text: Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by escalating risks, issues, and key decisions to management, the Audit Committee, and our Board. Our program is designated to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents. In addition, our operations team provides cybersecurity training to employees during the onboarding process and periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.

companyName: PHOENIX MOTOR INC.

ticker: PEVM


text: Management's Role Managing Risk We have an internal management team comprising of our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO"), VP, Corporate Controller, Sr. Director, SEC Reporting, and Sr. Director of IT (the " Risk Management Team "), that plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Sr. Director of IT and IT team monitor cybersecurity risks and perform continual risk exercises and assessments. The Risk Management Team meets quarterly to discuss current security breaches and threats, if any, and discuss new controls and results of the cybersecurity risk monitoring, exercises, and assessments. The Risk Management Team provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and the Risk Management Team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, the Board receives updates on any significant developments in the cybersecurity domain, ensuring the Board 's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: Energy Recovery, Inc.

ticker: ERII

secItem: Item 1C


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation. We regularly engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. Certain results of such assessments and reviews are reported to the Audit Committee and the BOD, as appropriate, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.

companyName: PFIZER INC

ticker: PFE


text: Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: Our management monitors our websites and online accounts frequently to manage risks associated with cyber-security risks. Our management communicates with our board on matters of cybersecurity but, has not had to inform them of any breaches thus far.

companyName: IIOT-OXYS, Inc.

ticker: ITOX


text: Because we develop, process, store, and transmit large amounts of data, including confidential, classified, sensitive, proprietary, and business and personal information, failure to prevent or mitigate data loss, theft, misuse, unauthorized access, or other security breaches or vulnerabilities affecting our systems could: expose us or our customers to a risk of loss, disclosure, or misuse of such information; adversely affect our operating results; result in litigation, liability, or regulatory action (including under laws related to privacy, data use, data protection, data security, network security, and consumer protection); deter customers or sellers from using our products, and services; and otherwise harm our business and reputation. We use third-party technology and systems for a variety of reasons, including, without limitation, encryption and authentication technology, employee email, content delivery to customers, back-office support, and other functions. Although we have developed systems and processes that are designed to protect our data and prevent such incidents, including systems and processes designed to reduce the impact of a security breach at a third-party vendor or customer, such measures cannot provide absolute security and may fail to operate as intended or be circumvented.

companyName: Toughbuilt Industries, Inc


text: We employ Information Security Officers to help the business better understand and manage their information security risks, as well as to work with the centralized Global Cybersecurity team to drive awareness and compliance throughout the business.

companyName: STATE STREET CORP

ticker: STT


text: As of the date of this Annual Report on Form 10-K, we have not identified material risks from known cybersecurity threats that have materially affected Zillow Group. Given the data-driven nature of our business and the prevalent use of technology in operating our business, we face cybersecurity risks inherent to our normal course of operation that, if realized, are reasonably likely to materially affect our business strategy, results of operations and financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: We understand the importance of educating our employees about cybersecurity risks, and, over the past two years have initiated awareness and training programs internally specifically targeted to employees with a goal of continually increasing employee education. This initiative aims to foster a culture of cybersecurity awareness and empower our employees to be vigilant in identifying and mitigating potential threats.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. Breeze maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats as appropriate for a Special Purpose Acquisition Company ("SPAC").

companyName: Breeze Holdings Acquisition Corp.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. The Information Security and Privacy team leads cybersecurity risk management for our business. Effective Cyber Risk Management is foundational to our Information Security and Privacy program and is based on recognized frameworks established by the National Institute of Standards and Technology (NIST). Our Information Security and Privacy Risk Management program includes processes and controls for the business to ensure that cybersecurity risks are identified and responded to promptly. These range from formal processes that are triggered in certain circumstances, to detective controls and technology that we use to identify and manage risks. Information Security and Privacy's Risk Management process is consistent with our Enterprise Risk Management Policy, which describes how we manage risks generally. The Information Security and Privacy team also engages with external consultants to ensure best practices in our Cyber Risk Management.

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to patient and employee data or our systems. Third-party risks are included within our risk management process discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: As part of the above processes, from time to time we work with third parties that are intended to help us to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, managed cybersecurity service providers and penetration testing firms.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are a part of our decision-making processes at every level. Our risk management team works closely with our Information Technology (IT) team including our IT and cybersecurity vendors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Cybersecurity Governance; Management Cybersecurity is an important part of our broader risk management processes and an area of focus for our Board of Directors and management. In general, our Board of Directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our Board of Directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our Board of Directors has authorized our Audit Committee to oversee risks from cybersecurity threats.

companyName: Quantum-Si Inc

ticker: QSI


text: The Company's CISO directs our information security program and the Director of Enterprise IT Risk directs our information technology risk management. Led by our CISO and Director of Enterprise IT Risk, a team of dedicated security professionals examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment and provides immediate responses to threats.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations. The Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Committee provides regular reports to our Board of Directors and provides our Board of Directors with timely updates regarding any ongoing cybersecurity incident. On an annual basis, our Board of Directors and the Committee discuss our approach to cybersecurity risk management with members of our management's cybersecurity committee.

companyName: Plymouth Industrial REIT, Inc.


