybersecurity risks from management and, if they occur, is briefed regarding any material cybersecurity incidents. The Audit Committee reports any findings or recommendations to the Board, as appropriate.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: Risks from Cybersecurity Threats Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems; result in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; and/or jeopardize the security of our facilities. These risks are further described in the risk factors within Item 1A, particularly under the headings "We may be subject to risks relating to our information technology and operational technology systems", "We currently rely on third-party service providers for many of the critical elements of our global information and operational technology infrastructure, and their failure to provide effective support for such infrastructure could increase our cybersecurity risk or otherwise negatively impact our business and financial results", and "Disruptions or breaches of our information systems could adversely affect us."

companyName: Allegion plc

ticker: ALLE


text: The Board's Risk Committee is central to the Board's oversight of cybersecurity risks and bears the primary oversight responsibility for this domain. The Risk Committee is composed of Board members with diverse expertise, including audit and finance and technology experience, equipping them to oversee cybersecurity risks effectively. The Risk Committee actively participates in strategic decisions related to cybersecurity, offering review and guidance on, among other things, program design, the Company's cybersecurity risk profile and the effectiveness of its risk management strategies.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Company's board of directors is collectively responsible for oversight of risks from cybersecurity threats. The Company's executive officers oversee the overall processes to safeguard data and comply with relevant regulations and will report material cybersecurity incidents to the board of directors. The Company's CEO has more than 15 years of experience in the field of information technology with a focus on software development. Some of his experience and knowledge relates specifically to cybersecurity. Other executive officers of the Company have more limited experience in the area of cybersecurity. When and where necessary in the view of the Company's executive officers, the Company will consult with external advisers to manage and remediate any cybersecurity incidents. For material cybersecurity incidents, the Company's executive officers will promptly inform, update, and seek the instructions of the board.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: Effects and Impacts of Cybersecurity Risks As announced on October 28, 2023, we identified a cybersecurity incident impacting certain internal operations and information technology systems which adversely affected our ability to ship orders in the first quarter of fiscal 2024. All of our facilities were operational by mid-December 2023 and were returned to normalized operations. We incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024. Additionally, we have invested and intend to continue to invest in strengthening our systems, cybersecurity training, policies, programs, response plans and other similar measures. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. For information regarding cybersecurity risks that may materially affect us, see the risk factors titled "If we do not successfully maintain our information and technology networks, including the security of those networks, our operations could be disrupted and unanticipated increases in costs and/or decreases in sales could result," and "We may fail to effectively manage confidential data, which could harm our reputation, result in substantial additional costs and subject us to litigation" as well as "Cyberattacks and security vulnerabilities could lead to reduced sales, increased costs, liability claims, unauthorized access to customer data or harm to our reputation" under "Risk Factors" in Part I, Item 1A to this Annual Report on Form 10-K.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design an effective layer of controls as a baseline. We regularly conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our systems, networks, and data infrastructure to identify vulnerabilities and potential threats. Our cybersecurity program also includes a dedicated function for third party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process sensitive information. In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives aim to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and regular communications about cybersecurity topics and threats.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: We have developed and implemented a comprehensive multi-layered cybersecurity risk management program, consisting of a dedicated cybersecurity function, risk assessments, policies and procedures managed by internal and external resources, that we believe is reasonably designed to prevent, detect and respond to cyber risks and incidents. We utilize a set of tools and services, including regular network, endpoint and cloud monitoring, vulnerability assessments, penetration testing, SIEM, and tabletop exercises to identify and assess material risks from cybersecurity threats and to evaluate our cyber defense capabilities.

companyName: ENTERPRISE BANCORP INC /MA/


text: Technical Safeguards: We deploy a multi-layered defense system with various technical safeguards to protect our infrastructure and user data. This includes firewalls, intrusion detection and prevention systems (IDS/IPS), data encryption (at rest and in transit), and access controls based on the principle of least privilege.

companyName: Mega Matrix Corp.


