text: First Guaranty and First Guaranty Bank recognize the importance of incorporating cybersecurity in the company's operations, reputation, and overall risk management frameworks. First Guaranty Bank manages cybersecurity for both the holding company First Guaranty Bancshares, Inc. and the bank subsidiary. The IT Steering Committee (ITSC), while reporting regularly to the full Bank Board of Directors (the "Bank Board"), has been delegated oversight to ensure appropriate cybersecurity risk management for risks that are inherent to our organization. These risk management strategies have been implemented into the organization's enterprise risk management frameworks and our Internal Audit Plan. This disclosure is intended to inform investors about cybersecurity risks, risk management strategies, and potential impacts on financial conditions and operations in line with SEC guidance.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: Our Cybersecurity Program, which we are aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, provides a framework for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with our regulators to ensure that these policies are adequately designed to appropriately safeguard personal information. We use a variety of processes and technologies to monitor for and identify cybersecurity threats, including vulnerabilities scans, endpoint and network monitoring software, and email scanning software. We also have a Cyber Incident Response Policy and detailed plans which are updated and exercised annually. Our cyber defenses are reviewed annually by third-party penetration testers using the Adversarial Tactics, Techniques and Common Knowledge ("MITRE ATT&CK") framework and the incident response is reviewed by experienced counsel. We incorporate cybersecurity risk reviews of third-party service providers within our Enterprise Third Party Risk Management Program. We conduct annual Cyber Risk Assessments which drive strategic decisions. Employees are required to abide by our cybersecurity and data protection policies and are provided formal cybersecurity training. We maintain a corporate cyber risk insurance policy as part of our cybersecurity risk strategy that is reviewed annually. To date, the Company has not experienced a material cybersecurity incident.

companyName: OneMain Holdings, Inc.

ticker: OMF

secItem: Item 1C


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a designated team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management and • a third-party risk management process for certain service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Funko, Inc.

ticker: FNKO


text: In the event of a significant cybersecurity incident, we have a detailed Cybersecurity Incident Response Plan (CIRP) in place for informing key stakeholders, ensuring events are properly escalated and for contacting authorities. There are many ways that CommScope might initially learn of a cybersecurity incident, and these potential incidents are escalated, according to decision criteria, to a core team of internal stakeholders comprised of leaders from our information security, legal, business and finance organizations. The core team directs the initial fact-finding and response efforts, and based on their qualitative and quantitative review, may escalate the incident to CommScope's ELT. The ELT then makes the decision on escalation to the Audit Committee or Board based on the team's assessment of materiality. Our incident response plan is regularly validated and assessed to consider the types of decisions that would need to be made in the event of a cybersecurity incident.

companyName: Vistance Networks, Inc.

ticker: VISN


text: Cybersecurity Risk Management & Strategy We define a cybersecurity event as any anomalous activity on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. We have strategically integrated cybersecurity risk management into our broader enterprise risk management program to ensure cybersecurity risks are identified, evaluated and addressed alongside our operational objectives. Overall, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of our data and information by identifying, preventing and mitigating cybersecurity threats and being prepared to effectively respond to cybersecurity incidents when they occur.

companyName: WORLD KINECT CORP

ticker: WKC


text: We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the Company. Our information technology team oversees and implements a range of tools and services designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data. These tools and services include, from time to time: • monitoring emerging data protection laws and best practices regarding application security, access management, device protection, network management, and data loss prevention and recovery and implementing responsive changes to our processes; • undertaking periodic reviews of our partner-facing policies and statements related to cybersecurity; • utilizing intrusion detection and monitoring applications and multifactor authentication; • conducting periodic table-top exercises with management, including our Executive Director, Corporate Information Systems, and testing of our data security, incident response policies and procedures; • conducting periodic cybersecurity management and incident training for employees, including simulated phishing campaigns, which provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses; and • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care.

companyName: Vericel Corp

ticker: VCEL


text: In the event of a potential material risk, the risk is reported to the Chief Information Security Officer, the Chief Technology Officer, the Chief Privacy Officer and to the legal department and the appropriate member of senior management responsible for the function where the risk has been identified. The risk is then reviewed by the Disclosure Committee, which includes among others, the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, and Chief Accounting Officer to determine whether the risk is material for disclosure purposes in accordance with applicable rules and regulations.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: Those responsible for assessing and managing FHLBank's material risks from cybersecurity threats have expertise and experience relevant to their roles. FHLBank's CIO has served in technology and leadership roles for over 30 years, including almost 26 years of experience with FHLBank. During the last 12 years, the CIO has provided oversight and strategic direction for the Information Security area of the Information Technology department. The ISO has more than 25 years of information technology experience, including 24 in the financial industry, and 22 years of experience managing information security. The ISO has a Bachelor of Science degree in Computer Science Information Systems. The Director of Information Security is a retired United States Air Force Lt. Colonel whose primary career focus was in intelligence analysis. The Director of Information Security also has 13 years experience building and leading cybersecurity programs, including cyber threat intelligence programs and cyber regulatory compliance; 16 years of cyber intelligence analysis experience, including military and civilian; five years of continuity of operations and business continuity program development; and holds a Master of Arts degree in Strategic Intelligence Studies and is a Certified Information System Security Professional.

companyName: Federal Home Loan Bank of Topeka


text: The Company maintains a cybersecurity risk management program, led by a Chief Information Security Officer (CISO), that is responsible for the Company's overall cybersecurity strategy, policy, architecture, and cyber threat detection and response. The CISO, who reports to the Company's Chief Information Officer (CIO), has a Bachelor degree in Information Systems and MBA and is a Certified Information Systems Security Professional with over a decade of professional cybersecurity experience. The program aligned industry frameworks and controls from the National Institute of Standards and Technology. Leveraging these frameworks and controls allows the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain cybersecurity, including threat intelligence, multi-factor authentication, endpoint detection and response, and security automation.

