text: We also conduct periodic internal and third-party assessments, threat simulations, and exercises to test the effectiveness of our cybersecurity defenses and controls, including associated policies and procedures. We undertake efforts to address and mitigate risks from vulnerabilities identified during such assessments, simulations, and exercises.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG

secItem: Item 1C


text: We plan to strategically incorporate cybersecurity risk management into all our comprehensive risk management framework, fostering a corporate culture that prioritizes cybersecurity at all levels. This integration shall be done in stages so as to guarantee that cybersecurity factors are ingrained in our decision-making processes throughout the organization. We plan to incorporate a risk management team to collaborate closely with the IT department, consistently assessing and mitigating cybersecurity risks in alignment with our business recognize the intricate and ever-changing nature of cybersecurity threats. To address this, we shall collaborate with external experts, including cybersecurity assessors, consultants, and auditors. This cooperation shall involve regular audits, threat assessments, and consultations to enhance our security measures. These efforts ensure that our cybersecurity strategies adhere to industry best practices and remain effective in safeguarding our systems.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: We use technical safeguards to protect our systems from cybersecurity threats, including firewalls and access controls. As part of our risk management practice, and given the rapidly changing regulatory landscape, we focus on making relevant privacy and cybersecurity training available to all employees, this includes mandatory training for all users on privacy and security best practices, as well as awareness training tied to our phishing campaigns. Topics included in our yearly training include best practices in password hygiene, phishing awareness, data privacy and other focus areas. We periodically test our policies and practices to guard against cybersecurity threats and engage in audits, threat modeling, vulnerability testing and table top exercises.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: During the period covered by this Annual Report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or our financial condition. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, reputation, or financial condition. See Item 1A., "Risk Factors," for a discussion on cybersecurity risks and how they could materially affect the Company.


text: Information Technology and Cybersecurity Management Our Information Security Officer (ISO) is responsible for overseeing the Bank's strategies necessary to ensure the confidentiality, integrity, and availability of electronic information by communicating risk to senior administration, creating, and maintaining enforceable policies and procedures, and ensuring compliance with regulatory requirements.

companyName: River Financial Corp

ticker: RVRF


text: GECM has implemented an information security policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that it stores or processes and the maintenance of critical services and systems. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. GECM's policies and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. GECM's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: (1) cybersecurity risks associated with its physical and digital devices and infrastructure, and (2) cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. This program is based on recognized industry standards and is supported by both management and our Board. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use recognized industry standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Great Elm Capital Corp.

ticker: GECC


text: The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology ("NIST") security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to ensure the efficacy of our security measures.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Senior Director of Information Technology, who has more than two decades of information technology and information technology leadership experience. Our Senior Director of Information Technology, under the supervision of our Chief Financial Officer, manages and monitors our cybersecurity risk (including that presented by our information technology service providers). Our Senior Director of Information Technology is responsible for informing our Chief Financial Officer of relevant cybersecurity risks including, as relevant, the prevent, detection, mitigation and remediation of cybersecurity incidents. Our Chief Financial Officer has over two decades of management experience, including oversight over information technology and cybersecurity matters.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: Our Cybersecurity and Technology Risk Program (the "Program") is designed to protect critical assets, scale with business growth and identify and mitigate threats, enabling us to securely conduct the Company's business. The Program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The Program and other cybersecurity processes have been integrated into our overall risk management framework.

companyName: PJT Partners Inc.

ticker: PJT


text: While we, like any technology-dependent company operating in the current environment, have experienced cybersecurity incidents in the past, we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in, among other things: unfavorable publicity, damage to our reputation, difficulty marketing our products, customer allegations of breach-of-contract, claims and litigation by affected parties, investigations by and other proceedings involving governmental authorities and possible financial liabilities for damages, any of which could materially adversely affect our business, financial condition, reputation and relationships with customers and partners.

companyName: NLIGHT, INC.

ticker: LASR


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.

companyName: QVC INC

ticker: QVCD


text: Employees are required to complete a cybersecurity training annually specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings. We have a set of policies and procedures addressing information security concerns governed by our Written Information Security Program (WISP), other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices. These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee. We currently maintain a System and Organization Controls ("SOC") Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the United States and United Kingdom. Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 standard.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: To serve as an additional protection from outside threats, we also seek to prepare our employees and contractors about cybersecurity risks through cybersecurity training, simulated phishing exercises and awareness campaigns. We conduct employee training bi-annually, and point-in-time training for any phishing failures. We have implemented software and processes and currently use a managed service to help identify and evaluate risks from cybersecurity threats associated with third-party service vendors. In the event of a cybersecurity incident deemed to have a moderate or higher business impact, we have an incident response plan to notify senior leadership and to address how to contain the incident, mitigate the impact, and restore normal operations efficiently.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Although as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Launch One Acquisition Corp.