text: Third-Party and Vendor Management Review Processes — We have implemented processes that establish a systematic approach to assessing the cybersecurity controls while on-boarding new third-party vendors. Additionally, we have implemented annual reviews of the cybersecurity controls for third-party vendors that provide essential services and/or store data that presents a business risk to us and/or our customers.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Management and Strategy our business information, intellectual property, customer and employee data, and technology systems is essential for the continuity of our business, meeting applicable regulatory requirements and maintaining the trust of our stockholders. Cybersecurity is an important and integral part of our enterprise risk management function that identifies, monitors and mitigates business, operational and legal help protect us from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: annual penetration testing by a third party vendor, cloud and agent based security scanning that runs continuously, establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, and implementing cybersecurity training. In addition, we annually purchase a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: ACORN ENERGY, INC.

ticker: ACFN


text: We monitor and periodically enhance our cybersecurity program, processes, techniques and procedures to combat evolving and adaptive cybersecurity threats. To this end, we engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers. The results of such assessments, audits, and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: ACCURAY INC

ticker: ARAY


text: The Company has established a Cybersecurity Steering Committee that includes executives and senior leadership across all divisions and corporate services to implement and manage a program designed to protect the Company's information systems from cybersecurity threats and to respond promptly to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are created and deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's Incident Response Plan. Through the ongoing communications from these teams, the Cybersecurity Steering Committee monitors effectiveness of the prevention, detection, mitigation and remediation within the cybersecurity program. The Company's General Counsel, as part of the Incident Response Team, will report any material cybersecurity incidents to the Board when appropriate.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Incident Response Program Management has developed and implemented a risk-based incident response program to minimize the impact to Pathward and its customers in the event of an information security incident. The incident response program has defined protocols to declare and respond to an identified incident and includes appropriate containment and restoration strategies. Pathward maintains a documented Cybersecurity Incident Response Plan and has identified Information Technology and Information Security staff who are responsible for assisting with a data breach incident response event. Team members have defined roles, responsibilities and must participate in incident response training and walk-through events at least annually. Pathward has contracted with an incident response provider in the event of a security breach. In addition, Pathward has acquired a cybersecurity insurance policy.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: A third-party managed security services provider ("MSSP") works in tandem with our internal IT team to implement and maintain processes and procedures to detect and handle identified security incidents, including the performance of phishing simulations to evaluate our workforce's ability to recognize malicious emails. Our MSSP team leaders have significant experience working in cybersecurity and employ a trained workforce designed to provide proactive and comprehensive cybersecurity care. Together with our MSSP, we also monitor the frequency and extent of cybersecurity threats and update our processes and procedures as necessary. On an annual basis, our internal auditors conduct penetration testing and other assessments.

companyName: FreightCar America, Inc.

ticker: RAIL


text: As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.

companyName: Flutter Entertainment plc

ticker: FLUT


text: AGM engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. AGM regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to AGM's risk management function, and AGM adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: The audit committee of the Board is responsible for the oversight of risks from cybersecurity threats. Beginning fiscal year 2024, at least annually, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee will generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and will discuss such matters with our VP of Software Platform. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks will also be considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: At Western Digital, our management team is charged with managing risk and bringing to our Board of Directors' attention all material risk exposures to our company. Our enterprise risk management ("ERM") process is designed to facilitate the identification, assessment, management, reporting and monitoring of material risks our company may face over the short-term and long-term and promote regular communication with our Board of Directors and its committees regarding these risks. Through our ERM process, we have determined that the compromise, damage and interruption of our technology infrastructure, information systems or products by cybersecurity incidents are key risks to our company that may have a material negative impact on our business. To help mitigate the potential impact of cybersecurity incidents on our business and protect against cybersecurity threats, we have established organizational structures, procedural measures and response plans that define roles and responsibilities related to cybersecurity risk management.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: The Board recognizes the importance of maintaining the trust and confidence of our tenants/borrowers/operators and employees to safeguard sensitive information and the integrity of our information systems. We have systems in place to assess, identify and manage cybersecurity incidents and we invest in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents. We have maintained a strong focus in consistently reviewing our cybersecurity practices. We also conduct periodic information security and awareness training to ensure that employees are aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we also take steps designed to provide appropriate guidance regarding security to our executive management and employees, including any employee who may come into possession of confidential financial information.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: We have a risk oversight committee, which is comprised of representatives from our operations management team, information technology and compliance functions. The committee assesses risks based on probability and potential impact on key business systems and processes. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data. In addition, we engage a third-party service provider to actively monitor potential threats as well as our security defenses. The effectiveness of the cyber and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit Committee.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Our board of directors has approved management committees including the CSI Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. There are also three technology steering committees that plan and guide technology projects in alignment with the Corporation's strategic plan. These committees are chaired by managers and experts within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company. These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: We leverage a structured process framework based on ISO 27001 to minimize cyber risks and facilitate continuous improvement. We adhere to the principle of least-privilege when provisioning access to systems, seeking to limit potential abuse of system privileges by internal or external threats. We train our employees annually in cybersecurity awareness and responsibilities and we engage them throughout the year with phishing awareness exercises, additional focused training, and messaging about current and persistent threats. Employees with privileged access to systems are further trained in security-by-design principles, centered on best practices for securely developing and managing software systems.