text: Our Board of Directors, in coordination with the Audit Committee of the Board of Directors (the Audit Committee), is responsible for overseeing our risk management and information technology programs of which cybersecurity is a critical element. Management is responsible for the administration of our cybersecurity policies, standards, procedures and practices. Our cybersecurity policies, standards, procedures, and practices are based on the Center for Internet Security (CIS) Critical Security Controls, a framework for companies to establish and evaluate cybersecurity policies, procedures and practices. We seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of our information systems or the information that we collect and store, by assessing, identifying and managing cybersecurity issues as they arise.

companyName: Xencor Inc

ticker: XNCR


text: Risks from Cybersecurity Threats Any risks from previous cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company's business, financial condition, or results of operations. Such risks and incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. The Company also has cyber event related insurance.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Cybersecurity Governance KKR has a Chief Information Security Officer (the "KKR CISO"), who leads an information security team (the "KKR information security team") that is responsible for information security at KKR's asset management business, including its cybersecurity strategy and program, which includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about KKR's security policies. The KKR information security team's mandates can be broadly grouped into three categories: (i) operations and engineering, (ii) threat detection and response and (iii) governance.

companyName: KKR & Co. Inc.

ticker: KKR


text: Our cybersecurity risk management program is an integral component of our overall information security platform sharing common governance processes that monitor, prevent, detect, mitigate, and remediate cybersecurity incidents and guiding continuous improvement to our broader enterprise IT infrastructure.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: Our CIR Process is a formalized approach following the NIST framework for evaluating cybersecurity incidents and prioritizing response efforts based on established criteria. The key components of the CIR Process includes: • cybersecurity incident prioritization • timelines and communications protocols, including establishing reporting thresholds pursuant to which incidents are escalated within the Company, and, where appropriate, reported promptly to the Cyber Review Committee, the Audit Committee Chairman, the Chief Executive Officer and Chief Financial Officer, and the Board of Directors • procedures related to our Cyber Review Committee described below • a formalized methodology for evaluating the impact of cybersecurity incidents The Cyber Review Committee ("Cyber Committee") is a sub-committee of our Disclosure Committee comprised of our Chief Accounting Officer; Senior Vice President of Information Technology and Engineering; General Counsel; Vice President – Investor Relations; Director – Risk Management & Insurance; and Director – Global Security & Administration. Pursuant to the CIR Process, cybersecurity incidents classified as high priority are reported to the Cyber Committee. The Cyber Committee's responsibilities include: • providing feedback and direction to our information technology teams on incident investigations • coordinating other departments, consultants, and advisors as needed • communicating with our executive officer team, Disclosure Committee, independent auditor, and the Chair of the Audit Committee • initiating the materiality determination methodology and assessing materiality of incidents (quantitative and qualitative) • based on materiality analysis, making a recommendation to the Chief Executive Officer and Chief Financial Officer that an incident should be deemed material

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Information Security & Compliance team consists of subject matter experts in the field on Information Security, Risk Management, Compliance and Data Protection. The Information Security & Compliance team monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to the CISO. The CISO is part of the senior management team and regularly updates the Technology and Data Management Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: Use of Third Parties Being cognizant of the complexity and dynamic nature of cybersecurity threats, the Company engages the services of various third-party experts, inclusive of Managed Security Service Providers, application and infrastructure cybersecurity assessors, consultants, and advisors. These engagements allow for the supplementing of our internal capabilities with specialized knowledge and expertise in the execution of cybersecurity strategic functions.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Furthermore, the program includes a formal information security training program that includes comprehensive security awareness initiatives and training modules, addressing critical areas such as phishing attacks and best practices for email security.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Protection Systems Weatherford has made significant investments in cyber protection systems, including by engaging third party service providers to actively search and monitor information systems for vulnerabilities through penetration testing and other means. In addition, multi-factor authentication and strong passwords are used across all major Weatherford systems in an effort to prevent unauthorized access.