companyName: OSHKOSH CORP

ticker: OSK


text: Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: We are committed to maintaining robust oversight and governance of potential cybersecurity risks and to implementing processes and controls that help us identify, assess, manage, and mitigate such risks. To date, we have not experienced a cybersecurity threat or incident that has resulted in a material adverse impact to our business or operations. However, we cannot guarantee that we will not experience such a threat or incident in the future, given the increasing sophistication of those responsible for cybersecurity incidents. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable through our internal processes and tools, we remain potentially vulnerable to known or unknown threats. In some instances, we can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" for more information on our cybersecurity risks.

companyName: Performant Healthcare Inc

ticker: PHLT


text: We use the National Institute of Standards and Technology Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: SIMON PROPERTY GROUP L P


text: Our joint Chief Information Officer and Chief Technology Officer (CIO/CTO) leads management's assessment and management of cybersecurity risk with the assistance of the Company's CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters. Our CIO/CTO has more than 28 years of experience managing technology and risks and advising on cybersecurity issues and our CISO has more than 20 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).

companyName: MCKESSON CORP

ticker: MCK


text: Our cybersecurity risk management program includes, among other things: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information services; • a team comprising information technology (IT) security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; and • a third-party risk management process for service providers.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: Our Board recognizes the increasing significance that cybersecurity has on our operations and business and is responsible for overseeing our cybersecurity plan and risks to the Company from cybersecurity threat actors. From farm to table our operations rely on various information systems and technologies, including those provided by third party suppliers. These systems collect, process, transmit and retain information that may require both mandatory and voluntary data protection regimens.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Management Oversight of Cybersecurity Our Chief Information Officer ("CIO") and the Vice President ("VP") of Information Security have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HERSHEY CO

ticker: HSY


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CISO, who has over 20 years of information security experience; our CIO, who has over 20 years of experience in information technology and cybersecurity; our Deputy CISO who has over 20 years of experience in the information technology and cybersecurity industry; and our Chief Legal & Compliance Officer, who has served as chief legal and compliance officer of various companies for the past five years.

companyName: EVERBRIDGE, INC.


text: Our Director of IT, who reports directly to the Chief Financial Officer and has over 10 years of experience managing information technology and cybersecurity matters and holds various EC-Council certifications including "Certified Chief Information Security Officer", "Certified Ethical Hacker" and "Computer Hacking Forensic Investigator", together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the headings "Failure in our information technology and storage systems or those of third parties upon whom we rely could significantly disrupt the operation of our business and adversely impact our financial condition" and "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: MoonLake Immunotherapeutics

ticker: MLTX


text: Key elements of our cybersecurity risk management program include but are not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and digital assets; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, senior management and our Board of Directors; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, based on their critically and risk profile.

companyName: EVERTEC, Inc.

ticker: EVTC


text: 3.Ongoing Monitoring: We continuously monitor the cybersecurity performance of our third-party vendors throughout the duration of our engagement. This includes regular assessments, audits, and compliance reviews to ensure that vendors adhere to agreed-upon cybersecurity standards and contractual obligations.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Our full Board retains responsibility for the oversight of management's role in assessing and managing cybersecurity risk. The Board is aware of the threats presented by cybersecurity incidents and is committed to taking measures to help prevent and mitigate the effects of any such incidents. The Company's management team and CTO report, at least twice annually, to the Board on risks and issues including to evaluate the status of our cybersecurity efforts. The Board also discusses cybersecurity issues with external experts.

companyName: PJT Partners Inc.

ticker: PJT


text: Based on an assessment using the previously described risk management program, we do not believe that there are currently any known risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. See " Our internal information technology systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business " in Part I, Item 1A, "Risk Factors" for additional information.

companyName: Generation Bio Co.

ticker: GBIO


text: The Company performs an annual risk assessment that includes identifying, assessing and documenting how cybersecurity and privacy risks are evaluated; establishes criteria to evaluate the confidentiality, integrity, and availability of Company systems and nonpublic information; documents how existing controls address identified risks; and leads to the revision of controls as appropriate. In addition, dedicated information technology and executive personnel convene quarterly to examine operational aspects of cybersecurity.

companyName: SAUL CENTERS, INC.

ticker: BFS


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of Unisys' information security program, including compliance and risk management, and the review of cybersecurity risks. The Security and Risk Committee (S&RC), a Board committee comprised entirely of independent directors, assists the Board of Directors in these oversight responsibilities. Additionally, the Audit and Finance Committee has general oversight over Unisys' cybersecurity as it relates to responsibility for Unisys' internal audit function, including cybersecurity practices, compliance with legal and regulatory requirements, and internal control over financial reporting.

companyName: UNISYS CORP

ticker: UIS


text: Our corporate governance committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and the committee is responsible to report any findings and recommendations, as appropriate, to the full board for consideration. Senior management regularly discusses cyber risks and trends and, should any issues arise, they review all material incidents with the corporate governance committee. Our corporate governance and audit committees discuss policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. Our board receives updates on the Company's cybersecurity risk management programs from management.

companyName: Roadzen Inc.

ticker: RDZN


text: Our Chief Compliance & Audit Officer (CCO/CAO) possesses over 27 years of experience in Cyber Security and IT Controls across various complex organizations, including initial tenure at Boston University Medical Center, followed by roles at PricewaterhouseCoopers, Biogen, Vertex Pharmaceuticals, and currently OPKO Health for the past 6 years. The CCO/CAO has a master's degree in Computer Science with a specialization in Cyber Security from Boston University, a qualifying UK law degree from the University of Edinburgh, an MBA in Accounting, and a Master's of Finance from Northeastern University, in addition to a BA in Economics from Dartmouth College.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data. We have integrated cybersecurity risk management into our broader risk management framework. Our digital and technology organization outside the Company continually addresses cybersecurity risk in alignment with our business objectives and operational needs.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: CFO is responsible for the day-to-day oversight of cybersecurity risks, and who utilizes the Coalition management platform for such risk management. Our CFO keeps the Board apprised of ongoing cybersecurity risk mitigation and any breaches if presented.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: We have also established and maintain a comprehensive Global Incident Response Plan designed to enable compliance with reporting standards and provide robust response to global cybersecurity events. Incidents are reviewed by the Global IMS Leadership Team and appropriate members of Senior Management.