companyName: KORN FERRY

ticker: KFY


text: We continue to make significant investments in our information technology systems pursuant to our operations. We believe that these investments, including additional technology changes to implement our strategic plan, are essential to enhance our overall customer experience, to support our compliance, internal controls and efficiency initiatives, to expand our capabilities to offer new products, and to provide scale for future growth and acquisitions. Our program ensures that we operate with greater efficiency.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: Annual risk assessments of our Information Security Program are conducted to identify emerging information security and third party risks. In addition, periodic vulnerability assessments and penetration tests are conducted to support the identification of risks. We also conduct independent audits, including through the use of third-party assessors on both the design and operational effectiveness of security controls and consult with external advisors on best practices to address new challenges.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: Role Managing Risk the management team, the responsibility for assessing and managing cybersecurity risk falls under the purview of Mr. Geldenhuys, whose background includes running a technology Company.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: Cybersecurity Program Overview The Advisor has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Kennedy Lewis Capital Co


text: All employees are required to complete cybersecurity training as part of on-boarding process and on-going training both online and in-person. IT department assigns position specific security level encryption to manage information security We have continued to expand investments in IT security, including software programs and policies mentioned above. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation.] In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers.

companyName: Nuwellis, Inc.

ticker: NUWE


text: EIS employs a variety of measures to prepare for and protect against, detect, contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures EIS has in place include, but are not limited to, password protection, multi-factor authentication, internal and external penetration testing, cybersecurity assessments, industry benchmarking, and annual cybersecurity awareness trainings for employees as well as social engineering awareness efforts. To detect and prevent cybersecurity incidents, the cybersecurity program uses automated event-detection technology monitored by the cyber defense team, notifications from employees, vendors or service providers and other tools. The Company has relationships with a number of third-party service providers to assist with cybersecurity incident response, containment and remediation efforts, including a forensic investigation firm, insurance providers and various law firms. While the Company maintains a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to detect threats in a timely manner or anticipate and implement adequate security measures. For additional information, see "Item 1A Risks Related to the Company's Information Technology, Cybersecurity and Data Protection".

companyName: ROBERT HALF INC.

ticker: RHI


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk function in coordination with the oversight and periodic review of the audit committee.

companyName: ESS Tech, Inc.

ticker: GWH


text: We implement a multi-layered approach to cybersecurity that includes, but is not limited to, employee security awareness training, phishing simulations, incident response planning, and various cybersecurity tools and technologies. We leverage the support of third-party information technology and security providers to manage our information technology systems, including through the performance of system scans and threat intelligence analysis. We have also previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we are adapting our cyber risk strategy in an effort to mitigate emerging cybersecurity risks.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: At the senior management level, our Global Chief Security Officer (CSO) oversees CNA's information security and data privacy programs and is responsible for establishing and implementing the security strategy alongside the Chief Information Officer (CIO), to whom the CSO reports directly. The CIO serves on the Enterprise Risk Committee, which is chaired by the CRRO.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: evaluation of the likelihood of the risks manifesting, the severity of the potential consequences and prioritization of different risk items based on, among other things, importance to the business execution – establishment of a program to address.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our Chief Information Officer's experience includes years of working in the cybersecurity field in various industries, including the financial services industry.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize. We conduct these risk assessments directly and also engage third parties to support these processes.

companyName: IMPINJ INC

ticker: PI


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed. For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item IA. Risk Factors of this Form 10-K.

companyName: Nextpower Inc.

ticker: NXT


text: We describe whether and how risks from cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: BancShares engages internal auditors, external assessors, and consultants to benchmark, scale, manage, and identify cybersecurity threats. Consultants also assess BancShares' cybersecurity systems and complete vulnerability testing. These groups assist the ECSO with cybersecurity risk management and identification.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: 33 Table of Contents Our privacy and security program dictates a governance structure whereby we: Regularly engage senior management on data privacy and security issues; Align policies, procedures, and technical controls to demonstrate our process and our commitment to our customers and users; Train each of our employees on all privacy and security expectations; Conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; Maintain a robust cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across AvePoint; Periodically run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; Monitor emerging data protection and cybersecurity laws, and implement changes to our processes, systems and offerings designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; Complete several cyber-specific audits per year; and Engage consultants and other third parties in connection with our cybersecurity practices.

companyName: AvePoint, Inc.

ticker: AVPT


text: The full Board of Directors is responsible for oversight of our key cybersecurity risks. The Board retains direct oversight of cybersecurity matters to best utilize the experiences and expertise of all Board members. Management, including the CIO, provides reports approximately quarterly to the Board regarding risks, threats, the threat landscape, assessments of and improvements to the cybersecurity program and internal response preparedness.

companyName: WISCONSIN POWER & LIGHT CO


text: Our CISO has over 20 years of experience in the cybersecurity industry and has been instrumental in building several key security technologies, viz. Network Intrusion Prevention Systems (NIPS), Host Intrusion Prevention Systems (HIPS), Web Application Firewalls (WAF), Whitelisting, Endpoint/Server Host Monitoring (EDR) and Virtualization Based Security (VBS). Previously, our CISO served in senior executive and technical leadership roles in several security companies. In addition, our CISO has experience as a pen-tester and has in-depth knowledge of operating system, networking and security products. Our CISO holds a bachelor's degree in computer science and a master's degree in software systems. In addition, our IS team includes over 20 members each with experience in network security related roles, with the two IS leads reporting to our CISO each having more than 20 years of security experience.

companyName: Arista Networks, Inc.

ticker: ANET


text: The Company also employs advanced screening and due diligence processes and tools, including data privacy and cybersecurity specific evaluations as applicable, as part of our standard third-party onboarding and continuous monitoring processes.

companyName: NCR Atleos Corp

ticker: NATL


text: Elevation Protocol: Incidents with significant potential impact are promptly escalated to senior IT security team members for further review. This ensures that high-level expertise is applied to complex or severe cybersecurity events.

