text: Our CISO, who reports directly to the Chief Risk Officer, has primary responsibility over Jack Henry's overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response. Our CISO has more than 20 years of technology and cybersecurity experience, including previous senior leadership roles at major financial institutions. The information security team, under the direction of the CISO, regularly monitors general cybersecurity trends and institutes preventative efforts and defensive measures to protect against cybersecurity threats.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Our chief information officer is responsible for hiring appropriate personnel and helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our chief information officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

companyName: Iridium Communications Inc.

ticker: IRDM

secItem: Item 1C


text: The Company's vulnerability management program conducts assessments with specified frequencies for specific asset types to validate system health against known threats. The Company leverages multiple tools, which are routinely updated with new threat signatures, to continually respond to evolving threats identified as part of its threat detection capability. The Company also maintains a cybersecurity insurance policy.

companyName: Johnson Controls International plc

ticker: JCI


text: Assessing, Identifying and Managing Material Cybersecurity Risks & Integrated Overall Risk Management. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Our Adviser's cybersecurity program includes a comprehensive policy framework, reviewed and updated annually; security awareness training for all employees, completed annually; technology risk assessments for critical information systems and applications, performed annually and following all changes to these systems; monthly vulnerability scans; quarterly technology risk assessments and the use of software to protect the confidentiality, integrity and availability of our systems, including the use of anti-malware applications and the use of programs that log, monitor and audit system activities. The effectiveness of our Adviser's cybersecurity programs is evaluated regularly through both internal and third-party audits. We may also engage third parties to conduct risk assessments.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: The Board of Directors, through its Audit Committee, holds at least quarterly meetings to discuss the matters within the Audit Committee's scope, including to review and discuss our cybersecurity threat management. The Audit Committee oversees matters related to cybersecurity threats and hears reports from our SVP Engineering and Chief Information Security Officer about our guidelines, policies, and practices regarding cybersecurity risks as well as any updates of certain cybersecurity threats faced by us and steps we are taking to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats risk and mitigation.

companyName: Grindr Inc.

ticker: GRND


text: the use of a third-party Managed Security Service Provider ("MSSP") that includes a 24x7 security operations center ("SOC") that is designed to monitor and analyze suspected suspicious activity on our internal network and remediate or escalate activity as appropriate; regular cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: Key features of the DSCP include access controls, security training, system security testing, dedicated security personnel, security event monitoring, and when necessary, consultation with third-party data security experts.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: We did not identify any cybersecurity incidents during the year ended December 31, 2023 that have materially affected or are reasonably likely to materially affect Solitario's business strategy, results of operations, or financial condition.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all of the information systems we use. Incidents may lead to reputational harm, revenue and client loss, legal actions, or statutory penalties, among other consequences. For a more detailed discussion of these risks, see our discussion in the Risk Factors in Item 1A of this report.

companyName: UNION PACIFIC CORP

ticker: UNP


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents, and (4) our assessment of new products and business processes;

companyName: ATN International, Inc.

ticker: ATNI


text: The ISO has served various roles involving anti-money laundering, law enforcement, security, and information technology for over 7 years. The ISO holds an undergraduate degree in Legal Studies and master's degree in Criminal Justice and Criminology. The ISO reports to the Chief Financial Officer ("CFO") as well as the Chairperson of the ERC. The CIO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 12 years. The CIO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor ("CISA"). The CIO reports to the Chief Executive Officer ("CEO").

companyName: LAKE SHORE BANCORP, INC.


text: Incident materiality The Incident Response Program is a component of the Company's Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response program includes timely notification of a material cybersecurity incident to the to the appropriate law enforcement, regulatory agencies, Board of Directors and other members of senior management.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: North Haven Net REIT


text: Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will prevent material compromises to our information technology systems in the future that could have a material adverse effect on our business. As of the date of this filing, we are not aware of any current cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Risks Relating to Information Technology, Cybersecurity and Privacy" in our Risk Factors in Item 1A of this Form 10-K.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: Incident and risk event levels each vary from level 3 (or low) risk to level 1 (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., SEC), authorities (e.g., F.B.I., Department of Justice), clients, third parties or internal personnel.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Our CDO has over 25 years of experience at technology companies and has been in the security space for over 18 years, including serving as chief security officer at a public company and leading security engineering at another public company. Our CDO also serves on the board of directors of a publicly traded cybersecurity company. Our CDO holds an undergraduate degree in electronics engineering and a graduate degree in business administration and management. Our CISO has over 18 years of experience managing cybersecurity risks in the technology industry, including serving as the acting chief security officer at a public company and holding other senior cybersecurity leadership and operational roles at other companies. Our CISO holds an undergraduate degree in computer engineering and graduate degrees in electrical engineering and business administration. Our CFO, CLO, VP of Internal Audit, and VP of Ethics, Compliance and Risk Management each hold undergraduate and/or graduate degrees in their respective fields, and have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: TWILIO INC