ticker: LPAA


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are an integral part of our decision-making process. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.

companyName: BANNER CORP

ticker: BANR


text: The Committee receives briefings from our Chief Information Security Officer ("CISO") on our cybersecurity risks no less than annually. In addition, management updates the Committee in addition to the full Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: The Company's CISO has a Bachelor of Engineering degree in information technology and more than 25 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team have also been instructed to elevate any potential cybersecurity issues, whether internal or at a third-party with whom we do business, to the CISO.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Assessing, identifying, and managing material risks from cybersecurity threats We are committed to maintaining robust cybersecurity practices to safeguard our information assets and ensure the confidentiality, integrity, and availability of our operations. We employ a comprehensive approach to assess, identify, and manage material risks arising from cybersecurity threats. The identification and oversight of material cybersecurity risks is included in continuous ERM Committee and Board meetings and reporting.

companyName: LITHIA MOTORS INC

ticker: LAD


text: While we have never had a material cybersecurity incident that impacted our operations, we face various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; employee threats; virtual and cyber threats to our directors, officers, and employees; threats to the security of our facilities and infrastructure; and threats from terrorist acts or other acts of aggression. Our customers and vendors face similar threats. We utilize internal and external independent controls to monitor and mitigate the risk of these threats, including an outside independent Cybersecurity consultant, a Security Incident Response Plan (SIRP) and periodic Information Technology training for all employees.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: The Company completes periodic assessments and testing of its practices addressing cybersecurity threats and incidents. These efforts include, but are not limited to, audits, assessments, tabletop exercises, and vulnerability testing and are focused on evaluation of cybersecurity policy efficacy. These assessments and testing efforts are supported by third-party consultants who specialize in cyber-risk mitigation. The results of these third-party engagements are used to inform enhancements and adjustments to our cybersecurity policies and practices.

companyName: REGAL REXNORD CORP

ticker: RRX


text: We are not aware of any risks from cybersecurity threats or previous cybersecurity incidents (and we are not aware of any) that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: U. S. Premium Beef, LLC


text: We maintain and periodically review and update an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: We regularly assess our programs and control environment, leveraging externally conducted cyber tests and evaluations along with internally managed cyber risk assessments and testing. Additionally, the Company collaborates with industry associations, government authorities and external advisors to monitor the threat environment and to inform our security practices.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Regulatory Supervision Arrow and its subsidiaries are subject to the provisions in the Gramm-Leach-Bliley Act relating to data security, as well as many federal and state laws, regulations and regulatory interpretations which impose standards and requirements related to cybersecurity.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier and partner information that we collect and store.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Our CSO, reporting to our Interim Chief Operations Officer, and in conjunction with our IT Department, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Board of Directors. Our CSO has 3 decades of information technology and cybersecurity experience with the last 7 years leading the cybersecurity activities at Harte Hanks, as well as participating in numerous cyber readiness exercises with U.S. Government agencies, and has specialized training in cybersecurity risk management, cloud security and holds a CISSP certification offered by ISC2. Our CSO is also responsible for the operation of our cybersecurity program, and management of our cybersecurity incident response team.

companyName: HARTE HANKS INC

ticker: HHS


text: Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: As a Company that manages midstream infrastructure for the energy sector, cybersecurity is of great concern to our organization, and we aim to protect our systems, networks and programs from digital attacks. We have endeavored to implement policies, standards, and technical controls based on external cybersecurity standards, such as National Institute of Standards and Technology ("NIST") and ISO frameworks. Like others in our industry, we are reliant on the continuous and uninterrupted operation of our various technology systems. User access to our sites and information technology systems are important elements of our operations, as is protection against cybersecurity incidents. In the ordinary course of our business, we collect and store data in our data centers and on our networks, including proprietary business information, critical operating information, among other types of sensitive information. In addition, the information and operational technology infrastructure we use is important to the operation of our business and to our ability to perform day-to-day operations. We use various processes and tools, including third-party cybersecurity tools and technologies, to aid us in seeking to secure and protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption, including those processes described below.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The Board of Directors is responsible for overseeing and monitoring the material risks facing the Company. The Audit and Risk Committee of the Board is charged with overseeing our risk management framework, including cybersecurity risks. The CISO provides reports on cybersecurity matters and risks directly to the Audit and Risk Committee on a quarterly basis.