companyName: QHSLab, Inc.

ticker: USAQ


text: Board of Directors Oversight in Cybersecurity Governance FMC's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which is comprised of independent directors whose prior work experience provides them with insights as to potential cybersecurity risks and mitigation strategies. Company executives along with external and internal cybersecurity experts update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic audits performed on the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. In addition to the routine updates provided to the Audit Committee, FMC has an established policy for communication of cybersecurity incidents with the Board of Directors and, if material, the investor community. Refer to the discussion above for further details of this policy.

companyName: FMC CORP

ticker: FMC


text: Identified threats are analyzed using a recognized risk assessment model to consistently assess the likelihood and impact of these threats. We then map these threats to a well-established industry model called MITRE ATT&CK to identify areas of vulnerability. This analysis produces a likelihood score that is used in conjunction with an impact analysis to calculate the preliminary level of risk. The impact analysis includes factors such as disruption to business operations, employee and customer data, legal issues, reputational harm, and regulatory compliance. Based on the preliminary level of risk, we also analyze compensating controls and other factors to arrive at a residual risk level. If appropriate, additional mitigations may be planned based on this risk level.

companyName: GLOBE LIFE INC.

ticker: GL


text: We also identify, assess and manage risks associated with our use of third-party service providers and maintain a third-party risk management program that monitors third-party cybersecurity risk throughout the procurement lifecycle—from planning and sourcing through relationship conclusion. This program includes supplier cybersecurity vetting at onboarding, and cybersecurity risk assessments, remediation, and cyber vulnerability monitoring while in-use, and deeper dive cyber risk assessments and security compliance monitoring is in place for our highest-risk suppliers. Our third-party risk management program is assessed for maturity by an independent third party and is aligned with NIST and ISO/IEC frameworks. We remain focused on continuous improvement through intelligence sharing with industry groups.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: The Company relies on FS Investments to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company is also included in the FS Investments risk management program and processes, which include cyber risk assessments.

companyName: FS KKR Capital Corp

ticker: FSK


text: Material Cybersecurity Risks, Threats & Incidents We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. While we have not experienced a known material information security breach nor incurred material breach-related expenses over the last three years, there can be no guarantee that we will not be the subject of future cybersecurity threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: The Cybersecurity Program team members, including the CISO and the CIO, have extensive work experience in cybersecurity, information technology engineering and the media and advertising industries, with some members holding degrees in cybersecurity and professional certifications in cybersecurity. The Cybersecurity Program team members are subject to ongoing employee trainings in cybersecurity procedures.

companyName: OUTFRONT Media Inc.

ticker: OUT


text: The CSIRT is responsible for assessing and managing our material risks from cybersecurity threats. They have primary responsibility for leading our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity service providers.

companyName: SIMON PROPERTY GROUP L P


text: We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent public accounting firm of matters and any relevant developments.

companyName: Solidion Technology Inc.

ticker: STI


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: Engagement of Third Parties in Connection with Risk Management The Company engages a range of external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These include cybersecurity consultants and external auditors to review the Company's cybersecurity posture and responsive efforts. Our relationships with these external partners enable us to leverage their expertise with the goal of maintaining best practices.

companyName: Bioventus Inc.

ticker: BVS


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of emerging industry-wide trends in cybersecurity risks along with specific risk areas our company has greater risks throughout the year, including, among others, those relating to cybersecurity threats. These reports come from the Head of IT to include our enterprise risk profile on a quarterly basis. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are industry-standard metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Neuronetics, Inc.

ticker: STIM


text: We have not identified risks from known cybersecurity threats, that have materially affected us, including our operations, business strategy, results of operations, cash flows or financial condition. We face certain ongoing risks from cybersecurity threats, including active interactions with children's hospitals while assisting with insurance prior approvals, that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, cash flows or financial condition. CYBERSECURITY GOVERNANCE.

companyName: Neuraxis, INC

ticker: NRXS


text: We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature, or collectively, Information Systems and Data.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: We continue to evaluate our cybersecurity requirements to address the evolving cybersecurity risks that we face in an increasingly technically capable environment. Our management manages our cybersecurity policies, with the goal of preventing cybersecurity incidents, if possible, while also maintaining IT system performance and data integrity to minimize the business impact should an incident occur.

companyName: HEALTHY EXTRACTS INC.

ticker: HYEX


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We have established monitoring procedures in our effort to mitigate risks related to data breaches or other security incidents originating from third parties. We engage third-party consultants and legal advisors in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: The Bank engages a third party to audit and examine its processes, conduct vulnerability assessments, and review the security of its network infrastructure consistent with FFIEC (Federal Financial Institutions Examination Council) Information Technology Audit guidelines, regulatory requirements and federal banking agency expectations. Trusted third parties are engaged to assist the Bank in improving its cybersecurity readiness. The Bank engages third party vendors to monitor and assist in maintaining its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our CIO provides quarterly updates to the Audit Committee regarding our cybersecurity risks and an annual enterprise risk management update, which includes updates on plans intended to enhance our overall cybersecurity posture, to the Audit Committee. The Audit Committee updates the full Board of Directors on matters relating to cybersecurity risk management as needed.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: We have developed a cybersecurity program that continuously evaluates material risks to our business and applies controls in an attempt to eliminate or mitigate them. Our key cybersecurity risks include, among others: brand and reputational damage, business disruption, regulatory and compliance risk, sensitive data loss, and reliance on third parties.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: Under the oversight of the Corporate Risk Committee of our Board of Directors, the chief information officer ("CIO") and chief information security officer ("CISO") are primarily responsible for assessment and management of material cybersecurity risks, with the CIO being responsible for strategic direction and management of information technology systems and the CISO being responsible for security of such systems, as described further below. The CIO has more than 30 years of experience with global technology organizations across multiple industries. The CISO has more than 20 years of experience in information security, risk management and compliance and is a certified information systems security professional. The CIO and CISO are also supported by an incident response team ("IRT") comprised of selected members of senior management and responsible for providing cross-functional support and response facilitation for cybersecurity incidents.