ticker: TWLO


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: See Item 1A. "Risk Factors" of Part I of this Annual Report on Form 10-K for discussion of cybersecurity risks that are reasonably likely to materially affect the Company.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: The Company Risk Committee ("CRC") serves as the management committee responsible for Information Security oversight and the CISO is a member of the committee. The Risk Oversight Committee ("ROC") is a sub-committee of the Board of Directors (the "Board") and provides direct oversight of Information Security on behalf of the Board. Kim E. VanGelder, the current Chair of the ROC, has served as a member of our Board since 2016, and has held progressive information technology leadership roles at the Eastman Kodak Company, with responsibilities including cybersecurity, global applications, and global technology infrastructure and has served as its Chief Information Officer since 2004.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: We employ a comprehensive set of processes to monitor and mitigate cybersecurity risks. These processes include: a.24x7x365 Security Alert Monitoring e. Internal and External Security Assessments f. Security Awareness Training Programs g. Identity Management h. Incident Response Plans i. Data Encryption These processes are regularly reviewed and updated to adapt to evolving cybersecurity threats. Our cybersecurity personnel provide regular reports to the Board of Directors.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees and reviews the design and effectiveness of the Corporation's cybersecurity program and its contingency plans and provides regular reports to the Board of Directors of the Corporation. The DPM provides periodic reports to the Audit Committee, the Corporation's Chief Executive Officer, Chief Financial Officer, and other members of senior management at each of the Audit Committee meetings and in the event of a cyber incident deemed material. These reports include updates on the Corporation's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: We conduct vulnerability scans of business critical systems on an annual, quarterly, and daily basis. We utilize external third parties to assist in assessing our systems, conduct scans and provide reports based on these scans and we address vulnerabilities as they are identified. We generally review current and prospective third party service providers for cybersecurity risks.

companyName: Sonendo, Inc.

ticker: SONX


text: Our cybersecurity strategy prioritizes detection, analysis, and response to mitigate unknown and unexpected threats and security risks. Our cybersecurity risk management processes include technical security controls, monitoring systems, employee training, and management oversight to assess, identify, and manage risks from cybersecurity threats. We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy, and confidential information handling. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See "Risk Factors" in Item 1A of this Annual Report for additional information about our cybersecurity risks.

companyName: Enservco Corp

ticker: ENSV


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of Service Providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness and spear-phishing resistance training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a vendor management policy for Service Providers.

companyName: Peakstone Realty Trust

ticker: PKST


text: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program. The IR Plan provides a framework for responding to and managing cybersecurity incidents. The IR Plan identifies applicable requirements for incident response, outlines processes for any applicable reporting, as well as provides protocols for incident evaluation, processes for notification and internal escalation of information to the Company's senior management, and the Board and/or appropriate Board committees, as applicable. The IR Plan is reviewed, tested, and updated under the leadership of the Company's Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Refer to Part I, Item 1A. "Risk Factors" of this 2023 Annual Report on Form 10-K for further information about the Company's overall ERM process.

companyName: BADGER METER INC

ticker: BMI


text: Management's Role Managing Risk The Chief Operating Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Chief Operating Officer provides comprehensive briefings to the Audit Committee on a regulatory basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and Chief Operating Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Via Renewables, Inc. The Audit Committee conducts an annual review of the Company's cybersecurity program and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Via Renewables, Inc.

ticker: VIASP


text: The board of directors is responsible for oversight of risks from cybersecurity threats in conjunction with our senior management team and CCS Business Solutions, Inc. This includes receiving reports and updates from our outside partner CCS Business Solutions, Inc. with respect to the management of risks from cybersecurity threats. Such reports cover our information technology security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape. Additionally, the board of directors considers risks from cybersecurity threats as part of its oversight of our business strategy and risk management.

companyName: PIONEER POWER SOLUTIONS, INC.

ticker: PPSI


text: Parker is committed to the protection of the Company's data, data systems and digital assets while in storage, use or transit. Our cybersecurity program is integrated into our overall Enterprise Risk Management program and exists to secure our information systems and data assets, including those data assets entrusted to us by our stakeholders, and to promote our compliance with applicable laws and regulations.

companyName: Parker-Hannifin Corp

ticker: PH


text: In connection with the design, implementation and testing of our cybersecurity program, we also work, as appropriate, with our accountants, independent assessors, legal counsel and other consultants.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: The Company also engages consultants, auditors, and other third parties in connection with these processes to assist in the design of cybersecurity measures and employee training and to test the effectiveness of the Company's processes and measures.

companyName: ALIMERA SCIENCES INC


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Training sessions are held regularly at the senior and executive management levels to validate roles and responsibilities, and response protocols respective to cybersecurity threats.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: For any vendors providing or supporting critical business information systems, we require confidentiality provisions as part of a services agreement defining our business relationship and our requirements for protecting our data.

companyName: SURMODICS INC

ticker: SRDX


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. While we have designed our cybersecurity program with the purpose of minimizing risk and protecting our assets, no cybersecurity measures can eliminate all risks. Therefore, there remains a possibility that we could experience a cybersecurity incident that could have a material impact on our business, results of operations, and financial condition. For more information on this risk, read Part I, Item 1A "Risk Factors – General Risk Factors –Cybersecurity breaches and other disruptions of our information systems could compromise our information and operations and expose us to liability, which would cause our business and reputation to suffer."

companyName: USA Compression Partners, LP

ticker: USAC


text: The goal of our cybersecurity risk management strategy is to protect the privacy, integrity, and availability of our critical systems and information. Our processes identify, assess, and manage material risk from cybersecurity threats as part of our entity-wide risk management efforts. To safeguard our data and the data of our customers, management utilizes a multi-layered approach consisting first of an external security operations center company that specializes in the detection and containment of cyber-attacks. For protection of endpoint devices connected to our network, we use the tailored security software of a third-party consultant company for managed detection and response. Perimeter defense technology is used to filter e-mail for threats from malware viruses and e-mail phishing attempts. We also detect threats through the use of our firewalls that monitor incoming and outgoing network traffic.

companyName: HCI Group, Inc.

ticker: HCI


text: Cybersecurity Risk & Material Effects on the Company The Company does not believe that any risks from past cybersecurity incidents have materially affected the Company or are reasonably likely to materially affect the Company. As to ongoing risks from cybersecurity threats, see Item 1A, "Risk Factors."