companyName: Weatherford International plc

ticker: WFRD


text: The Manager's Security Awareness Program includes training that reinforces the Manager's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Manager's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: In addition, our Risk and Compliance Committee (RCC) is responsible for oversight and support of the Company's Enterprise Risk Management and Compliance and Ethics programs and is comprised of the Executive Leadership Team and the Senior Vice President and Chief Accounting, Risk, and Compliance Officer (Compliance Officer). The RCC also created a subcommittee, the Enterprise Risk Management Committee (ERMC), who is charged with continually monitoring, evaluating, and managing enterprise risks. The ERMC includes the Compliance Officer, General Auditor, Vice President Law - Finance, Compliance and Commercial Litigation, Vice President and Chief Safety Officer, CISO, Vice President - Strategy and Corporate Development, and Assistant Vice President - Executive Services. The RCC and ERMC both meet throughout the year and receive periodic updates on cybersecurity from the CISO.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third-party service providers, while our board of directors has responsibility for the strategic oversight of risk management, including oversight of material risks associated with cybersecurity threats.

companyName: Lomond Therapeutics Holdings, Inc.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on our Manager managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Security breaches and other cyber-security incidents could result in a loss of data, interruptions in our business, subject us to regulatory actions, increased costs, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Managing Material Risks & Integrated Overall Risk Management The Company embraces risk management across the company, to include cybersecurity risk. This comprehensive approach ensures that cybersecurity considerations are an integral part of its decision-making processes at every level. The Company's risk management team works closely with its IT department to continuously evaluate and address cybersecurity risks in alignment with its business objectives and operational needs.

companyName: YORK WATER CO

ticker: YORW


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Board of Directors Our board of directors, in coordination with the audit committee of our board of directors, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our audit committee regularly receives reports and presentations from the Technology Team regarding cybersecurity. The Technology Team also reports to our board of directors at least annually on cybersecurity matters. We have established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, are reported to our board of directors and/or our audit committee.

companyName: Techpoint, Inc.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, security questionnaires, review of the vendor's written security program, review of security assessments, reports, vulnerability scans related to vendors, imposition of information contractual obligations on the vendors and other elements of vendor management program such as continuous cyber security monitoring by third-party service. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Enovix Corp

ticker: ENVX


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Vice President, Information Technology and our information technology group endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology (NIST) and CIS Critical Security Controls frameworks.

companyName: LGI Homes, Inc.

ticker: LGIH


text: The CISO is responsible for administration, management, and oversight of the Information/Cybersecurity Program; and is supported by a team of individuals that possess various levels of educational and technical hands-on expertise to carry out daily responsibilities and to ensure the Program's success and continued maturation. The CISO reports directly to the Chief Risk Officer, and has over 15 years of direct experience in designing, implementing, and maturing information and cybersecurity strategies within the financial sector. Prior to joining the Bank, the CISO served as a technology examiner for one of the three Federal banking regulatory agencies, with over ten years of experience performing technology examinations of financial institutions ("FI") and FI service providers primarily within the New York metropolitan area.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: Our cybersecurity risk management processes include a third-party risk management program that assesses risks from vendors and suppliers. The program includes cybersecurity and data privacy assessments during vendor onboarding to identify and classify risk based on several factors, including the type of data handled by the third-party service provider and the potential impact to our business if there were a significant disruption to the third-party service or system.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: Members of senior management have regular meetings with the CISO and other members of Farmer Mac's information technology team to discuss and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents. The participants in these meetings also discuss their management of, and participation in, the cybersecurity risk management and strategy processes described in this report, including the operation of Farmer Mac's incident response plan. Farmer Mac provides quarterly cybersecurity training to all employees, board members, and users of Farmer Mac's technology assets. Employees with elevated privileges within the computing environment also receive specialized training tailored to their job responsibilities. Farmer Mac tracks the metrics from the cybersecurity training program and includes the results in dashboard reports shared and discussed with senior management, the board enterprise risk committee, and the board cybersecurity subcommittee.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: The Company's CIO oversees the day-to-day implementation of the Company's cybersecurity risk management programs, tests its compliance with standards, remediates known risks, and leads its employee cybersecurity training program. The CIO is tasked with keeping informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, in an attempt to assist in effectively preventing, detecting, mitigating, and remediating cybersecurity incidents. The CIO implements and oversees processes for the regular monitoring of the Company's information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is responsible for implementing the Company's incident response plan to mitigate the cybersecurity incident's immediate impact, implement long-term strategies for remediation, and prevent future incidents.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: We have also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of critical third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. Additionally, we require those third parties that could introduce significant cybersecurity risk to us to provide ISO certifications or Service Organization Controls, or SOC, 2 reports as evidence of a cybersecurity audit and these reports are reviewed and assessed for risk.