companyName: CHS INC

ticker: CHSCP


text: Regional, Country Risk and IT Risk Committees • Asia Pacific (APAC) Technology Risk and Controls (TRC) Forum • APAC - TRC Zone / Country Monthly Forums • Japan IT Risk Committee • Europe, Middle East and Africa region/UK and Latin America and Caribbean TRC Forum The above forums are set up for regional focus on IT, cybersecurity, regulations and overall issue management. The forums engage with the Company's relevant IT leaders and functional leaders within Enterprise Risk Management, Legal, Compliance, and Internal Audit.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: For additional information regarding relevant cybersecurity risks, see Item 1A Risk Factors "A cyberattack targeting systems and infrastructure used by the Company or others in the oil and gas industry may adversely impact the Company's operations."

companyName: APA Corp

ticker: APA


text: The IRP was designed to comprehensively leverage capabilities throughout the Company and to provide a standardized framework for responding to cybersecurity incidents by coordinating an approach to investigate, contain, mitigate, fix vulnerabilities, determine legally required responses or notifications, and document cybersecurity incidents including reporting and escalating findings as appropriate. The CSIRT, being responsible for incident response, assembles the IRT and assigns responsibilities based on the circumstances of the information security incident.

companyName: VALVOLINE INC

ticker: VVV


text: g. Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Axogen, Inc.

ticker: AXGN


text: The Board of Directors has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. The Audit Committee serves and functions as the Board of Directors primary oversight body to monitor the Company's cybersecurity and related information technology risks. The Audit Committee receives periodic updates from the VP of Tech on the Company's policies, processes, procedures, and any significant development related to the identification, mitigation and remediation of cybersecurity risks. The Audit Committee ensures that the VP of Tech provides to the Board of Directors annual updates on our cybersecurity and information technology risk. These annual updates include topics related to our cybersecurity programs and mitigation strategies, trends in cybersecurity, and other cybersecurity-related developments.

companyName: AIR T INC

ticker: AIRT


text: When cybersecurity incidents occur, the GM Cybersecurity team's focus is on responding to and containing the threat and minimizing impact. When we become aware of a cybersecurity incident, we have defined policies and procedures to respond to and recover from such incident as quickly as possible. In the event of a cybersecurity incident, the Cybersecurity team also assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement, as appropriate. Our policies and procedures are reviewed periodically for alignment with regulatory requirements and the threat landscape.

companyName: General Motors Co

ticker: GM


text: Our CTO has served in various roles in information technology and information security for over a decade, and holds a doctorate in mathematics from the London School of Economics and Political Science. The Vice President, Engineering and Security has served in various roles in information technology for over 25 years. Our CEO, CFO and CLO each hold degrees in their respective fields, and each have experience managing risks, including risks arising from cybersecurity threats.

companyName: Nerdy Inc.

ticker: NRDY


text: Risk Management and Strategy Marine Products approaches cybersecurity as an enterprise-wide risk and has created a Cybersecurity Risk and Compliance Program that outlines governance programs in place and outlines efforts undertaken to mitigate cyber risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, the Company uses the Center for Internet Security ("CIS") Controls framework to provide best practices for securing IT systems and data. We have implemented a majority of version 8.0 of the CIS Controls which supports a Zero Trust architecture.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: Sensitive files are password protected and accessible by only select individuals. These files are maintained on a separate drive. Computer files are backed up and redundancy protocols are in place so that minimal downtime would occur in the event of a cyber breach. The Company also maintains cyber insurance coverage to ensure that the Company is adequately prepared in the event of an unforeseen cyber incident.

companyName: BAB, INC.

ticker: BABB


text: Our management team, including our COO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, the IT security team that is responsible for managing our cybersecurity risks has over 50 years of experience in mitigating cybersecurity risks.

companyName: Erasca, Inc.

ticker: ERAS


text: Lumen's cybersecurity organization includes a response team and management-level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, we maintain an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. We generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board of Directors and senior leadership team. Some of the more significant risks discussed by the ROC are also reported to Lumen's Security Committee at least quarterly.

companyName: Level 3 Parent, LLC


text: Our Board of Directors ("Board") oversees our risk management processes, including our risks from cybersecurity threats. As part of its ongoing responsibilities, the Board receives recurring reports from management on the Company's cybersecurity risk environment and regularly meets with management to review the risk landscape and discuss the steps taken by management to monitor and mitigate cyber exposures. In addition, from time to time, our Chief Technology Officer and Chief Information Security Officer ("CISO") brief the Board on the cyber-threat landscape, our information security program and other related information technology topics.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: As of the date of this report, we have not experienced any cybersecurity incidents that [we have determined] have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in our risk factor disclosures under the heading "We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cyber-attacks, malware, misappropriation of data or other malfeasance, as well as outages, accidental releases of information or similar events, may disrupt our business and materially impact our results of operations, financial condition and cash flows" in Item 1A of this Annual Report on Form 10-K.