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), International Organization for Standardization (ISO) 27001, and Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: KOHLS Corp

ticker: KSS


text: We retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our Chief Operating Officer, to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. CyberTeam has been with the Company since the Company's inception and has over 25 years of experience in cybersecurity.

companyName: PAVmed Inc.

ticker: PAVM


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we leverage strategic external partnerships to assist with assessing and mitigating cybersecurity threats to us. For example, we utilize multiple third-party managed security service providers who perform security operations center consulting and investigative duties as a backup to our in-house dedicated cybersecurity team.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: We use a risk-based approach with respect to our use and oversight of third-party service providers and vendors, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use numerous means to assess cyber risks related to our third-party service providers, including for example use of a managed security service provider ("MSSP") that monitors cybersecurity events for our cloud systems. We also seek to include appropriate security terms in our contracts where applicable as part of our oversight of third-party service providers.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: Our management team, including our chief financial officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our information technology team has over 20 years of experience developing and implementing computer infrastructure, including cybersecurity and audit compliance. We use some of the latest security technologies from leading vendors to help secure our network and to regularly monitor and assess alerts and threat levels. The team possesses various industry certifications and continuously refreshes their skills through relevant training.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Members of management and members of our board take reasonable steps to stay informed about cybersecurity trends, threats, and best practices through ongoing education and training. Management reviews Company employee training programs to ensure employees are being trained appropriately and kept up to date on evolving cyber trends. Training: Certain of our board members have received training to understand cybersecurity risks and their role in overseeing cybersecurity.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: At CommScope, cybersecurity risk is part of our cross-functional Enterprise Risk Management (ERM) program because of the potential for negative impacts of an incident across our business. At least annually we conduct a cybersecurity risk assessment, bringing together threat intelligence, internal assessment of our control posture and third-party opinions. The risk assessment informs our Board and management team and drives the next year's security strategy and initiatives.

companyName: Vistance Networks, Inc.

ticker: VISN


text: With respect to assessing privacy, data and cybersecurity risks, the Company adopts a hybrid approach that primarily aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, including the guidance set forth in the NIST HIPAA Security Rule Cybersecurity Guide, while also evaluating against certain elements of the ISO 27001 and 27005 standards that management believes provide additional levels of guidance or structure. We regularly evaluate the Company's cybersecurity and privacy processes and procedures, both through regular audits by our Internal Audit and IT security teams, as well as regular retention of outside advisors under direction of our IT security team. Among other things, the IT security team oversees an external third party review at least every two years that evaluates the readiness of the entire Company against the NIST Cybersecurity Framework and provides an assessment that measures Capability Maturity Model Integration levels. Additionally, our CISO engages in regular consultations, typically monthly, with third-party cybersecurity advisors. Among other things, these sessions provide the Company with a broader review of the external cybersecurity environment, helping us to stay current on emerging or developing security approaches and risks. Among other initiatives, our CISO and the Company's IT security team actively participate in industry conferences and maintain memberships to resources such as the Health Information Sharing and Analysis Center (Health-ISAC), a trusted community of critical infrastructure owners and operators within the Health Care and Public Health sector which, among other things, allows the Company to monitor email updates and alerts coordinated with the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. In order to maintain awareness of privacy, data and cybersecurity risks, the Company incorporates these topics into its annual compliance training materials that are mandatory for all teammates and new hires, and among other things cover HIPAA privacy and security requirements.

companyName: DAVITA INC.

ticker: DVA


text: Security Engineering - Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We also maintain an incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess the severity of, escalate, contain, investigate, and remediate identified incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct periodic tabletop exercises to test and fortify the controls of our cyber incident response program. The incident response team assesses the severity and priority of incidents, with escalations of cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.

companyName: DROPBOX, INC.

ticker: DBX


text: The Company's information security efforts are led by our Chief Information Security Officer ("CISO"). The CISO meets at least quarterly with each of the Board of Directors, the ELT, and the Senior Leadership Team ("SLT"), facilitating the Company's robust cybersecurity oversight and strategies that help us to assess, identify, and manage cybersecurity risks. This includes performing tabletop exercises at least annually with the Board and with the SLT to evaluate our incident response processes and keeping them informed of the evolving threat landscape and how 1st Franklin is managing such risks.

companyName: 1st FRANKLIN FINANCIAL CORP


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has oversight responsibilities for material risk for the company, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function as a whole, as well as through the audit committee.

companyName: Lyft, Inc.

ticker: LYFT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factors captioned "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—The security or operation of our platform, networks, computer systems or data, or those of third parties upon which we rely, may be breached or otherwise disrupted, and any such breach or other disruption could have an adverse effect on our business and reputation" and "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—Interruptions or performance problems associated with our technology and infrastructure, or that of our third party service providers, including AWS and Azure, may adversely affect our business and operating results."

companyName: Veritone, Inc.

ticker: VERI


text: The Committee receives reports regularly from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any cybersecurity incidents.

companyName: Wag! Group Co.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures aligned to industry standards to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Our Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Operations Administrator, who is supported by Compass MSP, a leading provider of technology managed services. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.

companyName: HCW Biologics Inc.