companyName: RESMED INC

ticker: RMD


text: Under the oversight of the Audit Committee, and as directed by our Chief Executive Officer, the Company's Systems Application Manager, is primarily responsible for the assessment and management of material cybersecurity risks and the Company's annual security audits to meet the payment industry expectations.

companyName: OLB GROUP, INC.

ticker: OLB


text: Our overall efforts to safeguard the information systems and confidential information critical to our operations include preventative and detective internal processes, technological defenses, and other controls designed to provide multiple layers of security protection. Our information security efforts are designed to evolve with the changing security threat environment through ongoing assessment and measurement. In our efforts to keep our data and technology systems secure, we leverage both the International Organization for Standardization (ISO) 27002 Security Framework for the body of security control requirements and the National Institute of Standards and Technology Cybersecurity Framework to assess the strength of our processes and defenses. This integrated approach to protect data and information systems is also built into our project management, development, and operations. To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ a variety of internal resources to evaluate our environment, information systems, and processes. In addition, we engage third parties to test the vulnerability of our cybersecurity infrastructure on a regular basis and we have a third-party assessment performed annually.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: NEE operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE (information systems), including those used for the provision of functions to XPLR, that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats), as well as on its operations, including its provision of services to XPLR. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: Our advisor experienced a security incident in January 2023 that impacted the operability of its computer systems. Our advisor promptly reported the incident to federal law enforcement and restored the functionality of its computer systems. We are unaware of any misuse of our information.

companyName: Moody National REIT II, Inc.


text: The Audit Committee, under oversight of the Board of Directors, has responsibility for oversight of risks from cybersecurity threats, and the assessment and management of cybersecurity risks is the responsibility of the Information Security ("INFOSEC") team. The INFOSEC team is managed by the Vice President, Information Technology, who reports to our Chief Executive Officer. Our current Vice President, Information Technology and other members of our INFOSEC team collectively have more than 60 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Our cybersecurity risk management efforts have also been integrated into the overall Enterprise Risk Management ("ERM") process, which includes assessment of cybersecurity risks that could result in significant operational disruption to the Company, such as production disruption, business downtime, loss of containment or other operation interruptions, as well as risks that could have significant reputational and compliance/regulatory impact. Cybersecurity risks identified and tracked through our ERM risk register have assigned risk owners at the executive leadership level and risk delegates who are responsible to identify and manage risk mitigation actions. Key risk indicators are updated quarterly by risk delegates and communicated to our executive leadership and the Audit Committee.

companyName: Baker Hughes Co

ticker: BKR


text: Management and Strategy recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: NewHydrogen, Inc.

ticker: NEWH


text: Related to Cybersecurity Risks Management is responsible for the day-to-day management of risks we face, while our board of directors, as a whole and through committees, has responsibility for the oversight of risk management. Our board of directors oversees the management of our risks from cybersecurity threats. In addition, the full board discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.

companyName: Deciphera Pharmaceuticals, Inc.


text: We maintain cybersecurity insurance and regularly consult with third-party cybersecurity experts during our review of existing cybersecurity controls. We also perform periodic assessments of our key vendors, which allow the Company to identify vendor cybersecurity risks and develop reasonable mitigation plans.