companyName: BERRY GLOBAL GROUP, INC.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, and penetration testing firms.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. We regularly engage with third-party consultants in connection with our cybersecurity risk management program, which is overseen by our Chief Operating Officer.

companyName: Expion360 Inc.

ticker: XPON


text: Valvoline has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of critical systems and information in addition to a cybersecurity incident response plan based on the National Institute of Standards ("NIST") Cybersecurity Framework ("CSF"). The program applies, where appropriate, to the Company's internal and external information systems, applications, networks, and operations which includes scanning, testing, and assessments designed to identify risks from cybersecurity threats. Management across various functional teams administer the enterprise risk management program, which is designed to identify, assess, and manage top enterprise risks, including risks arising from cybersecurity threats. Valvoline continually evaluates and makes updates to the Company's cybersecurity programs to align with regulatory requirements and industry best practices in order to keep company-wide training initiatives related to cybersecurity risks robust and up to date.

companyName: VALVOLINE INC

ticker: VVV


text: The VP HR&A manages a team of information technology professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, incident response, insider threats and regulatory compliance.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: As part of our cybersecurity risk management program, we maintain processes to proactively manage potential risks posed by third-party vendors. This involves conducting cybersecurity assessments before onboarding any vendor that may have access to our systems, applications, or data, followed by ongoing monitoring by our GRC team and periodic assessments to evaluate these onboarded vendors' compliance with our cybersecurity standards.

companyName: MeridianLink, Inc.


text: Our cybersecurity program is led by our Chief Information Security Officer (the "CISO"), a Certified Information Systems Security Manager with over 10 years of related experience, including oversight over any third-party service providers used in connection with our cybersecurity program. Our cybersecurity program includes the implementation of controls aligned with best practices in cybersecurity and applicable statutes and regulations to identify threats, detect attacks, and protect our information assets. We use preventative and detective tools and utilities that provide alerts of vulnerabilities and missing patches for our systems. We have implemented security monitoring capabilities designed to alert us to suspicious activity and have developed an incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a breach. In addition, our employees participate in an ongoing program of mandatory annual training and receive frequent communications regarding the cybersecurity environment to increase awareness throughout the company. We have also implemented an annual training program for specific specialized employee populations, including secure coding training. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: JBT MAREL Corp

ticker: JBTM


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including because of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, refer to Item 1A, Risk Factors of this Form 10-K.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: 2023, we encountered no cybersecurity threats that significantly influenced our operational, financial, or strategic outcomes. However, we acknowledge that our cybersecurity measures, while comprehensive, cannot completely eliminate the risk of cyber incidents or guarantee that all such incidents will be detected.

companyName: Crypto Co

ticker: CRCW


text: As a global technology and services leader, our business is heavily dependent upon information technology networks and systems. Protecting our systems, data, and information, as well as the information and data of our game-changers, clients, and partners, is a key priority.

companyName: Concentrix Corp

ticker: CNXC


text: The CISO and Information Security team, together with our Privacy and Data Protection Team, led by a dedicated Data Protection Officer are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors".

companyName: GAN Ltd


text: Event management of a cyber incident follows our Cybersecurity Policy Incident Response Procedure ("Incident Response Policy") which is based upon the NIST framework. The procedure includes incident identification, isolation and containment, investigation, impact analysis, communication, materiality assessment including in aggregate with previous events, and reporting steps and associated ownership. Annually, the Incident Response Policy is tested with the key owners to validate the procedure and for training purposes.

companyName: NGL Energy Partners LP

ticker: NGL


text: The company's Corporate Risk & Compliance division provides risk-based independent oversight of cybersecurity risk management performed by the Information Security organization. Members of the Corporate Risk & Compliance division chair the Technology Risk Committee and the Enterprise Risk Committee.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example assessors, cybersecurity consultants, auditors, and outside legal counsel. CIDARA THERAPEUTICS, INC.

companyName: Cidara Therapeutics, Inc.


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit & Risk Management Committee and the Board provides structured oversight of the Company's risk management program, which focuses on the most significant short, intermediate, and long-term risks the Company faces. The Company has an Information Security Council (the "Council") that is responsible for overseeing the development and upkeep of written policies and procedures aimed at safeguarding the Company's information systems and the nonpublic information stored within them. In addition, the Council plays a crucial role in the governance of the cybersecurity risk management process. This involves collaborating with third-party industry experts and the Company's internal audit team to conduct risk assessments of the Company's information security program (the "Program"). The assessments encompass an evaluation of the Company's adherence to the Program, including the elements of the Program that are dictated by relevant laws, regulations, and the Company's information security policy and procedures. Reports of the Council are shared regularly throughout the year with the board of directors. Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our designated Chief Technology & Innovation Officer ("CTIO").

companyName: SB FINANCIAL GROUP, INC.

ticker: SBFG


text: We recognize the critical importance of effective cyber risk management and response strategies in today's digital landscape. As part of our comprehensive risk management framework, we have developed a cyber crisis and data breach response plan for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. These engagements include routine audits, threat assessments, and consultations aimed at enhancing our security measures. We have incorporated cybersecurity risk management within our comprehensive risk management framework to cultivate responsiveness and a corporate culture that prioritizes cybersecurity risk management. Our cyber risk management team works closely with stakeholders across corporate functions to consistently assess and mitigate cybersecurity risks, aligning with our business goals and operational requirements.

companyName: BrightView Holdings, Inc.