ticker: HCWB


text: Our board of directors, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to our third party partners. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our approach to cybersecurity risk management with management.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: We are requiring each of our significant third-party service providers to agree that it will implement and maintain appropriate security measures that are consistent with applicable law, implement and maintain reasonable security measures in connection with their work with us, and promptly report any suspected breach of its security measures that may affect our company.

companyName: IO Biotech, Inc.

ticker: IOBT


text: The RMC serves as the primary Management committee in fulfilling enterprise risk management oversight responsibilities, including cybersecurity risk. The RMC provides quarterly updates to the Audit Committee.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Our board of directors reviews our management of cybersecurity risks, and our Audit Committee has been delegated primary oversight over such risks and the steps our management has taken to monitor and control these exposures. Our data privacy and security program is overseen by our IT Director who has presented to the Board on an annual basis. Our Audit Committee also receives briefings on significant cybersecurity incidents.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. The audit committee of our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.

companyName: Yext, Inc.

ticker: YEXT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials ("Information Systems and Data").

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Recovery —bring affected production systems back online carefully, to prevent additional attacks. Test, verify, and monitor affected systems to ensure they are back to normal activity.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: The Board of Directors is responsible for the overall oversight of the Company's enterprise risk management. The Board of Directors receives regular updates on the key risks to the organization on a quarterly basis. The Board of Directors has delegated oversight of cybersecurity risks to the Technology, Data and Supply Chain Committee. The Technology, Data and Supply Chain Committee receives quarterly cybersecurity updates from the Company's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), which include updates on the Company's cybersecurity policies and strategies, cyber risk posture, improvements and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: We use COBIT, or Control Objectives for Information Technologies, as a framework for risk management and manage various controls as required by ISO 27001, 27017 and 27032 standards. We maintain the following certifications: ISO 27001, ISO 27017 and ISO 27032, Cloud Security Alliance Star level 1 and PCI-DSS SAQ A-EP. Our on-premises data centers are SOC 2 certified. In addition to our certifications, we (i) conduct routine employee training sessions and onboarding security training, including phishing simulations, to increase awareness of phishing and other cyber threats; (ii) require multi-factor authentication access methods for all employees into our network; (iii) operate general monitoring and service protections that are subject to continuous enhancements to detect and mitigate various threats, including performing ongoing manual and automatic vulnerability assessment tests; and (iv) manage an ongoing cyber risk-management framework to assess internal technological changes, as well as external systems and services as part of supply chain risk.

companyName: Teads Holding Co.

ticker: TEAD


text: Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Risk Factors" for more information on our cybersecurity risks.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: The cybersecurity risk management program is led by our outsourced security team. At present our Board of Directors does not oversee the cybersecurity risk management program, however, the Audit Committee of our Board of Directors is in the process of implementing procedures to obtain regular updates on our cybersecurity program, including recent developments, key initiatives to strengthen our systems, applicable industry standards, vulnerability assessments, third-party and independent reviews, and other information security considerations.

companyName: Trio Petroleum Corp

ticker: TPET


text: Our Chief Information Officer has been with the Company for more than 25 years, developing and overseeing our information systems and cybersecurity risk management program. Our Chief Information Officer and his team, which includes a cybersecurity professional, are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board and Audit Committee on any appropriate items.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: We also participate in industry groups and with regulators to gain additional knowledge, including, but not limited to, the Federal Bureau of Investigation, U.S. Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security, Electricity Information Sharing and Analysis Center, U.S. Cyber Emergency Response Team, the NRC and NERC. We apply the knowledge gained through industry partnerships, government organizations, external cyber risk platforms, and program maturity assessments to improve our processes to detect and mitigate cyber threats.

companyName: Vistra Corp.

ticker: VST


text: Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, he has been a core part of building Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our current President of Technology joined Visa in November 2013 and has over 30 years of experience in leading the development and deployment of commerce and transaction technologies, which includes overseeing cybersecurity risk and transformational technology initiatives. At Visa, our President of Technology is responsible for the Company's technology innovation and investment strategy, product engineering, cybersecurity, global IT, and operations infrastructure, and for accelerating the integration of engineering and product teams.

companyName: VISA INC.

ticker: V


text: Director of Security and Network Management ("SNM") leads our cybersecurity initiative, holding various information technology ("IT") and security certificates and possessing over 20 years of experience in risk assessments, regulatory compliance (across various frameworks such as ISO 27001, NIST, and GDPR), threat intelligence gathering, and orchestrating coordinated incident response efforts. Our Director of SNM ensures that our cybersecurity team is equipped with up-to-date threat intelligence and uses industry leading tools for threat monitoring and incident response.

companyName: Powerfleet, Inc.

ticker: AIOT


text: The ISSC currently meets quarterly. In addition, various subcommittees meet on an as-needed basis to address business needs. At the ISSC, topics such as changes to the InfoSec risk register, notable issues, and information security projects are discussed.

companyName: EQUINIX INC

ticker: EQIX


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. Our risk management, legal, and compliance personnel oversee and identify material risks from cybersecurity threats.

companyName: Artisan Consumer Goods, Inc.