companyName: BRINKS CO

ticker: BCO


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of strategic risk, including cybersecurity risk oversight. The Audit Committee receives regular reports on at least a quarterly basis from our cybersecurity team, typically on, among other things, our cybersecurity posture, cybersecurity benchmarking, potential cybersecurity vulnerabilities, and other cybersecurity interest items such as the external cybersecurity environment, items requiring Audit Committee input, and our broader cybersecurity program roadmap, in order to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The Audit Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: The Company conducts bi-annual cybersecurity awareness training for all employees, new-hire cybersecurity training, periodic simulated phishing tests, and additional training for specific departmental requirements as part of the Company's risk mitigation efforts. The Company also maintains cybersecurity insurance; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.

companyName: SITE Centers Corp.

ticker: SITC


text: Management and Board Oversight of Cybersecurity Risks Our Cybersecurity Program is managed by the Director of Information Technology who leads our Information Technology team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Information Technology provides periodic reports to the executive risk management committee and the board-level risk committees of the Company and the Bank and the Chief Executive Officer and other members of our senior management, as well as the cross-functional management team that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.

companyName: BayCom Corp

ticker: BCML


text: Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse Peapack-Gladstone Bank systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Peapack-Gladstone Bank's Information Security Officer and Chief Information Officer, who reports directly to the Chief Operating Officer, along with other key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our Board of Directors, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at both Ellington and Longbridge, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties.

companyName: Ellington Financial Inc.

ticker: EFC


text: Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. Senior management regularly discusses on at least a quarterly basis and otherwise as needed, cyber risks and trends and, should they arise, any material incidents with the Audit Committee.

companyName: Digital Turbine, Inc.

ticker: APPS


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Head of IT is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of IT has over 20 years of experience in information security and possesses the requisite education, skills and experience expected of an individual assigned to these duties. In addition to individual skills, the Head of IT has partnered with several third-party Cybersecurity experts to identify new areas of risk and the latest trends in security tools and methods.

companyName: Neuronetics, Inc.

ticker: STIM


text: As an externally managed REIT, the Company's risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Company and other affiliated entities managed by Apollo, and the Company relies on Apollo for assessing, identifying and managing material risks to the Company's business from cybersecurity threats.

companyName: Apollo Realty Income Solutions, Inc.


text: The Managing Director, Information Technology, provides updates to the Audit and Reserves Committee on data protection and cybersecurity matters on at least a semi-annual basis, or as requested or deemed necessary. The topics covered in such reports may include an overview of our current cybersecurity risk assessment, key risk areas, any significant cyber incidents that have occurred or are reasonably likely to occur, as well as recent updates on cybersecurity trends and emerging threats. Additionally, on an annual basis, the Managing Director, Information Technology, reviews with the Audit and Reserves Committee the results from tests of key cybersecurity risks and the subsequent steps taken to mitigate such risks.

companyName: Chord Energy Corp

ticker: CHRD


text: We are subject to extensive federal and state regulation of customer privacy and the security of financial information. Our federal regulator, the FDIC, is part of the Federal Financial Institutions Examination Council (FFIEC), which publishes extensive guidelines and examination procedures that are used to review the security of financial institutions.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: Governance and Risk Management Our Technology Risk Program is designed to proactively identify, monitor, and mitigate technology-related risks across our digital operations and assess cybersecurity risks related to third-party vendors and suppliers. Our Cybersecurity Program and our Technology Risk Program are led by our Chief Information Security Officer ("CISO") a Certified Information Systems Security Professional with two decades of cybersecurity leadership. The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Technology Risk Oversight Committee chaired by our CISO, with members representing leadership throughout our Company, provides oversight and guidance to technology risks, including cybersecurity. Our Company's Cybersecurity Program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company's Enterprise Risk Management framework. Internal and external experts regularly evaluate our Cybersecurity Program, and the results of those reviews are reported to senior management and our Company's Board of Directors. Our Incident Response Committee, which is comprised of leaders in the areas of information security, digital, legal, finance, privacy, compliance and ethics, corporate security and communications, is responsible for leading our Company's response to cyber incidents. Our Cybersecurity Incident Response Plan outlines the processes by which management is informed about and monitors detection and mediation of cyber incidents. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program, which we have continued to invest in developing. Our corporate cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party vendors and service providers, and facilitating coordination across different business units of the Company. Our corporate cybersecurity risk management program is based on and audited against industry standards, including ISO 27001 for Information Security Management Systems (ISMS) and the automotive industry's Trusted Information Security Assessment Exchange standard (TISAX).