ticker: BV


text: The Board, in coordination with the Audit Committee, will oversee the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Risk Management Processes. We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats to our business and operations and developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems. As a result, we have integrated the management of cybersecurity threats into our broader risk management efforts, implementing policies and procedures to promote cybersecurity risk management and enhance mitigation efforts against cyber-attacks and similar threats. To help secure our systems that store or transmit electronic information, we have implemented multi-layered preventive controls which use aggregated intelligence to proactively detect, block and evaluate attacks. We also maintain a Chief Information Officer who is charged with implementing and overseeing our comprehensive written Information Security Program. In connection with our Information Security Program, we perform cybersecurity risk assessments at least annually to analyze the materiality of identified risks, the likelihood of such risks materializing, and the scope and intensity of adverse impacts if such risks result in the compromise of our information systems or sensitive information stored by us or on our behalf.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: Wiley adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF) as a guide for its cybersecurity program to establish and maintain a continuous improvement process for identifying, assessing, and managing cyber risks and cyber-related threats. Informed by the NIST-CSF, we maintain a cybersecurity risk management program that is designed to identify, assess, manage, and mitigate cybersecurity risks and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. To secure our technology environment, our organization leverages the latest software and security capabilities with a defense-in-depth and layered strategy. We deploy endpoint detection and response, network anomaly detection, and multi-factor authentication across most of our environment. We engage with various third-party consultants as well as utilize various threat intelligence services to assist in our oversight and to identify risks. We require employees with access to our information systems, including all corporate employees and consultants, to undertake annual data protection and cybersecurity training and ongoing phishing simulation exercises. In addition, Wiley's controls are also monitored and tested on a continuous basis by an external third-party to assess the effectiveness of our cyber program.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Our CISO manages our information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cybersecurity threat detection and incident response. Our CISO informs and updates the Board about any information security incidents that may pose a significant risk to us.

companyName: CORPAY, INC.

ticker: CPAY


text: The Innovation and Cyber Committee reports its activities to the full Board on a regular basis and makes such recommendations to the Board and management with respect to risks from cybersecurity threats and other matters as it deems necessary or appropriate.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: The Company's Crisis Management Team has relevant expertise and experience to assess and remediate cyber threats. The CIO has over 18 years of experience in information technology and security, and the CISO has 32 years of information technology experience and 12 years of information security experience.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: The board of directors receives briefings from management and the Cybersecurity Management Team periodically on our cyber risk management program and presentations on cybersecurity topics as part of the board of directors' continuing education on topics that impact public companies.

companyName: Arteris, Inc.

ticker: AIP


text: Oblong's IT team is responsible for assessing and managing cybersecurity risks and has a depth of experience focused on increasing the organization's resilience to security threats and stays current on new developments through monitoring of the cybersecurity landscape. Oblong's IT environment is monitored for potential security threats and security events are investigated and acted on to minimize potential risk to the environment.

companyName: TaoWeave, Inc.

ticker: TWAV


text: To support the Chief Information Security Officer in managing cybersecurity and our Chief Risk Officer in managing cybersecurity risks, we have established a cross-functional cybersecurity team that includes experts in various aspects of information security. This team of employees includes individuals with many years of prior combined work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Chief Information Security Officer and our Chief Risk Officer of any potential cybersecurity incidents. We employ robust and comprehensive processes to respond to cybersecurity risks.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: The information security function is overseen by our Chief Information Security Officer ("CISO") and is supported by the Information Security and Privacy Committee ("ISPC"), which is made up of members of our executive management team including our Chief Legal & Compliance Officer and Chief Information Officer ("CIO").

companyName: EVERBRIDGE, INC.


text: The nominating and corporate governance committee receives periodic reports from our chief financial officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The nominating and corporate governance committee also receives various reports, summaries or presentations related to cybersecurity threats, risks and mitigation.

companyName: LUMOS PHARMA, INC.


text: In collaboration with third-party experts, our corporate cybersecurity organization is led by our CISO, reporting to our CIO. The CIO has more than 20 years of experience as a CIO and in technology leadership positions, with deep expertise in technical strategy, data management, infrastructure and cybersecurity. Our CISO has 25 years of experience in information technology, governance, compliance and risk management and is a Certified Information Security Manager (CISM), which is an advanced certification indicating an individual possesses the knowledge and experience required to develop and manage an enterprise information security (InfoSec) program. The CISO is responsible for our overall cybersecurity strategy, policies, security operations and threat detection and response. The cybersecurity organization manages and continually enhances the maturity of our security posture with the goal of preventing or mitigating cybersecurity incidents to the extent feasible, while increasing system resiliency to minimize business impact.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be adequate, fully complied with or effective in protecting our systems and information.

companyName: LANDS' END, INC.

ticker: LE


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: The cybersecurity risk management process also includes the evaluation of risks from cybersecurity threats associated with the use of third-party service providers, such as vendors engaged by the Company to provide the IT systems used in its operations. As a part of the overall risk management process, the Company evaluates new vendors for security risks before onboarding and regularly monitors third-party vendor performance to identify potential cybersecurity risks. The Company periodically engages with third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management processes.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: Risks from Cybersecurity Incidents As of March 31, 2025, BKV has not been subject to any material cybersecurity incidents and we are not aware of any cybersecurity risks that are reasonably likely to materially affect the Company, its operations, or financial standing. For additional information about cybersecurity risks associated with our business, see Item 1A, " Risk Factors."

companyName: BKV Corp

ticker: BKV


text: The Managing Director oversees the Trust's cybersecurity protocols and conducts regular discussions and reviews of such protocols with the Trust's Board of Trustees.