companyName: EZCORP INC

ticker: EZPW


text: We have not previously experienced a cybersecurity incident that has materially affected HGV, including our business strategy, results of operations, or financial condition. However, we cannot be certain that we will not experience such an incident in the future. For information on risks we face from cybersecurity threats, see "Our increasing reliance on information technology and other systems subjects us to risks associated with cybersecurity. Cyber-attacks or our failure to maintain the security and integrity of company, employee, associate, customer, or third-party data could have a disruptive effect on our business and adversely affect our reputation and financial performance" in Item 1A. Risk Factors.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: We regularly engage third-party cybersecurity experts to supplement our cybersecurity risk management efforts, including those we engage to conduct periodic cybersecurity risk assessments. During 2024, Unisys engaged an external security firm to conduct several cybersecurity tabletop exercises. Additionally, we worked with an audit firm and directed several audits related to cybersecurity.

companyName: UNISYS CORP

ticker: UIS


text: Under the oversight of the Audit Committee, and as directed by the SVP IT, Company management is primarily responsible for the assessment and management of material cybersecurity risks.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Our Chief Technology Officer manages and monitors the Company's cybersecurity risk and has over 40 years of experience in the technology field. The Cumulus Security Team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that we evaluate and address on a regular basis based on a risk-weighted determination.

companyName: System1, Inc.

ticker: SST


text: We face a number of cybersecurity risks in connection with our business. Although we have numerous controls to protect against common attacks, some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we carry a cyber insurance policy to help cover investigation and mitigation expenses, it may be subject to limitations and be insufficient to cover all expenses that may result from a cybersecurity incident. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. For more information about the cybersecurity risks and other information technology and data privacy risks we face, see Item 1A. Risk Factors and the subsection titled Risks Related to Information Technology, Cybersecurity and Data Privacy.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by Blackstone's CSO and members of BXTI and Blackstone's Legal and Compliance.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: The CISO/CIO, in coordination with senior management including the Office of the Chief Executive Officer, or the CEO, Chief Financial Officer, and General Counsel, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams have been established to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO/CIO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and report such threats and incidents to the Audit Committee when appropriate.

companyName: CareDx, Inc.

ticker: CDNA


text: We have not been materially affected by cybersecurity threats. We may, from time to time, experience threats to and security incidents related to our data systems but we do not believe they are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information, please see the risk factors entitled "Our internal computer systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches or other unauthorized or improper access, which could result in a material disruption of the development programs of our product candidates" and "Security incidents, loss of data or modification of information, and other disruptions could compromise information related to our business or prevent us from accessing critical information, result in a significant disruption of our activities and expose us to liability, which could adversely affect our business and our reputation" in Item 1A- Risk Factors in this Annual Report.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Over the past fiscal year, we have not identified material risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled "Risk Factors" in Part I, Item 1A of this Annual Report.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Noble works with various third-party partners to help execute and advise on cyber security and evaluate maturity assessments as needed.

companyName: Noble Corp plc

ticker: NE


text: Our information security program includes an incident response program that coordinates activities across multiple teams in responding to cybersecurity incidents in accordance with a defined Incident Management Policy. This program is designed to detect, analyze, and escalate cybersecurity events, and includes a cybersecurity incident response team responsible for containment and recovery activities, and a crisis response team to liaise with business stakeholders, secure priority resources, and validate completion of any post-incident activities. In addition, we have established an executive security risk management committee composed of senior representatives of our legal, finance, information security, product, and marketing teams which meets on a quarterly basis to review our information security program and any noteworthy developments in the quarter. Finally, we coordinate internal simulations of cybersecurity incidents periodically to test the processes we have established.

companyName: BILL Holdings, Inc.

ticker: BILL


text: To ensure compliance with industry standards and safeguard sensitive customer data, the Company mandates that all employees, regardless of department or role, participate in annual Payment Card Industry Data Security Standard (PCI DSS) training. This training is designed to educate staff on best practices for handling payment card information securely, identifying potential security risks, and mitigating vulnerabilities. By reinforcing the importance of PCI compliance, we aim to foster a culture of cybersecurity awareness throughout the organization, reduce the risk of data breaches, and maintain the highest level of protection for our customers' financial information. Failure to complete the required training may result in disciplinary actions, underscoring the critical importance of this initiative in protecting both the Company and its customers.