companyName: Frontier Communications Parent, Inc.


text: Leadership and Governance Our organization is guided by our Chief Information Security Officer (CISO) who leads our enterprise-wide cybersecurity strategy, compliance, policy, standards, architecture, cyber operations, risk management, governance, and processes. With over 25 years of experience in Information Security, including 14 years as a CISO for several multi-billion-dollar organizations, our CISO brings unparalleled expertise to our security initiatives.

companyName: CONNS INC


text: Our cybersecurity incident response and vulnerability and patch management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO and General Counsel. Such management members work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: However, given the escalating sophistication of cyber threats, the preventive measures we adopt may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of artificial intelligence ("AI") technologies, and the potential challenges in implementing timely preventive measures.

companyName: NETWORK CN INC

ticker: NWCN


text: Our practices include, among others, providing ongoing security awareness training for our global workforce, conducting ransomware and phishing simulations, deploying tools for the detection and analysis of anomalous network activities, and implementing containment and incident response procedures. We are committed to staying abreast of the latest industry standards, and we actively participate in industry forums to exchange insights and stay ahead of emerging cybersecurity threats.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: If management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit and Compliance Committee, who will then escalate the risk to our full Board of Directors, depending on management's assessment of the risk. As discussed above, management also provides regular reports to the Audit and Compliance Committee and to our Board as appropriate.

companyName: Ventas, Inc.

ticker: VTR


text: Our Internal Audit function updates the Enterprise Risk Management Committee of our Board of Directors on a quarterly basis about the Company's enterprise risk management program. These reports are the culmination of a process that involves discussions with leaders across the Company and incorporates a multitude of enterprise risk factors, including cybersecurity threats. The Enterprise Risk Management Committee Chair, in turn, reports to the full Board of Directors a summary of the enterprise risk management presentation.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: Our management team, including the CSO, is responsible for assessing and managing our risks from cybersecurity threats. The CSO partners with the security, technical operations, legal, internal audit, engineering and product development teams to supervise both our cybersecurity program and our retained external cybersecurity consultants, and to stay informed on Okta's security and the overall security landscape. Our current CSO brings over 20 years of cybersecurity and risk management experience to his work at Okta, having held numerous security leadership positions in highly-regulated industries such as finance. Prior to joining Okta, the CSO was Senior Vice President and Chief Security Officer at Symantec Corporation, a leading cybersecurity company, where he had global oversight responsibility for all cybersecurity and physical security programs. His experience delivering cybersecurity at scale extends internationally, and includes security and risk management roles at companies in Australia, the United Kingdom and the United States. Our security team includes individuals with experience across a broad range of cybersecurity areas, including product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk and compliance.

companyName: Okta, Inc.

ticker: OKTA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data results ("Information Systems and Data").

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Sprout Social maintains an overarching security program comprised of several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance. Together, these teams help identify, assess and manage the Company's cybersecurity threats and risks using various methods including, for example, internal and external audits, automated and manual tools, threat assessments for internal and external threats, software and services that identify cybersecurity threats, third party threat assessments, a vulnerability management policy and program, incident response exercises, and, evaluating threats reported to us through an external bug bounty program.

companyName: Sprout Social, Inc.

ticker: SPT


text: Our Board of Directors ("Board") is responsible for our risk oversight, with the Audit Committee specifically overseeing management's cybersecurity risk management program. In this role, the Audit Committee receives quarterly updates from members of management, including the vice president, information technology and CIO, who oversees our information technology function ("CIO") and another vice president who supports the CIO in implementing, monitoring and updating the cybersecurity risk management program, as well as addressing existing and emerging cybersecurity threats and managing cybersecurity incidents ("Head of Information Security"). The Board receives regular reports from the Audit Committee, as well as an annual cybersecurity report from management, including the CIO, highlighting key activities of the Company's cybersecurity team, including internal initiatives and updates and external engagements with third party cybersecurity firms, recent incidents throughout the industry and the emerging threat landscape.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: Our management team takes steps to stay informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment Our Board considers cybersecurity risk as part of its risk oversight function and receives regular updates from the management team on our cybersecurity risks and in addition, management updates the Board where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: SURGE COMPONENTS INC

ticker: SPRS


text: Members of Cohen & Steers' Cybersecurity Management, including its CISO and its CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Cohen & Steers' overall risk management strategy and communicating key priorities to relevant personnel. Members of Cohen & Steers' Cybersecurity Management, including its CISO and its CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate an initial business combination. However, because the assets in our trust account are held in a demand deposit account at a bank and we also depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: CF Acquisition Corp. VII


text: The Company's VP of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with the Company's Chief Financial Officer and other business leaders across the Company, including in cybersecurity and legal and enterprise risk & commercial compliance. The VP of Information Technology has over twenty years of technology experience, during which his responsibilities have included technology operations, third-party assessments and risk management.

companyName: Revance Therapeutics, Inc.


text: As a Company with a single-officer operation and no formal cybersecurity policies in place, we recognize the importance of safeguarding our digital assets and protecting sensitive information. While we strive to maintain the security of our systems and data, our resources and infrastructure are limited. We rely on basic security measures, such as password protection and firewalls to mitigate potential risks.