ticker: ARRT


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Cybersecurity risk is a key operational risk facing the firm, and measures to address such risk are an important component of the firm's overall Enterprise Risk Management ("ERM") framework. As part of our ERM framework, we have implemented and maintain a program to identify, assess, and manage risks arising from cybersecurity threats ("Cybersecurity Program"). Our Cybersecurity Program seeks to mitigate cybersecurity risk and associated legal, financial, reputational, regulatory and/or operational risks by protecting our clients, associates, firm data, and services through a comprehensive, cross-functional approach. Specifically, our Cybersecurity Program is focused on preserving the confidentiality, integrity, and availability of information, enabling the secure and uninterrupted delivery of financial services, and protecting the firm and the safe operation of our technology systems. Further, we consider cybersecurity risks in our business strategy decisions, including in our business continuity planning and in connection with our acquisition activity. We seek to continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory requirements.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: We are not aware of any vulnerability inherent in our systems or malware embedded in our systems that are likely to would materially affect, or are reasonably likely to materially affect, our operations. The Company is in the process of implementing additional training and is in the process of engaging third parties to perform various testing as indicated above.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: We face various cybersecurity threats. The purpose of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: Ladder leverages a senior cybersecurity team (the "Cybersecurity Team") comprised of the Chief Technology Officer ("CTO"), Chief Administrative Officer and General Counsel (the "GC"), Chief Compliance Officer (the "CCO") and Senior Regulatory Counsel, as well as senior representatives from Ladder's outsourced technology firm. The Cybersecurity Team maintains Ladder's cybersecurity program, which is designed to identify, detect and manage cybersecurity risks. The Cybersecurity Team monitors technology trends and developments to inform improvements and adjustments to Ladder's information technology ("IT") infrastructure and oversees the Company's various cybersecurity training initiatives.

companyName: Ladder Capital Corp

ticker: LADR


text: We are in the process of implementing a process to oversee and identify risks from using third-party service providers, suppliers and vendors who have access to our critical systems and information.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: While we have experienced a cybersecurity incident in the past and encounter cybersecurity threats from time to time in the ordinary course of business, none to date have had a material adverse effect on our business, financial condition, results of operations or cash flows. Despite our proactive measures, including expanded employee training and enhanced vendor oversight, cybersecurity threats continue to evolve, and no system can be entirely secure. A future cybersecurity incident could materially impact our operations, financial results, or reputation.

companyName: Pluri Inc.

ticker: PLUR


text: Material Cybersecurity Threat Risks. Risks from cybersecurity threats have not materially affected the Company, its business strategy, results of operations, or financial condition for the year ended December 31, 2024. However, it is possible that the Company could suffer such losses in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Information Risk" contained in Item 1A. Risk Factors.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: 1. Context establishment - Established in accordance with the requirements of International Organization for Standardization 27001 and 27002 ("ISO 27001" and "ISO 27002"). The ISO 27001, Information security management systems, provides a framework and guidelines for establishing, implementing and managing an ISMS and ISO 27002, Information security controls, provides a reference set of generic information security controls including implementation guidance.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Oversight of the information security program sits with the Company's President and ultimately with the full Board of Directors. The full Board of Directors is briefed as appropriate but not less than annually on cybersecurity risks and the Company's efforts to mitigate exposure from those risks.

companyName: DILLARD'S, INC.

ticker: DDS


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, including those related to the Fund.

companyName: John Hancock Comvest Private Income Fund


text: Cybersecurity risks are incorporated into our overall risk management program. If a cybersecurity risk is identified as high-risk, a response and mitigation plan is developed, and progress updates on the plan are routinely reported to the Technology Risk Management Committee and tracked by the Audit Committee of the Board as part of our overall risk management process.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks to provide an additional protection barrier through end-user knowledge.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: The Board, through its Risk Committee, oversees the Company's risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management ("ERM") program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: Training and education, to enable Goldman Sachs' people to recognize information and cybersecurity concerns and respond accordingly; Identity and access management, including entitlement management and production access; Application and software security, including software change management, open source software, and backup and restoration;

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: From an enterprise perspective, we implement a multi-faceted risk management approach based on the National Institute of Standards and Technology Cybersecurity Framework. We have established policies and procedures that provide the foundation upon which IBM's infrastructure and data are managed. We regularly assess and adjust our technical controls and methods to identify and mitigate emerging cybersecurity risks. We use a layered approach with overlapping controls to defend against cybersecurity attacks and threats on IBM networks, end-user devices, servers, applications, data, and cloud solutions.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: All Harrow employees receive information security training (including data protection and fraud awareness) on an annual basis, and we use industry standard technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team would be convened that consists of members from many functions, including legal counsel, the Director of Information Technology and the CEO.

companyName: HARROW, INC.

ticker: HROW


text: Overseeing enterprise-wide risk management is our Risk Management Committee, chaired by our General Counsel and comprised of key members of our executive management team, including the CISO. The Risk Management Committee meets regularly and plays a core role in the identification, monitoring, mitigation, and management of the risks the Company faces and oversees our enterprise risk management framework, including cybersecurity and data protection/privacy.

companyName: Anywhere Real Estate Group LLC


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls applied to financial business processes and supporting information systems are regularly tested and audited by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements.

companyName: JACK IN THE BOX INC

ticker: JACK


text: we provide periodic training and education for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Cybersecurity is reviewed as part of our overall enterprise risk management program, led by our Chief Compliance Officer (CCO), which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to the Audit Committee of our Board of Directors. Cybersecurity risks are reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: The governance of cybersecurity risks is a critical function of our Board of Directors, with the Audit Committee playing a key role in the oversight of cybersecurity and related technology risks. The Audit Committee is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.

companyName: Onconetix, Inc.