companyName: GOOD GAMING, INC.

ticker: GMER


text: We devote significant resources to protecting the security of our computer systems, software, networks and other technology assets, and our cybersecurity risk management processes include physical, procedural and technical safeguards. Our cybersecurity policies, standards and procedures include incident response plans designed to help coordinate our response to cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents. We seek to enhance our policies and practices to better protect our platform, adapt to changes in regulations, identify potential and emerging security risks and develop mitigations for those risks, including conducting cyber incident tabletop exercises with our management team.

companyName: KADANT INC

ticker: KAI


text: Our Audit Committee also meets at least quarterly with our independent registered accounting firm and communicates with them regarding any cybersecurity-related risks.

companyName: BTCS Inc.

ticker: BTCS


text: Following our risk assessments, we evaluate when and how to design, implement, and maintain reasonable safeguards to minimize the identified risks and address any identified gaps in existing safeguards, and proceed with such design, implementation, and maintenance as deemed appropriate. We also engage third-party service providers in connection with our risk assessment process and certain risk management processes. Our collaboration with these third-party service providers includes threat assessments and consultation on security enhancements, 24/7 monitoring and incident response support.

companyName: Talis Biomedical Corp

ticker: TLIS


text: As part of its oversight of our company, our board of directors is involved in overseeing our risk management program. Cybersecurity is an important component of overall enterprise risk management ("ERM"). Our cybersecurity processes are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and industry standards and regulations, including the NYDFS Cybersecurity Regulation and PCI DSS. We address cybersecurity risks through an approach that focuses on preserving the confidentiality, integrity, and availability of our assets, including the information we collect and store, by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents as they occur.

companyName: TRUPANION, INC.

ticker: TRUP


text: Key elements of our information security program include but are not limited to the following: (i) risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; (ii) an information security team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally and by external security and risk audit providers, as appropriate; (iv) cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Cybersecurity updates are provided periodically to Registrant's senior management, including its CEO, CFO and senior vice presidents of Registrant's operations, and to the senior management of Registrant's subsidiaries. Cybersecurity risk management extends beyond Registrant's and its subsidiaries' senior management teams. Registrant's Board of Directors ("the Board") oversees enterprise risk management, or ERM, performed under the direction of Registrant's senior management team. Cybersecurity updates, including recent findings, changes to processes or personnel changes, are provided to the ERM liaison to the Board, who is a member of the Board, and to the full Board on a quarterly basis or more frequently if needed. Cybersecurity is one component of an overall ERM framework that involves Registrant's Board. The Board satisfies its oversight responsibility by obtaining information from the ERM liaison and senior management of Registrant, with input from the senior management of Registrant's subsidiaries as necessary. On a quarterly basis, Registrant's senior management will discuss the implementation status of plans to mitigate cybersecurity risks with the ERM liaison. The ERM liaison and Registrant's senior management will then provide a report to the full Board regarding the critical cybersecurity risks discussed, mitigation plans and implementation of the ERM program that addresses cybersecurity risks.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: The Company has a robust, risk-based cybersecurity program, designed to protect the company's data as well as data belonging to its customers and partners. In addition to performing its annual assessment of the overall cybersecurity risk as part of the Company's Enterprise Risk Assessment evaluation, Magnolia constantly assesses its cybersecurity risks by considering the likelihood of occurrence and the potential impact on the business. The risk identification process considers those common in the oil and gas industry and those that pertain to the technologies within the Company's applications and infrastructure.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: & COO and CEO are responsible for overseeing our business operations and are responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. We also use the services of an outside consulting firm to monitor activity and advise the company of cybersecurity protocols.

companyName: Stemtech Corp

ticker: STEK


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: Our management has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by our Board of Directors of the processes we establish to assess, monitor and mitigate that exposure.

companyName: Ventas, Inc.

ticker: VTR


text: The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to a complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: Braemar Hotels & Resorts Inc.