companyName: Mobileye Global Inc.

ticker: MBLY


text: We aim to be proactive in our approach to cybersecurity, with our practices informed by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This approach aids us in identifying and managing cyber risks in a manner that aligns with our business operations. While the NIST CSF serves as a guiding framework to help us identify, assess, and manage cybersecurity risks, this does not imply we adopt a blanket adherence to its standards and requirements in all respects. Our cybersecurity risk management program is further informed by the industry-recognized certifications we have obtained through comprehensive third-party evaluations, including ISO/IEC 27001, ISO 27701, ISO 27799, ISO 22301, SOC 2 Type 2, and SOC 3.

companyName: KALTURA INC

ticker: KLTR


text: Legacy relies on information technology infrastructure and architecture, including hardware, cloud computing networks, software, people, and processes to manage protected, confidential, and personally identifiable information. Our business is at risk from, and may be impacted by, cybersecurity threats and incidents, including but not limited to attempts to gain unauthorized access to our systems or data. Similar threats and incidents may impact third parties with which we do business. We have invested and continue to invest in cybersecurity and data protection efforts, including technical, administrative, and organizational safeguards designed to protect our systems and data. However, we acknowledge that a future cybersecurity incident could materially harm our business, operating results, and financial condition.

companyName: Legacy Housing Corp

ticker: LEGH


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For the years presented, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that had, or were reasonably likely to have, a material affect on the Company, including our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see "Operational Risks - Our business and operations could suffer in the event of cybersecurity breaches," in "Item 1A. Risk Factors" in this report.

companyName: UNIFI INC

ticker: UFI


text: We rely on our information technology systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third party service providers and are not under our direct control. The Company has implemented a third party risk management program to manage the cybersecurity risks associated with its use of third party service providers.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: Integration into Overall Risk Management: Our cybersecurity risk assessment processes are fully integrated into the broader risk management framework. Cybersecurity is positioned as a core component of our risk management strategy, with direct reporting to our President and COO, who is guided by our third-party CIO firm. The CIO firm provides strategic direction on policy, procedures and best practice. The synergy between cybersecurity and risk management ensures a resilient posture against emerging cyber threats.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. Our Audit Committee oversees risks and exposures associated with financial matters, particularly financial reporting, tax (including compliance with REIT rules), accounting, disclosure, internal control over financial reporting, cybersecurity, financial policies, investment guidelines, development and leasing, and credit and liquidity matters. In addition, the Risk Committee oversees our enterprise risk management practices to ensure that we are equipped to anticipate, identify, prioritize, and manage material risks to the Company. Our Risk Committee assists our Board of Directors in its oversight of our enterprise risk management framework, including cybersecurity, our overall risk-taking tolerance and our management of financial, reputational and operational risk.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: The CISO provides quarterly reports to the Audit Committee, as well as more frequent reports to our Cyber Security Steering Committee, which includes the Chief Executive Officer, Chief Financial Officer and other members of our senior management. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and the emerging threat landscape. Our cybersecurity program is periodically evaluated by internal and external experts, with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: For the year ended March 31, 2024, the Company was not subject to material fines or penalties in connection with cybersecurity, and there were no material cybersecurity incidents arising from cybersecurity or personal data protection.