companyName: NORTH EUROPEAN OIL ROYALTY TRUST

ticker: NRT


text: The CISO works collaboratively with the Risk Committee. The CISO has implemented and monitors a program designed to protect the Company's information systems and to promptly respond to any cybersecurity incidents in accordance with the documented incident response plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams are engaged to identify, classify, and address cybersecurity threats and incidents. Through prompt notifications and ongoing communications, the CISO and other key management personnel work to monitor, prevent, detect, mitigate and remediate cybersecurity threats and incidents.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Our Chief Information Security Officer ("CISO") oversees our information security program, leading a team responsible for enterprise-wide cybersecurity strategy, policy, process, standards, and architecture. Our CISO holds an MBA in technology management and has over twenty-five years of technology leadership experience, along with other certifications in efficiency and project management. Beyond the CISO, the security team in charge of incident management has a strong bench of experienced information security practitioners holding diverse degrees in science, technology, computer science, and mathematics. Members of the operations team have certifications such as the Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Offensive Security Certified Professional ("OSCP"), Certified Ethical Hacker, and many more. They all come from backgrounds that complement professions in security and all of them have at least several years of industry experience.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Management's Role Managing Risk Our CEO, Chief Financial Officer ("CFO"), and Information Technology Manager ("IT Manager") play a primary role in informing the Audit Committee on cybersecurity risks. Our IT Manager has seven years of experience with the Company, which includes management of cybersecurity. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reporting, if any, and learning from any cybersecurity events; • Risk mitigation efforts and insurance, and • Compliance with regulatory requirements and industry standard.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: IRadimed faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks.

companyName: IRADIMED CORP

ticker: IRMD


text: For the fiscal year ended December 29, 2024, we are not aware of any cybersecurity incidents or risks from cybersecurity incidents that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. We cannot guarantee that we may not experience any cybersecurity incidents or risks related to cybersecurity incidents in the future.

companyName: Utz Brands, Inc.

ticker: UTZ


text: The Board's Audit Committee oversees risks relating to cybersecurity threats and the steps management takes to monitor and control such exposures. In addition to other written policies and procedures, the Company has instituted an Information Security Incident Response Plan ("IRP") which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents. Our IRP includes detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be executed from detection to assessment to notification and recovery, including internal notifications to the Audit Committee as appropriate. These incidents may consist of any actual, threatened, suspected, or reported event or occurrence that may affect the confidentiality, integrity, or availability of Company systems or data, or of any such event affecting a third party that may affect Company systems or data. T he objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders. The Audit Committee receives regular reporting from senior officers (such as the Chief Information Security Officer and the Director of Risk Management & Insurance) on operational risk and the steps management has taken to monitor and control these risks. Such reporting includes updates on the Company's IRP, the external threat environment, and the Company's programs to address and mitigate the risks associated with the cybersecurity threat environment. The IRP and internal controls around cybersecurity are periodically evaluated by external experts and the results of those reviews are reported to the Audit Committee.

companyName: BRUKER CORP

ticker: BRKR


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, and, as appropriate, provides briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: Any materiality assessment that results in a determination that a cybersecurity incident is not material would be reported by the Information Security Team, or appropriate members of management, to the ERC Committee at its next scheduled meeting.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser. The Company also relies on the communications and systems of other third-party service providers.

companyName: PENNANTPARK INVESTMENT CORP

ticker: PNNT


text: Primary responsibility for assessing and integrating within enterprise risk management of our cybersecurity risks rests with our Director of Internal Audit, who oversees our governance programs, tests our compliance with standards, remediates known risks, and coordinates our employee training program. The Director of Internal Audit is a Certified Fraud Examiner with over 20 years of planning and managing information technology audits, including information technology general controls for SOX, and cybersecurity breach protocols, policies and assessments.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: Role of Management IZEA's President & COO, our Director, Systems & Security, and our Senior Development Operations (DevOps) leader, are jointly responsible for the day-to-day management of our cybersecurity risks. We have established a Security Council, which includes our President & COO; Director, Systems & Security; Senior Manager, Systems & Security; Chief Financial Officer; General Counsel and other senior officers, that meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our cybersecurity risk management includes enterprise-wide monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on our services, systems, resources, or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Our cybersecurity monitoring and identification efforts include the use of a third- party managed detect and response security service to monitor and take action as necessary, with the response ranging from automated processes to immediately block and remove undesired risks to cybersecurity team review and action, depending on the nature and severity of the risk. We have a Cybersecurity Incident Response Plan which provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, and includes activating crisis, or business continuity recovery plans, as appropriate. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: Oversee Third-party Risk The Company implements processes to oversee and manage the risks inherent with third-party service providers, including conducting thorough security assessments prior to engagement. This is designed to mitigate risks related to data breaches or other security incidents originating from third party providers.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: In the event our Information Security team classifies a cybersecurity incident as posing a "critical risk," our Disclosure Committee, which includes our Chief Legal and Policy Officer and Chief Accounting Officer, is immediately notified of such classification via functions within our digital work environment. The Disclosure Committee, in consultation with our Information Security team and Chief Information Officer, engages in an assessment of the materiality of the cybersecurity incident, under applicable disclosure standards, including material developments throughout the incident response process. Our Board of Directors would be promptly informed upon identification of any material cybersecurity event.

companyName: EQT Corp

ticker: EQT


text: We have engaged the services of various third-party service providers to, among other things, review and evaluate our processes and procedures designed to control access to our information systems, perform penetration testing on our cybersecurity systems on a biannual basis, and provide regular information technology reviews based upon the NSIT Cybersecurity Framework. In addition, we contracted with a third-party managed detection and response security company in the fourth quarter of 2023 to commence testing for cyber vulnerabilities on a continual basis.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: Additionally, in Item 1A, 'Risk Factors' we discuss forward-looking cybersecurity risks that could have a material impact on us. Our disclosures in Item 1A should be read in conjunction with this Item 1C.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: The Fund depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Fund relies on the expertise of information technology, legal and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Stone Point Credit Income Fund


text: The Cyber Incident Policy sets forth a process to report cybersecurity incidents that is intended to enable a rapid organizational response to mitigate risks and also to ensure compliance with our public reporting obligations. This process includes incident identification, reporting channels to report any cybersecurity incidents, reporting procedures with respect to information to be included in any incident report, provision for confidentiality of information reported, the initiation of a response process to any reported incident, communication of a reported incident to the Cybersecurity Committee and other stakeholders, and ongoing training and awareness of employees. In addition to our internal reviews we may from time to time engage external cybersecurity firms to assist with investigations and external cybersecurity experts to evaluate our processes, including conducting penetration tests, to report on our cybersecurity infrastructure and processes to our senior management and to the Enterprise Risk and Audit Committee (the "Audit Committee") of our Board. Our Cyber Incident Policy also establishes procedures for engaging law enforcement should the need arise and defines certain parameters with respect to drafting initial incident reports, technical assessment reports, and financial impact reports for review by the Cybersecurity Committee, management, the Audit Committee, and the full Board, as appropriate.