companyName: FLEXPOINT SENSOR SYSTEMS INC

ticker: FLXT


text: Our Chief Financial Officer and Chief Compliance Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: The Company also relies on certain critical third party IT vendors that support processing, transmission, and storage of data, which has become more critical given the information security risks that are intensified through the Company's increased use of remote work arrangements. The Company has also engaged a third party to help monitor and analyze its system activities.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management, which includes ensuring that the risk management process implemented within our organization is appropriate and functioning as designed. The Audit Committee of our Board of Directors oversees cybersecurity risks pursuant to its charter, and our governance framework includes oversight by the Audit Committee. The Audit Committee, with assistance from our management, including our Head of IT, periodically reports to the full Board of Directors to inform them of potential cyber risks and threats, the status of projects to further develop our information security systems, and the emerging cybersecurity threat landscape.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: The SVP-GIS is responsible for maintaining our IRP. Potentially significant threats are escalated to an interdisciplinary data breach response team (the "DBRT"), which is led our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy and a representative from our Law Department. The DBRT is responsible for oversight and handling of significant security threats, incidents, and issues that involve data loss or operational impact to our business through a documented process. Potentially material cyber events are escalated by our EVP-CIO to executive management and reviewed with members of the Company's Disclosure Committee.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process. As a result, risks posed by cybersecurity threats are among the risks that the Company's ERM process evaluates and assesses at least annually. The results of this risk assessment, including cybersecurity, are presented to the Board of Directors annually.

companyName: ESAB Corp

ticker: ESAB


text: The Compliance Committee is responsible for understanding the global risk landscape of the company and for working to ensure that we have a compliance program in place designed to mitigate, manage and/or monitor risks. The Compliance Committee consists of, among others, our Chief Financial Officer ("CFO"), Chief Legal Officer ("CLO") and Chief Compliance Officer ("CCO"). The CCO has established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of our Chief Information Security Officer ("CISO") and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with our information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: The operations of the Company are dependent on technology information and communications systems. A failure of any such system, or a security breach or cyberattack related thereto, could significantly disrupt the Company's operations. The service providers of the Company are also subject to cybersecurity threats. If the Company and/or any service provider of the Company fails to adopt, implement or adhere to adequate cybersecurity measures, or in the event of a breach of any network, information relating to the Company or the Company's operations, as well as personal information relating to the Company's clients, may be lost, damaged or corrupted, or improperly accessed, used or disclosed.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: We have established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems, data, and operational continuity. We conduct risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of our existing controls. Upon identification and assessment of risks, we develop and implement what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. We maintain change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly review our systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into our overall risk management processes.

companyName: S&W Seed Co

ticker: SANW


text: Lendway's cyber environment at December 31, 2023 consisted primarily of outsourced information technology ("IT") operations. The outsourced provider has a cybersecurity framework which includes multiple products implemented to ensure the security of Lendway's environment. Annual internal and external vulnerability scans are also completed to ensure we mitigate any risks proactively. The Company's internal operations are PC based and the PCs have up to date security software. Regular phishing exercises are conducted, and employee awareness training is conducted annually by our outsourced provider.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: The Audit and Risk Committee of our Board of Directors oversees our policies and practices with respect to risk assessment and risk management, including a review, in coordination with our management, of PMI's management of cybersecurity. Our CISO presents reports to the Audit and Risk Committee or to the full Board of Directors at least quarterly, which reports include cybersecurity risk status along with key performance indicators and key risk response strategies and plans.

companyName: Philip Morris International Inc.

ticker: PM


text: In response to the recent SEC cybersecurity disclosure rule, we have updated our cybersecurity program to incorporate the requirements to disclose, as appropriate or required and if deemed to be material, such a material incident via a Form 8-K within four (4) business days of determining the occurrence of such a cybersecurity incident.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: The Board of Directors receives regular reports from the Chief Information Officer and the Information Security Officer on Plumas Bancorp's cyber risks and threats, the status of projects to strengthen Plumas Bancorp's information security systems, assessments of Plumas Bancorp's security program, and the emerging threat landscape. Additionally, the Chief Information Officer chairs the Technology Steering Committee, which drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. In addition to conducting internal audits, Plumas Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Executive Committees of the Board. The Company also engages with key third-party vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Technology Steering Committee and Board of Directors.

companyName: PLUMAS BANCORP

ticker: PLBC


text: Cybersecurity risk management is integrated within Prudential's risk management framework. Prudential conducts risk identification through several processes at the business unit, corporate, senior management, and board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to Prudential's board of directors or its audit committee for oversight.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is one component of our information security program that guides continuous improvement to, and evaluates these security objectives for our critical systems, data, and operations. Additionally, our cybersecurity risk management program includes a cybersecurity incident response plan. Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST frameworks, guidance and recommendations to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: TERAWULF INC.

ticker: WULF


text: Our board of directors receives periodic reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Our incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Director of Information Technology/Information Security, Data Protection Officer, and the Vice President, Legal. These individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Third Party Risk Program The Company's third-party risk program includes a process for assessing and overseeing the risk profile of third parties we do business with at the time of contract execution and also in the event that the scope of the work done with any third party materially changes.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Management is actively informed about, and monitors, cybersecurity incidents, including their prevention, detection, mitigation, and remediation, through defined processes and reporting mechanisms. This proactive approach includes the alignment of security policies and practices with NIST 800-171 Rev 2 and the organization's enterprise risk management requirements. Twice annually, the CFO and CEO are briefed by the CISO and CIO regarding ongoing projects, investments and changes to the threat landscape that have impacted, or may impact, the organization, ensuring that the highest levels of management are kept abreast of the Company's cybersecurity posture. Overall, this comprehensive approach ensures that management is well-informed and actively involved in safeguarding the Company from cybersecurity threats.