ticker: BHR


text: We maintain a robust cyber incident response plan that includes controls and procedures designed to allow timely and accurate reporting of any material cybersecurity incident. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources as well. We provide at least annual information security training program for employees who have access to JLL or client related sensitive or personal information and regularly conduct phishing tests and education.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Artificial Intelligence AI possesses the potential to transform various work sectors significantly. Currently, we are in the early stages of enhancing and broadening our offerings with AI technologies, aiming to assist our clients in tackling current challenges. Our dedication lies in actualizing AI's potential while ensuring ethical practices. Our approach is underpinned by fundamental values: ensuring equity, dependability, and safety, maintaining privacy and security, promoting inclusiveness, upholding transparency, and embracing accountability.

companyName: Moatable, Inc.

ticker: MTBLY


text: Our cybersecurity risk management program includes: • an information security management systems policy, including a business continuity policy, acceptable use and physical security policies, and an incident response policy and plan for responding to cybersecurity incidents, among others; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of internal audit teams and external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness, data protection, and privacy training of our employees, incident response personnel, and senior management; and • a vetting and management process for third party service providers, suppliers, and vendors Through this program, our IT/IS team identifies and executes improvements based upon its own assessments, public cybersecurity events and the identification of new risks by third parties, including our external cybersecurity consultants. As part of these continuous improvement efforts, there may be times when the IT/IS team prioritizes certain cybersecurity fixes or program improvements over other measures, which could lead to new known or unknown risks being identified on an ongoing basis. Cybersecurity threat actors are often highly sophisticated and nimble in their attacks. Despite these efforts, we cannot guarantee that our priorities and efforts will prevent any cybersecurity incident from happening.

companyName: Arista Networks, Inc.

ticker: ANET


text: The Board of Directors oversees our risk management process, including cybersecurity risks. The Audit Committee oversees our enterprise risk assessment. The Audit Committee meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity. Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.

companyName: Lightstone Value Plus REIT V, Inc.


text: Data breaches: Unauthorized access to user data, including nicknames, email addresses, country, and identification numbers, could lead to reputational damage, regulatory fines, and legal action, a loss of users and loss of revenue. Disruption of service: A cyberattack could disrupt our service, preventing users from accessing content and impacting our revenue. Loss of intellectual property: Cybercriminals could steal our proprietary content or intellectual property, harming our competitive advantage. Costs associated with responding to a cyberattack: Costs of remediation, legal fees, and regulatory fines, could be significant.

companyName: Mega Matrix Corp.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: Implementation of processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our critical systems and information. For any agreements with service providers that do not contain acceptable protections, we are working to put them in place on an ongoing basis.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Technology and Cybersecurity Risks", which disclosure is incorporated by reference herein.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel, threat intelligence and other information obtained from public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: We have created a robust Information Security Awareness Program to deliver our employees pertinent and timely educational content. Mindful that human error can be a significant factor in cybersecurity incidents, our employees undergo regular training to stay informed about the latest threats and best practices. This reduces the risk of inadvertent security breaches and cultivates a culture of security throughout the organization. Additionally, we regularly conduct social engineering tests on our employees to keep them sharp and alert for threats through email, text messages, and voice calls. Mid Penn did not experience a material incident to our computer systems or networks in 2024.

companyName: MID PENN BANCORP INC

ticker: MPB


text: Our Board of Directors has appointed its Audit Committee as its primary body to oversee management's risk identification, risk management and risk mitigation strategies related to cybersecurity related information technology risks.

companyName: SUPERNUS PHARMACEUTICALS, INC.

ticker: SUPN


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of Unisys' information security program, including compliance and risk management, and the review of cybersecurity risks. The Security and Risk Committee (S&RC), a Board committee comprised entirely of independent directors, assists the Board in these oversight responsibilities.

companyName: UNISYS CORP

ticker: UIS


text: We discuss risks related to cybersecurity threats under the heading "Breaches in data security or other disturbances to our information systems and other networks or our actual or perceived failure to comply with requirements regarding data privacy and protection could impair our operations, subject us to significant fines, penalties and damages, and have a material adverse impact on our business, financial condition and results of operations" included as part of our risk factor disclosures in Item 1A of this Annual Report, which disclosures are incorporated by reference herein. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition and any expenses we have incurred from cybersecurity incidents were immaterial.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: Governance of Cybersecurity Risk Management The Board of Directors has oversight responsibility for our risk management programs, including cybersecurity risk management. The Board of Directors has delegated the specific responsibility of cybersecurity risk oversight to the Audit Committee, although the Board remains actively involved in overseeing cybersecurity risk management, both through presentations given by management during Board meetings, as well as through regular reports from the Audit Committee on its cybersecurity risk oversight activities.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: As part of our information security program, we also have a program in place for management of cybersecurity risks associated with third-party handling of our confidential information, including their provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and our application of established mechanisms for ongoing monitoring of such third parties, including tools such as security ratings services and periodic reassessment questionnaires.