ticker: ONCO


text: Our commitment to security is evidenced by our certifications under ISO 27001, ISO 27017, SOC 2 Type II, HIPAA, NIST 800-171 and FedRamp Additionally, we subject our standards-based certifications to annual audits by third parties and have successfully undergone examinations such as the Health Insurance Portability and Accountability Act (HIPAA), validated by qualified third-party assessors. There were no material cybersecurity incidents experienced by C3 AI during the fiscal year ended April 30, 2024.

companyName: C3.ai, Inc.

ticker: AI


text: Comerica also oversees and identifies risks from threats to third parties, such as service providers, through efforts such as monitoring, risk assessments, audits, contractual due diligence and third-party security standards.

companyName: COMERICA INC

ticker: CMA


text: As part of the Company's cybersecurity risk management program, we follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") to assess, identify and manage material risks that arise from cybersecurity threats. Griffon's cybersecurity risk management program is closely tied to and integrated with the Company's overall enterprise risk management processes.

companyName: GRIFFON CORP

ticker: GFF


text: We use a variety of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises, to enhance our cybersecurity posture. Our incident response plan is comprehensive, detailing procedures for preparing for, detecting, responding to, and recovering from cybersecurity incidents. This plan includes processes for triaging, assessing the severity of, escalating, containing, investigating, and remediating cybersecurity incidents, while ensuring compliance with relevant legal obligations. In addition to internal measures, we manage cybersecurity risks associated with third-party suppliers, particularly those with access to our systems or confidential data. We perform due diligence on critical third-party suppliers and monitor identified cybersecurity threats. We require these suppliers to contractually agree to manage their cybersecurity risks according to our standards or to submit to cybersecurity audits conducted by our agents.

companyName: Outdoor Holding Co

ticker: POWW


text: We also have policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service providers. Our third-party service providers provide us with SOC-1 reports, which document their internal controls, on a regular basis. Our executive management team reviews these reports as part of its assessment of the effectiveness of our internal control over financial reporting. We use such reports to assess and mitigate the risks associated with the use of third-party providers.

companyName: Petros Pharmaceuticals, Inc.

ticker: PTPI


text: Management and Strategy regularly assess, identify, and manage material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: We also have plans in place to respond to cybersecurity incidents. These plans address issues relating to preparation for and detection of incidents, as well as responding to and recovering from incidents. We have procedures designed to assess, investigate, contain, remediate, and mitigate cybersecurity incidents, as well as procedures that seek to comply with legal obligations and regulatory reporting requirements. We periodically engage with assessors, consultants, auditors, and other third parties to review our cybersecurity processes.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: The Company trains employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: Our CSO, who assumed his current role in 2022, has over 11 years of cybersecurity experience with us and over 28 total years of cybersecurity and IT experience across various industries, including telecom, engineering, and finance. He also holds several cybersecurity certifications: GIAC Certified Incident Handler, GIAC Certified Penetration Tester, and Certified Healthcare Information Security Leader. Our CSO reports directly to our chief information officer ("CIO"). Our CIO, who assumed his current role in 2011, has 35 total years of cybersecurity and IT experience. Prior to assuming the role of CIO, he served in senior IT and security roles for us beginning in 2001. As a highly decorated United States Air Force officer, he served as a CIO, regional CIO, and chief technology officer responsible for the USAF health system's IT worldwide operations. He also served as a senior staff advisor to various levels of the United States Department of Defense's military health system on strategic matters related to IT policy, procedures, procurement, solutions, and is a subject matter expert on cybersecurity. He has numerous professional certifications and affiliations, including a CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors' Cyber-Risk Oversight Program; Certified Information Systems Security Professional; lifetime member, fellow, and previous board member of the College of Health Information Management Executives.

companyName: Encompass Health Corp

ticker: EHC


text: Our cybersecurity incident response and vulnerability management protocol is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The executive leadership team works with the incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management protocol includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: We plan to implement a Cybersecurity Committee which will be responsible for the day-to-day management of cybersecurity risks, and which will meet bi-monthly to review our practices related to cyber events and risk management. The Committee will be composed of the Chief Financial Officer, Chief Legal Officer, Controller, and Head of Human Resources.

companyName: Ispire Technology Inc.

ticker: ISPR


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance", our board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including our cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and AHL's CISO, with support from the broader Technology team, are responsible for information security strategy, policies and practices. • Collaborative Approach. The Company utilizes a cross-functional approach involving stakeholders across multiple departments, including Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to help mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Apollo Global Management, Inc.

ticker: APO


text: identification of unauthorized use of the information system resources; and deployment of monitoring devices strategically within the information system environment.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: Our CIO holds an undergraduate degree in Business Administration and has served in various roles in Information Technology for over 15 years and has been overseeing the cybersecurity program for 5 years. Our VP information Security hold an undergraduate degree in Information Systems Security and has served in various roles in cybersecurity for over 15 years. Our Chief Executive Officer, interim Chief Financial Officer, and Chief Legal Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Our entire management team periodically participates in the review of our cybersecurity systems, processes, threats and incidents with our internal cybersecurity team, including the controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our entire management team also periodically participates in cybersecurity incident response exercises with our third-party cybersecurity firms to review how material incidents will be handled and reported. Our internal cybersecurity team works closely with our Legal department to oversee compliance with legal, regulatory and contractual security requirements.

companyName: Innovex International, Inc.