companyName: Celsius Holdings, Inc.

ticker: CELH


text: The GRCC prioritizes top enterprise and emerging risks for reporting to and dialoguing with our executive staff at least quarterly, and from this discussion, risks are presented to the Nominating and Governance Committee to consider for further assessment and report-out either to a committee or the full Board as appropriate.

companyName: EQUINIX INC

ticker: EQIX


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) program. As part of the Company's ERM program, the Board receives a report at least annually from the Company's chief executive officer and chief legal officer concerning the Company's risks, which include cybersecurity risks.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: Security Awareness Training for Personnel : We provide comprehensive employee training on cybersecurity awareness, confidential information protection and simulated phishing attacks.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: Material Cybersecurity Risks, Threats & Incidents The Company relies on information technology and third party vendors to support its operations, including its secure processing of personal, confidential, sensitive, proprietary and other types of information. The Company and its vendors may not be able to protect all of their respective information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. While the Company has not experienced any material cybersecurity incidents, there can be no guarantee that it will not be the subject of future successful attacks, threats or incidents.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: The Company focuses on building cybersecurity awareness with its employees and other end-users through training and security exercises and communicates the Company's expectations of employees and contractors with respect to cybersecurity matters.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: The IT Manager plays a pivotal role in informing the board of directors on cybersecurity risks. The IT Manager and members of senior management meet regularly and provide comprehensive briefings to both the board of directors. These briefings encompass a broad range of topics, including: the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies;

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Process We strive to follow the guidelines set by the National Institute of Standards and Technology Cybersecurity Framework to manage information assets, protect sensitive data and mitigate security risks. To address risks from cybersecurity threats, we maintain an information security team, automated monitoring and detection services, and policies and procedures for managing risk to our information systems. As part of our information security program, our operations strive to assess, identify and manage cybersecurity threat risks by: • identifying cybersecurity threats and critical information assets; • implementing cybersecurity prevention, detection and response controls; • incorporating cyber risk assessment practices into program activities; and • integrating cyber risk management into our business risk governance practices.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: The Company's Internal Audit Department, including third parties engaged by Internal Audit, evaluate the overall effectiveness of the Bank's cybersecurity risk management strategy which is reported to the Audit & Risk Committee of the Board. In addition, the Enterprise Technology and Enterprise Risk Management Departments provide reports to the Audit & Risk Committee of the Board discussing items such as the Departments' efforts to prevent, detect, mitigate, and potentially remediate cybersecurity risks, cybersecurity status updates, and current cybersecurity trends in the banking industry. Finally, the Company's Board participates in training at least annually on the Directors' role in managing cybersecurity risks.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Board oversees the Company's cybersecurity risks management and reviews management reports on material cybersecurity risks and issues on an as-needed basis. The chief executive officer (the "CEO") and the chief financial officer (the "CFO")

companyName: Singularity Future Technology Ltd.

ticker: SGLY


text: The Company maintains a cybersecurity program guided by the ISO 27001 information security standard for information security management systems that is reasonably designed to protect its information, and that of its customers, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of its information systems.


text: We are increasingly dependent on sophisticated software applications, computing, and cloud infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: As part of the shared services integration with Energy Transfer, we are transitioning to a shared services cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. As we are in the midst of that transition, currently certain of our information systems are operating under the shared services cybersecurity program, while certain other information systems remain under our internal USAC cybersecurity program. We expect that once the shared services implementation is complete, all of our information systems will operate under the shared services cybersecurity program.

companyName: USA Compression Partners, LP

ticker: USAC


text: Our Manager, Information Security, who reports to our Vice President, Information Security, is responsible for managing our security analyst team and the tactical execution of security operations. He has nine years of experience in security roles, including seven years in technical system administration roles. He also has the following certifications: ISC2 CCSP, ISC2 SSCP, CompTIA Security+, EC-Council Certified Encryption Specialist ("ECES"), EC-Council Certified Incident Handler ("ECCIH").

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Finally, as a means to ensure that our senior executive management has an integrated understanding of the cybersecurity and other risks facing the company at any particular time, the Company has organized a Management Enterprise Risk Management Committee (the "management ERM committee"). Our Chief Risk Officer leads this committee, whose membership includes the Company's President and the leaders of our major business lines and back-office functions. Among other things, the management ERM committee reviews the Company's cybersecurity and other risk metrics and the direction in which each risk is trending (increasing risk or decreasing risk), both in isolation and in the context of other existing and emerging risks facing the company, and the status of risk mitigants therefor. We believe that this committee helps management better focus its efforts to minimize cybersecurity risk and that it assists in more focused reporting of cybersecurity risks to the Board of Directors.

companyName: RENASANT CORP

ticker: RNST


text: Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding our information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor our information systems and provide threat detection alerts. The Bank's strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of our systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.

companyName: RBB Bancorp

ticker: RBB


text: The Board receives formal cybersecurity updates at least quarterly from the Director of Information Technology, the Chief Operating Officer, and the Chief Risk Officer. These reports include updates on emerging threats, incident response activities, regulatory developments, and enhancements to cybersecurity frameworks. Additionally, the Board periodically conducts cybersecurity resilience reviews, including scenario planning and tabletop exercises, to evaluate preparedness for potential cyber incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank also provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.