companyName: Senmiao Technology Ltd

ticker: AIHS


text: The Information Security organization works collaboratively across the company to protect the company's information systems from cybersecurity threats and to respond to cybersecurity threats and incidents. The Information Security organization monitors information systems to detect anomalies, including attempted cyber attacks, as well as user activity for access controls and risks of insider threat. The Information Security organization also monitors and investigates cybersecurity incidents through detection tools, reports from end-users, and other cybersecurity threat and vulnerability intelligence. The Information Security organization also shares and obtains information on cybersecurity threats through participation in the Financial Services Information Sharing and Analysis Center, referred to as FS-ISAC, a member-driven organization that advances cybersecurity and resilience in the global financial system.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Our management leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our information security program is coordinated by our IT department, led by our Senior Vice President of Information Technology, who has 27 years of industry experience in IT, with responsibility for enterprise security, and cyber risk management including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Supporting team members have relevant educational and industry experience, including holding similar technology positions at other companies.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: Cybersecurity is a high-priority item for legislators and regulators at the federal and state levels, as well as internationally. State and federal banking regulators have issued various policy statements and, in some cases, regulations, emphasizing the importance of technology risk management and supervision. These policy statements and regulations indicate that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. For example, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations after a cyberattack involving destructive malware. Additionally, financial institutions are expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to cyberattacks.

companyName: CapStar Financial Holdings, Inc.


text: The Company provides regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: All dollar amounts expressed in thousands, except per share amounts The SVP IT oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. The SVP IT also coordinates with the Company's General Counsel and Interim Chief Financial Officer and Chief Accounting Officer (the "Interim CFO and CAO") to assess and manage material risks from cybersecurity threats. The SVP IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: The Company employs a number of cybersecurity measures intended to reduce the likelihood that cybersecurity incidents materialize, including: (i) employing a variety of reputable and recognized hardware, software and other security measures in the design and maintenance of our information technology and data security systems; (ii) conducting periodic testing and verification of information and data security systems, including engaging third-party assessors to perform penetration testing of our systems to identify vulnerabilities; (iii) confirming with our critical vendors whether they have had cyber breaches of their IT systems or otherwise involving Company information; (iv) verifying third-party IT system integrity through a review of System and Organization ("SOC") audit review reports provided by certain of our vendors; and (v) providing onboarding and other periodic employee security awareness training relating to phishing and other scams, malware and various cyber-related risks. We have also engaged third-party vendors to assist with incident detection and monitoring and to implement and maintain other cybersecurity measures specific to our operations and portfolio properties.

companyName: EQC Liquidating Trust


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director of IT, who holds a Bachelor of Science in Computer Methods from California State University-Long Beach and has previously served as the Associate Director of IT for a large pharmaceutical company.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of our incident response plan. As discussed above, our CISO reports to the Compliance and Regulatory Affairs Committee, about the risks from cybersecurity threats among other cybersecurity related matters, and meets regularly with our Chief Technology Officer.

companyName: Evolent Health, Inc.

ticker: EVH


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the section titled "Risk Factors" in Part I. Item 1A of this Annual Report on Form 10-K, including the risk factor titled "—Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: While we have not yet experienced any material impacts from a cyber-attack, any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.

companyName: Mediaco Holding Inc.

ticker: MDIA


text: Our Chief Information Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Financial Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience, as well as third-party information security specialists. In particular, our Chief Information Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management. In addition to the ISOC, our board of directors has created the Information Technology Steering Committee, These committees provide oversight and governance of the technology program and the information security program. These committees include the Chief Financial Officer and Chief Information Officer as well as their direct reports and other key departmental managers from throughout the entire Company. The Information Technology Steering Committee meets on a quarterly basis. The ISOC generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Information Technology Steering Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: TC Bancshares, Inc.

ticker: TCBC


text: Ensuring the protection of sensitive data is fundamental to our operational integrity and strategic vision. Cybersecurity and data protection form essential pillars of our long-term strategy, safeguarding confidential information concerning our business, employees, customers, suppliers, and shareholders.