companyName: ITT INC.

ticker: ITT


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Director of Information Security and Director of Information Technology, who reports directly to our Director of Technology Management, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed periodically by such personnel with the goal of addressing changing threats and conditions.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.

companyName: BC Partners Lending Corp


text: Governance; Board Oversight Under the ultimate direction of our CFO, with oversight from the Board, we maintain a security governance structure to evaluate and address cyber risk.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: Our security and legal teams oversee our information security and privacy practices and are responsible for identifying and proactively addressing security and privacy risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and incident response plans and maintaining cybersecurity programs. We maintain an in depth incident response plan that includes a process for identifying, containing and removing any threats and vulnerabilities and a plan to recover and restore normal business operations following an incident. Members of the security team are always on call to be able to address any issues that arise. In addition, we have created a cybersecurity materiality assessment team, which includes representatives from our security, legal, internal audit, communications and investor relations departments that reviews and assesses the impact of cybersecurity incidents on the company, our customers and other stakeholders. Our material assessment framework provides for an escalation path for any potentially material cybersecurity incidents from the security team to our CISO who may further escalate to the materiality assessment team, senior management and the Audit Committee. To ensure our preparedness to appropriately respond to cybersecurity incidents, the cross-functional team meets regularly and conducts simulations of cybersecurity incidents to test its procedures.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on Cadrenal's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: Cadrenal Therapeutics, Inc.

ticker: CVKD


text: The Fund depends on and engages various third parties, including service providers, to operate its business. The Fund relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.

companyName: John Hancock Comvest Private Income Fund


text: Mesabi Trust does not have any directors, officers or employees. The Corporate Trustee is responsible for oversight of Mesabi Trust's risks from cybersecurity threats as it relates to financial record keeping, cash and investment management, administration and reporting. The Corporate Trustee also serves as registrar and transfer agent for the Trust. The Corporate Trustee has dedicated personnel responsible for assessing and managing Mesabi Trust's cyber risk management efforts, informing senior management of the Corporate Trustee regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts. The Corporate Trustee's information technology team has significant experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Corporate Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Corporate Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Corporate Trustee. The Corporate Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Corporate Trustee's overall risk management process. The Corporate Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions, computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Corporate Trustee has an annual assessment, performed by a third-party vendor, of the Corporate Trustee's cyber risk management program. Other non-technical protocols include securing of documents and work areas that could contain non-public information and independent verification of information changes by outside vendors. Mesabi Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, results of operations, cash flows or reputation. The Corporate Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Mesabi Trust's focus, financial condition, results of operations, or cash flows. See "Risk Factors – General Risk Factors – The Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, financial record keeping, investment management, reporting, results of operations, cash flows or reputation."

companyName: MESABI TRUST

ticker: MSB


text: Chief Technology Officer and General Manager is responsible for assessing and managing cybersecurity risks, through his oversight of our IT service provider that manages our IT, but he does not have specific cybersecurity expertise. The Company has an Information Technology Policy that, among other things, governs and provides for cybersecurity policies and processes, including to define safety measures to protect the Company's confidentiality, integrity and availability of data and other intellectual property, as well as to define the manner in which information is stored, saved and routed in the Company's network. Additionally, the Board and management believe cybersecurity represents an important component of the Company's overall approach to risk management and oversight, especially as the Company moves towards commercialization of its first product.

companyName: Microbot Medical Inc.

ticker: MBOT


text: The VP of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the VP of IT Security informs executive management regarding cybersecurity risks and incidents and provides regular updates about cybersecurity incidents to the Board, the Chief Operating Officer and other members of the executive management team as well as to the Audit Committee and the Board of Directors, as appropriate.

companyName: SEMTECH CORP

ticker: SMTC


text: Our Board of Directors addresses NetScout's cybersecurity risk management as part of its oversight function. The Board of Directors' Audit Committee is responsible for overseeing NetScout's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our Council, in turn, oversees management's cybersecurity efforts.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: The Company has a cybersecurity strategy designed to protect our information systems and data from an evolving cyber-threat landscape. Our cybersecurity program, administered by the Company's Senior Network Administrator and overseen by the Audit and Compliance Committee, has the support of executive leadership and the Board of Directors, and the Company continues to invest in cybersecurity to protect the Company's systems.

companyName: TENAX THERAPEUTICS, INC.

ticker: TENX


text: Our information security team manages and enhances our cybersecurity infrastructure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We utilize cybersecurity tools, including the NIST Cybersecurity Framework, in assessing the threat landscape and continuously monitoring our environment.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Controls assessments are completed annually with respect to any remediation activities that have been identified and completed as part of the cybersecurity program. Avanos engages third-party vendors to conduct assessments and deliver their recommendations for improvement annually. Where appropriate, third-party vendors also assist with remediation projects.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Governance and Management's Responsibilities IT management is responsible for the cybersecurity program that assesses and manages cybersecurity risk. Specifically, our Director, IT Infrastructure & Cybersecurity is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents while at the executive level, the Chief Administrative Officer oversees the program and is the executive sponsor.

companyName: Third Harmonic Bio, Inc.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: 6. Risk Monitoring and Review -Continuously performed to evaluate any changes or the need for changes. The Company uses the Ontrack software solution ("Ontrack") to monitor and track all aspects of risk assessment. Ontrack also serves as tool to track any cybersecurity incidents and remediation tasks.

companyName: AVITA Medical, Inc.

ticker: RCEL