companyName: BayCom Corp

ticker: BCML


text: The Bancorp's Information Technology (IT) and Information Security (IS) teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. The Bancorp's Information Technology and Cybersecurity Risk Management (IT CSRM) team, as part of the Bancorp's Risk Management division, provides independent risk management oversight to those IT and IS teams. In addition to the Board oversight discussed below, the Bancorp's Internal Audit function independently oversees, reviews and validates these activities and reports to the Board of Directors on the effectiveness of governance, risk management and internal controls.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including (i) Real or perceived errors, failures, or bugs in our platform could adversely affect our operating results and growth prospects, (ii) Any security incident, including a distributed denial of service attack, ransomware attack, security breach or unauthorized data access could impair or incapacitate our information technology systems and delay or interrupt service to our clients and consumers, harm our reputation, or subject us to significant liability, and (iii) We are subject to industry standards, governmental laws, regulations and other legal obligations, particularly related to privacy, data protection and information security, and any actual or perceived failure to comply with such obligations could harm our business.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security and Information Technology teams complete security reviews on the vendors. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with our Vendor Management team to review SOC 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.

companyName: BROOKLINE BANCORP INC


text: In general, our incident and crisis management plans are aligned with the National Institute of Standards and Technology ("NIST") framework for cybersecurity. These plans are intended to provide a framework and processes that allow us to take a consistent approach to cybersecurity before, during and after a cybersecurity incident. Our plans are reviewed and updated periodically. In addition, we conduct cybersecurity tabletop exercises to simulate an actual incident and increase our team's awareness and preparedness. Based upon these activities, we maintain a risk register to track identified vulnerabilities and associated mitigation plans. We also regularly conduct security awareness training and phishing exercises for our employees around the world to help them identify and report suspicious activity.

companyName: Ingredion Inc

ticker: INGR


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives an annual briefing from our Chief Information Officer, or CIO, on our cybersecurity program, including risks and priorities.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Our Security Management Team is responsible for day-to-day management of cybersecurity risk, including hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity risk assessment and management processes are implemented and maintained by the Security Management Team. Our Security Management Team includes our CFO who has more than 15 years of experience in managing IT departments, and certain members of our IT department who have over 25 years of experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management.

companyName: aTYR PHARMA INC

ticker: ATYR


text: The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses all aspects of the corporate information technology environment.

companyName: XPEL, Inc.

ticker: XPEL


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • Cybersecurity awareness training of our employees; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: REGIS CORP

ticker: RGS


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting financial institutions. We recognize the critical importance of maintaining the safety and security of our systems and data and employ a multi-layered strategy for overseeing and managing cybersecurity and related risks. Our board of directors (the Board) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We believe we have not experienced any cybersecurity incidents that have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: We regularly engage third parties to perform cybersecurity audits to identify opportunities and enhancements to strengthen our policies and practices. We also annually engage an independent third party to perform internal and external penetration testing of our systems.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Processes to identify material risks associated with the use of third-party service providers. In addition to internal resources, we utilize third-party service providers to supplement and maintain our information technology systems. We have procedures to oversee and identify cybersecurity risks associated with our use of these third-party service providers, including procedures that apply if a cybersecurity incident occurs at a third-party service provider that results in our systems or data or our customers' data being compromised. These processes and procedures include, among others, a diligence review conducted by our information technology team of substantially all of our external business partners and a focused review of any such third parties' cybersecurity audit attestations, such as Service Organization Controls, NIST 800 alignments, ISO certifications, PCI DSS compliance or other recognized external reviews. In the case of a cybersecurity incident affecting a third-party, these procedures also govern interactions with personnel of the impacted third-party to determine the date, scope and effects of the cybersecurity incident, review the response and remediation measures taken by the third-party and conduct an inventory of potentially compromised data. Our notification process for a cybersecurity incident affecting a third-party is the same as the notification process that applies to a cybersecurity incident that affects our own information technology systems and applications.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: Our Management Leadership Team, with oversight from the Board of Directors, has implemented a comprehensive cybersecurity program, including incident response process, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and NIST Computer Security Incident Handling Guide (NIST SP 800-61) to assess, identify, address and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our critical systems, information and assets, including, for example: incident response plan and incident response policy, systems monitoring, vulnerability management policy, third party management program, failover and contingency plans, employee training, cybersecurity insurance, encryption of certain data, dedicated cybersecurity staff, network security controls and data segregation for certain environments and systems, physical security controls, and certain cloud security posture management processes.

companyName: EVERBRIDGE, INC.


text: The output of each of the foregoing committees are collected and analyzed on a regular basis and our CISO briefs the Audit Committee, through quarterly updates as well as on an ad hoc basis between regular updates to the extent needed.

companyName: Gogo Inc.

ticker: GOGO


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because Lightbridge recognizes the significance of these threats to our operational integrity and stakeholder confidence. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: Our cybersecurity risk management program is designed as a holistic program focused on predicting, preventing, detecting, and responding to cybersecurity threats across enterprise systems as well as the operational technology systems for our plants and pipelines. This program involves relevant employees as well as third-party subject matter experts who collaborate to identify and proactively address risks.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: The Board is responsible for general risk oversight. The Board reviews and evaluates management's evaluation and mitigation of cyber risks as part of its oversight of the Company's Risk Management program. Management periodically reviews cyber risks, incidents, and risk mitigation plans and activities with the Board. In addition to recommendations from our senior IT consultant, we engaged an outside consulting firm to conduct a review of our information systems environment and make recommendations to improve security where appropriate. Management shared the report's findings with the Board and periodically updates the Board regarding our progress on implementing the report's recommendations.

companyName: Fresh Tracks Therapeutics, Inc.


text: Cybersecurity Risks The Company faces a number of cybersecurity risks in connection with its business, although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date. While the Company is not aware of any cybersecurity incidents that have materially affected its business as of December 31, 2024, there can be no guarantee that the Company will not be the subject of future attacks, threats or incidents, that may have a material impact on its business strategy, results of operations or financial condition. Notwithstanding the extensive approach the Company takes to address cybersecurity, it may not be successful in preventing or mitigating all cybersecurity incidents or threats. For more information about the cybersecurity risks the Company faces, see the risk factor entitled "Technology is used in operations, and any material failure, inadequacy, interruption or security failure of that technology from cyber-attacks or other events could harm the Company's business" in Item 1A- Risk Factors.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: The Company provides training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: CHUY'S HOLDINGS, INC.