companyName: Alkermes plc.

ticker: ALKS


text: The Cybersecurity Council, in coordination with the Company's outside legal counsel, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Director of Information Technology & Cybersecurity and the Cybersecurity Council monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: EASTERN CO

ticker: EML


text: Incident Response Plan: The Company has established and maintains an incident response plan that governs the Company's response to a cybersecurity incident, and such plan is evaluated on a regular basis. Potentially material cybersecurity risks and incidents are escalated to management and the Board as applicable.

companyName: FARO TECHNOLOGIES INC


text: We use third -party service providers to perform a variety of functions throughout our business, such as: conducting nonclinical and clinical trials; supplying certain raw materials, compounds and components; delivering materials to our facilities; and shipping products to our customers. Additionally, we rely on third -party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and content delivery. Third-party service providers we rely on include: application providers, distributors, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Our vendor assessment process is generally limited to reputational due diligence of the vendor and, in some cases, examination of the vendor's security reports and certifications.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: The Board of Directors is tasked with oversight of the Company's cybersecurity, information governance, and privacy programs. The Audit Committee oversees our ERM program and receives semi-annual ERM updates, which include cyber-related risk items. In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: NEE's vice president and chief information officer, vice president cybersecurity and executive director cybersecurity are responsible for assessing and managing material risks from cybersecurity threats, including, through the MSA, those related to XPLR. They have careers that represent more than 50 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee and the Cybersecurity Governance Executive Committee. These NEE committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries as well as XPLR.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: We also employ a variety of preventative and monitoring tools designed to monitor, block, and provide alerts regarding suspicious activity including suspected. We have established processes and systems designed to mitigate cybersecurity risk, including regular and ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for incoming and outgoing malicious emails and monitor remote connections as a significant portion of our workforce has the option to work remotely.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: The secure maintenance and transmission of confidential information, as well as execution of transactions over the systems of our third-party service providers, is essential to protect us and our customers against fraud and security breaches and to maintain customer confidence. Information security and risk management are an integral part of our new product and service implementation and vendor relationship management to confirm that they all meet the minimum standards and policies established and approved by our Board. We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor selection and onboarding as well as risk-based monitoring of vendors on an ongoing basis.

companyName: HOPE BANCORP INC

ticker: HOPE


text: We have developed and maintain a cybersecurity risk management program that focuses primarily on securing and safeguarding computer systems, networks, cloud services, business applications, and data and that is integrated in our overall risk management strategy and framework. We have implemented protocols to protect against cyber threats and ensure the containment and security of sensitive business data, including ongoing security reviews of critical systems, continuous monitoring of event data, and employee training programs, which processes are aligned with our overall business and operational goals and strategies. Our risk assessment occurs on an ongoing basis and covers identification of risks that could act against the company's objectives as well as specific risks related to a compromise to the security of data.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: We have been, and continue to be, the subject of cybersecurity attacks and threats, including distributed denial of service and ransomware attacks. Historically, none of these attacks or breaches has individually or in the aggregate resulted in any material liability to us or any material damage to our reputation. Disruptions related to cybersecurity have not caused any material interruption to our business, strategy, results of operations, or financial condition. There can be no assurance that such attacks or disruptions will not have a material adverse impact on us in the future.

companyName: Western Union CO

ticker: WU


text: Cybersecurity Risks, Threats and Material Incidents Despite our endeavors to safeguard the security and integrity of our networks, systems, and the sensitive information they contain or transmit, including the adoption of numerous cybersecurity policies and protocols aimed at mitigating the risk of cybersecurity breaches or disruptions as previously outlined, it is impossible to guarantee the complete effectiveness of these measures. There remains a possibility that efforts to thwart cybersecurity threats may not be entirely successful, potentially resulting in successful breaches or disruptions that could be harmful. Refer to "Our failure to protect our management information systems against security breaches could adversely affect our business and results of operations" in Item 1A. Risk Factors.

companyName: ARGAN INC

ticker: AGX


text: In addition, we have an escalation process in place to inform our Chief Executive Officer and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: For a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section of our Registration Statement on Form S-1 filed with the Securities and Exchange Commission on February 14, 2025 titled " Cybersecurity risks could adversely affect our business and disrupt our operations."