ticker: INVX


text: Significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee and, as appropriate, the Board, ensuring that such bodies maintain comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Board of Directors' oversight of risks from cybersecurity threats Our Board has primary responsibility for the oversight of our enterprise risk management and exercises its oversight function in respect of cybersecurity risk through the BRC. The BRC is responsible for overseeing Truist's risk management function, including approving and reviewing Truist's risk management framework and policies, and overseeing management's implementation of such framework and policies. The oversight responsibility of our Board and the BRC is facilitated through management-reporting processes designed to provide visibility to the Board on cybersecurity matters. For example, members of the BRC receive regular reports from our CRO and interim CISO related to information technology and cybersecurity risks to Truist. The BRC meets periodically with risk management advisors and discusses with executive management any cybersecurity recommendations received. Management also discusses urgent cybersecurity developments with the Chairs of the BRC and BTC between Board and committee meetings, as appropriate. The Board annually reviews and approves our Information Security Program and Information Security Policy. Additionally, the BTC provides oversight of Truist's technology strategy, including elements of it that involve cybersecurity.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of GC Advisors when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: Our Board is actively involved in overseeing cybersecurity risk management. At least once a year, senior management, including our Chief Information Security Officer (CISO), presents to the Board on Synopsys' cybersecurity performance and risk profile. Further, senior management and our CISO present semiannually to our Corporate Governance and Nominating Committee (CGN Committee) on Synopsys' cybersecurity risk oversight activities and cybersecurity preparedness efforts. The CGN Committee, a majority of whom are individuals with a strong background in cybersecurity and related matters, meets with members of senior management to review our information technology and data security policies and practices, and to assess current and potential threats, cybersecurity incidents and related risks.

companyName: SYNOPSYS INC

ticker: SNPS


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The Company's Security Steering Committee is comprised of cross-functional executive management team members that collectively possess a high level of cybersecurity and technology operations expertise. The mission of our Security Steering Committee is to focus on defining and deploying its information security strategy, sustaining a robust employee cybersecurity awareness and training program, executing security engineering, providing continuous monitoring of the Company's information security strategy, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies.

companyName: ULTRALIFE CORP

ticker: ULBI


text: Although we have not experienced a cyberattack or other Cybersecurity incident that has materially affected us, we cannot guarantee that we will not experience Cybersecurity incidents that may have a material effect on us in the future. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cyberattacks and other unauthorizedaccess, disclosure, and disruption.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: Annual risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. As part of this process, the Board of Directors, through the Audit Committee, oversees the data protection and cybersecurity program, which includes reviewing management's risk assessments and the steps management has taken to monitor or mitigate our cybersecurity risk exposure. Management regularly provides data protection and cybersecurity reports to the Audit Committee and the Board of Directors, which include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape. For more information about the cybersecurity risks we face, see "Risks Related to Information Technology, Cybersecurity and Data Privacy" in Part I - Item 1A - Risk Factors.

companyName: BARNES GROUP INC


text: The Office of the CISO continually works to enhance our robust enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We have an established playbook to promptly detect, assess, and respond to cyber incidents. Depending on the nature and severity of an incident, this process provides for escalating notification to functional leaders, senior management, our CEO, and the Board.

companyName: BRUNSWICK CORP

ticker: BC


text: We have established and maintains broad incident response and recovery plans that help enable its effective and orderly management of, and response to, any identified security incidents, including escalation and internal and external-notification steps, allowing the incident response team to respond in a timely manner and enlist appropriate personnel and third-party experts. We maintain a process to promptly assess and assign severity levels to any identified security incidents in order to prioritize their importance and promptly direct resources to those issues of potentially greater impact. The notification plan establishes steps to alert external stakeholders as appropriate, including law enforcement, regulatory bodies, investors, customers and other business partners.

companyName: Fortinet, Inc.

ticker: FTNT


text: Management and Strategy review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: Our CISO leads our cybersecurity team and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has 30 years of experience serving in various roles related to cybersecurity and information security. The SSC, chaired by our CISO, is comprised of executive level representatives from our IT, legal, enterprise risk management and internal audit teams and is responsible for oversight, evaluation and coordination of activities related to safeguards, security risk, controls, remediation activities, policy governance and other related security program activities.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect the confidential information and records of all the Bank's clients in accordance with FDIC regulations. Our Information Security Program, along with its associated policies and guidelines, takes into account FDIC and FFIEC regulations and guidance on sensitive information protection as well as information system and domain name security. It is tailored to align with the Company's size and complexity and the nature and scope of our activities.

companyName: BANNER CORP

ticker: BANR


text: We require our vendors to comply with privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We include data protection and security content as part of annual training required of employees.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the ISSC and the Audit Committee. Our CISO possesses over 24 years of experience in various technology, cybersecurity operations, and engineering roles, holds a bachelor's degree in computer information science and a master's degree in technology management, earned a CISO Certificate from Carnegie Mellon University, and is ISC2 CISSP certified.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors and Audit Committee by CIO, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our cybersecurity incident response plan provides for escalation of certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, CDO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our incident response team also reports material cybersecurity incidents to the Chair of the Audit Committee.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Material Effects of Cybersecurity Incidents Except as described in the section entitled "Risk Factors" included in Part I, Item 1A, including, without limitation, the risk factor above titled "We face four primary risks relative to protecting critical information: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of our being unable to identify and audit our controls over the first three risks. In addition, an application, data security or network incident may allow unauthorized access to our systems or data or our customers' data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results" risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. In this instance, materiality is defined as an adverse impact to our critical information, which could result in significant legal and financial exposure.

companyName: CareDx, Inc.