text: Administrative Safeguards: We have implemented policies, security standards and procedures to ensure proper user and protection of our assets. We maintain cybersecurity risk insurance coverage to provide financial protection in the event a cybersecurity breach was to occur.

companyName: VERACYTE, INC.

ticker: VCYT


text: Management Approach have implemented, and continue to enhance, a cybersecurity risk management program designed to identify, assess, and mitigate threats to our systems and data. Current measures include: of firewalls, antivirus and endpoint protection tools, and restricted access to critical systems; authentication for select systems and administrative users; training programs focused on phishing awareness and data security practices;

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: The CSC is also responsible for the executive level supervision of the Company's cybersecurity risk, information security, and technology risk, as well as the IT department's actions to identify, assess, mitigate, and remediate cyber related issues. The CSC receives regular quarterly reports from the Vice President of IT on the Company's cybersecurity risk profile and enterprise cybersecurity program.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: We have implemented a third-party risk management program to proactively identify and mitigate any potential risks that emerge from our supplier and partner ecosystem. We have processes in place to restrict and provide need-based access to sensitive or confidential data for third parties. Additionally, we conduct periodic evaluations of key suppliers and partners for ongoing monitoring of the risk environment.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: At the management level, our VP of Information Security leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Our CISO is responsible for assessing, monitoring, and managing our cybersecurity risks. With over 25 years of experience in the field of cybersecurity, including extensive experience as an enterprise CISO, his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our cybersecurity governance programs, tests our compliance with applicable standards, remediates known risks, and leads our employee cybersecurity training program.

companyName: AUTONATION, INC.

ticker: AN


text: The Company has implemented a Computer Security Incident Response Plan (the "Incident Response Plan") that sets forth the process for identifying, responding to, and recovering from cybersecurity incidents. We have a dedicated cross-functional Incident Response Team (the "IRT") that participates in annual tabletop exercises and simulations with our external cybersecurity legal counsel to test the Incident Response Plan as part of our business continuity, incident response, risk assessment, and disaster recovery planning. The IRT is also responsible for evaluating the level of materiality of any cybersecurity incident in accordance with the Incident Response Plan and may engage the services of third-party experts to assist in the event of a cybersecurity incident.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: MDWerks, Inc.

ticker: MDWK


text: Disclosure of cybersecurity risk, management, & strategy CompuData Supports Pismo Coast Village through their Managed IT Services. This is done through patch management, a managed Network, Managed Security, and Managed 24/7 support. Pismo Coast Village has a comprehensive risk management process that all nodes on the network are set to follow. All external Vendors are SOC II compliant. Our users access all applications utilizing a two-factor authentication method at the Domain level and SSO for third Party applications.

companyName: PISMO COAST VILLAGE INC


text: We identify, assess, and manage cybersecurity risk as part of our company-wide enterprise risk management program. Our Chief Information Security Officer ("CISO"), Tim Rains, has more than 30 years of experience as an IT professional, with over 20 of those years spent in cybersecurity roles. Mr. Rains has held senior cybersecurity advisor roles at both Amazon Web Services and Microsoft. Mr. Rains has experience across multiple cybersecurity disciplines including vulnerability management, incident response, crisis communications, threat intelligence, cybersecurity architecture and operations, governance, risk, and compliance. Mr. Rains is designated as a Certified Information Systems Security Professional and is responsible for developing and implementing plans and strategies to mitigate cybersecurity risks. Our CISO also leads our cybersecurity risk assessment, which includes security posture scoring, vulnerability assessments, process maturity, and tooling coverage. We log cybersecurity risks into our cybersecurity risk register and track such risks for treatment. Management then discusses these cybersecurity risks for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third-party security experts as needed for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements, as appropriate.

companyName: ADT Inc.

ticker: ADT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data, or Information Systems and Data.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Like other businesses, we have been, and expect to continue to be, subject to attempts on unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions and other events of varying degrees. To date, we have not experienced a cybersecurity breach nor are we aware of any of our third-party outside service providers experiencing a cybersecurity breach.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least annually, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with certain members of management, which include our CFO and President. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: KINETA, INC./DE


text: The Audit Committee reviews our cybersecurity program on a quarterly basis, including through review of a quarterly enterprise risk management report, and periodically convenes special meetings to conduct deeper preparedness, enterprise risk and business continuity reviews. These special meetings are open to the full Board to attend. In addition, the full Board periodically receives cybersecurity updates. Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") attend all of these meetings and provide updates during them.

companyName: RALPH LAUREN CORP

ticker: RL


text: While to date we have not experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Any significant disruption to our systems could adversely affect our business and results of operations. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors, " in this annual report on Form 10-K, including the risk factor entitled "Any actual or perceived security or privacy breach or incident could interrupt our operations, harm our brand and adversely affect our reputation, brand, business, financial condition and results of operations."

companyName: Lyft, Inc.

ticker: LYFT


text: Recognizing the complexity and evolving nature of cybersecurity threats, we also engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable our company to leverage specialized knowledge and insights, ensuring its cybersecurity strategies and processes remain at the forefront of industry best practices. Our company's collaboration with these third parties includes regular audits, testing, threat assessments and consultation on security enhancements.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the risk factors under Item 1A. "Risk Factors" in this Annual Report, including "The Company (and the third parties upon which it relies) faces physical security risks, as well as risks related to its information technology systems, potential cyber-attacks, and security breaches.".

companyName: TerrAscend Corp.

ticker: TSNDF


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Item 1A. Risk Factors – General Risks Related to the Company's Business and Operations," which disclosures are incorporated by reference herein.

companyName: CervoMed Inc.

ticker: CRVO