companyName: Whitestone REIT

ticker: WSR


text: Incidents and Responses We have not experienced cybersecurity incidents that have materially affected our company, our business strategy, our results of operations, or our financial condition. However, we continue to face cybersecurity risks and recognize that we must remain vigilant against known and evolving threats. For additional detail about our cybersecurity risks and whether any such risks are reasonably likely to materially affect our company, please see the discussion in Item 1A, "Risk Factors."

companyName: Urgent.ly Inc.

ticker: ULY


text: We are constantly evolving our cybersecurity strategy and responses for new and emerging threats. As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats with respect to our information systems that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled "Failure to maintain the security and functionality of our information systems, or to defend against or otherwise prevent a cybersecurity attack or breach, could adversely affect our business, financial position, results of operations and liquidity" described under "Risk Factors" contained in Item 1A of this Annual Report on Form 10-K.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: We maintain specific insurance coverage to mitigate losses associated with cybersecurity incidents that impact our or our third parties' systems, networks, and technology.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: Like many other companies, from time to time, we detect attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. We have in the past been subject to cybersecurity incidents which have not had a material impact on our business or financial condition and expect that we will be subject to additional cybersecurity incidents in the future. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, there can be no assurance that our efforts to prevent or mitigate cybersecurity incidents will be successful. Please see "Risks Related to Technology and Data Privacy" in "Risk Factors" in Section 1A of this Annual Report on Form 10-K.

companyName: CTS CORP

ticker: CTS


text: We maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.

companyName: Expion360 Inc.

ticker: XPON


text: We believe cybersecurity is critical to our mission achievement to ensure uninterrupted business continuity, and enables us to deliver superior services while safeguarding our customers' sensitive information.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We operate in the industrial sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect our employees, customers, and corporate data and prevent data loss and other security breaches, including a cybersecurity risk assessment program. Both management and our board of directors are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: PIONEER POWER SOLUTIONS, INC.

ticker: PPSI


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. The Audit and Risk Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit and Risk Committee receives reports on information security and cybersecurity from the CISO at least four times a year.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls designed to protect critical systems and data. These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and deter malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to manage emerging cyber threats.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Matthew Dunnigan. Mr. Dunnigan was appointed Chief Financial Officer of RBI in January 2018. From October 2014 until January 2018, Mr. Dunnigan held the position of Treasurer, where he took on increasing responsibilities and successfully led all of RBI's capital markets activities. Before he joined RBI, Mr. Dunnigan served as Vice President of Crescent Capital Group LP, from September 2013 through October 2014, where he evaluated investments across the credit markets. Prior to that, Mr. Dunnigan was a private equity investment professional for H.I.G. Capital.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer. Our Chief Executive Officer and other leadership personnel work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit and compliance committee of the board of directors, as appropriate.

companyName: Immunocore Holdings plc

ticker: IMCR


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our director of cybersecurity and technology operations, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: When a cybersecurity incident occurs, whether detected internally or from third-party cybersecurity incidents, we evaluate the incident for criticality and potential materiality and disclosure across a range of contributing indicators, including service availability, impact to operations, reputational impact, regulatory and legal considerations, data sensitivity, and direct financial impact. The potential impact of the incident, individually or in aggregate, is evaluated by the CISO continuously across these criteria. We have escalation procedures to notify members of senior and executive management, the Board (or an applicable subset), and regulators in a timely manner based on the criticality and materiality of the cybersecurity incident.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: We have implemented processes that are intended to assess, identify, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, evaluate, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness.

companyName: AbbVie Inc.

ticker: ABBV


text: The ISO plays a pivotal role in informing the BRCC on cybersecurity risks. Jointly with the Chief Risk Officer, the ISO reports quarterly to the BRCC on a range of topics, including: • Current cybersecurity landscape and risks; • Status of ongoing cybersecurity incidents, threats and strategies; • Internal and external test result and remediation efforts; • Enforcement of ongoing awareness training on information security; • Cybersecurity incident reporting and post-incident reviews; and • Compliance with regulatory requirements and evolving industry trends.

companyName: OP Bancorp

ticker: OPBK