ticker: CDNA


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our patients' health information and all our data.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology ("NIST") standards, among others, and includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing systems operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Despite the low accessibility of our server and system and the resultant low cybersecurity risks that we face, we recognize that no system is completely protected from cyber threats, that cybersecurity risks are increasingly difficult to detect, and that the increasingly digitalized landscape that businesses operate in increase the pervasiveness and severity of cyber-attack risks. While we do not believe our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that we will not be materially affected by such threats or incidents in the future. We will continue to monitor cybersecurity risks with our IT Consultant and stay apprised of changes in the cyber environment.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: In addition, the Company's management team considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks, at monthly performance review meetings. The Company's CEO, CFO and other members of senior management participate in such meetings.

companyName: IPALCO ENTERPRISES, INC.


text: The Company's security awareness program seeks to create a culture of shared responsibility for the security of sensitive data and systems. There is required annual security training and quarterly phishing campaigns for team members with access to Company email. Annually, members of the IT department are required to take IT specific training, and store employees take operations and security training. A third-party led social engineering campaign that targets Kirkland's employees is carried out on an annual basis. Key performance indicators and periodic testing of training materials ensure the program's effectiveness.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: The Audit Committee has established the Enterprise Risk Management Working Group ("ERMWG"), comprising members of our senior management team and other senior leaders, to provide executive oversight of our enterprise risk management program. Our Chief Security Officer ("CSO") is a member of the ERMWG, and together with our Chief Information Security Officer ("CISO") leads an ERMWG sub-working group related to cybersecurity, which meets periodically to review and discuss emerging and key risks relating to cybersecurity at the company, and to provide regular updates to the ERMWG.

companyName: Coinbase Global, Inc.

ticker: COIN


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. IT leadership reports to our CEO and CFO to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We promote a company-wide culture of cybersecurity risk management. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2023.

companyName: CFN Enterprises Inc.

ticker: CNFN


text: Our Audit Committee is responsible for overseeing our cybersecurity and data privacy risks. Our cybersecurity program is led by the Hamilton Company's Chief Financial Officer, who, along with the Hamilton Company's Director of Information Technology who has been with Hamilton for 39 years, provide regular updates each quarter to the Audit Committee regarding this program, including information about the cybersecurity threat landscape, investments in infrastructure and opportunities to protect and enhance the Company's systems and security of products and operations. The also Board receives periodic briefings from management regarding cybersecurity activities and initiatives The Partnership's cybersecurity program is designed to safeguard the confidentiality, integrity and availability of data and systems within the Company's environment to effectively support our business objectives and customer needs. Our commitment to cybersecurity focuses on enhancing our prevention, monitoring, and detection response capabilities to identify and respond to evolving threats. We believe cybersecurity is the responsibility of every employee of the Hamilton Company, and it is prioritized each year. We regularly test, educate, and share best practices with employees of the Hamilton Company to raise awareness of cyber threats through a comprehensive security awareness training program. Our Managed Service Provider is responsible for testing our ability to restore our critical infrastructure on a quarterly basis. Additionally, our incident response and disaster recovery plans are reviewed and updated annually. During 2024, we have not encountered cybersecurity challenges that have materially impaired our operations, business strategy or financial condition.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We have a process requiring newly hired employees to participate in security awareness training and we conduct periodic phishing email simulations. We also have a risk-based process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: The Governance and Technology Committee of the Board (" GTC ") oversees Signet's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Two of the members of our GTC are technology executives employed at their respective organizations who are highly technology-fluent and well-versed on cyber risks. The CISO and CIO regularly brief the GTC on the effectiveness of Signet's cyber risk management program and risk status. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk-mapping exercise. In addition to scheduled meetings, the GTC, CISO and CIO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, members of senior management, and other personnel and advisors, as requested by the Board, report on the Company's financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. Based on these reports, the Board requests follow-up data and presentations to address any specific concerns and recommendations. Additionally, the Audit Committee has opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Our daily operations are monitored by a dedicated IT team. We conduct monitoring of our computer networks, and have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive data, including through the use of encryption and authentication technologies. We assess the adequacy of our cybersecurity measures through annual penetration testing of our computer networks by external consultants, and we have performed tabletop simulations and drills at both a technical and management level around scenarios involving the loss of critical information and technology systems.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: We require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and evaluate whether they employ appropriate and effective controls and continuity plans for their systems and operations.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: >employing tools and controls to support our efforts in identity and access management and device and user management and authentication;

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development and manufacturing, to communicate internally and externally, to operate our accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Gentherm Inc

ticker: THRM


text: Our board of directors, along with the audit committee of our board of directors, is responsible for oversight of our cybersecurity risks and receives regular reports regarding our assessment and management of cybersecurity risks and information regarding any significant cybersecurity incidents.

companyName: OGLETHORPE POWER CORP


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from our internal team; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: Technical safeguards undergo periodic assessment and enhancement designed to protect information systems from cybersecurity threats, utilizing vulnerability assessments, threat intelligence, and incident response experience. Our policies also mandate that our employees contribute to our security efforts. We regularly remind our employees of the importance of handling and protecting customer and employee data through quarterly security training and testing, aimed at enhancing employee awareness and improving their ability to detect and respond to cybersecurity threats.

companyName: OppFi Inc.

ticker: OPFI


text: We have developed and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management company wide. These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is monitored and tracked by our Risk and Information Security Committee, as well as through a separate cybersecurity assessment of the China IT platform opearated by our contractually controlled subsidiary, JiuGe Technology, which is required under PRC laws. The lead information technology manager (the "IT Manager")

companyName: FingerMotion, Inc.

ticker: FNGR