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: The Board of Directors is fully aware of the vital importance of managing cybersecurity risks. To ensure effective governance in handling these risks, the Board shall implement a strong oversight mechanisms. This reflects our understanding of the significant impact these threats can have on operational integrity and stakeholder confidence.

companyName: Vanguard Green Investment Ltd

ticker: VGES


text: Our cybersecurity risk management program includes (i) a policy designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; (ii) the use of external service providers to manage, assess, test and otherwise assist with aspects of our security controls; and (iii) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: We will implement a cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

companyName: NKGen Biotech, Inc.


text: We continually enhance our security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls through penetration testing, consulting on best practices and to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online updates. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Our board of managers has overall responsibility for the oversight of risk management, which includes cybersecurity risks. Our board receives periodic briefings on cybersecurity matters, including key risks to us, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Our cybersecurity risk management program encompasses periodic risk assessments, designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. More specifically, an independent third-party performs a regular penetration test of our IT infrastructure. In addition to our penetration testing, an independent t hird-party security firm is engaged to perform additional security controls testing and provide an independent report to our executive team. This external assessment provides us and our Audit Committee with a comprehensive evaluation of our security posture.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: The Audit Committee is composed of independent board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: The Manager's Chief Compliance Officer led the development and oversees the implementation of the cybersecurity program, and is the head of the Manager's cybersecurity team, supported by the Director of Compliance. The Chief Compliance Officer is responsible for assessing and managing the Manager's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team, inclusive of all third parties engaged to provide operations, monitoring, detection, and remediation, has extensive experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes.

companyName: Venture Lending & Leasing IX, Inc.


text: Our Board of Directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees generally meet monthly and quarterly, respectively, to provide oversight of our risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer informs the Information Technology Steering Committee by reporting on key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken in response. The Information Technology Steering Committee meets on a monthly basis (or more frequently as may be required by the Incident Response Plan).

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Board Responsibilities On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee quarterly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. The Company's Technology Senior Director briefs the Audit Committee quarterly on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: We have established and maintain policies and processes for assessing, identifying, monitoring, and managing material risks arising from cybersecurity threats which form an important component of our overall risk management program. Our policies and processes underlie and support the integrity and availability of critical data and systems, and are designed to provide a framework for timely, effective responses to cybersecurity threats, such as threats associated with our services and with our use of services or technology products by our strategic vendors, contractors, or other suppliers. ACV also engages independent third parties to help us assess our internal preparedness, audit our adherence to cybersecurity standards, assist us with risk mitigation activities, such as security assessments and penetration testing, and identify areas for continued focus and improvement.

companyName: ACV Auctions Inc.

ticker: ACVA


text: We have established and maintain comprehensive incident response and recovery plans that fully address our response to and recovery from a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.

companyName: BOYD GAMING CORP

ticker: BYD


text: We periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: WEWARDS, INC.

ticker: WEWA


text: Risks from Cybersecurity Threats We have not experienced any material cybersecurity incidents and the expenses we have incurred from any security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. See also "Risk Factors — Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business strategy and operating results." As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks.

companyName: electroCore, Inc.

ticker: ECOR


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our Chief Technology Officer, General Counsel, Chief Administrative Officer, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crises, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.

companyName: Tradeweb Markets Inc.

ticker: TW


text: In the event of a cybersecurity incident, the Company has established an incident response plan to address the matter promptly and effectively. Our CISO leads our Cybersecurity Incident Response Team (CIRT) that is responsible for leading and coordinating CACI's response to cybersecurity incidents in accordance with CACI's established cybersecurity incident response plan and response processes. In accordance with these policies, cybersecurity events and data incidents are evaluated, ranked by severity, and prioritized for escalation to CACI's Executive Incident Assessment Committee. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: As part of our risk management system, we track and log privacy and security incidents to remediate and resolve any such incidents. Any significant incidents are reviewed regularly with our Chief Financial Officer to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to our executive leadership team. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive leadership team makes the final materiality determinations and disclosure and other compliance decisions.

companyName: BioCardia, Inc.

ticker: BCDA


text: Voya's Board committees include the Technology, Innovation and Operations ("TIO") Committee, which provides support to the Board in its oversight of information technology, including cybersecurity risks. In addition, the TIO Committee supports the Audit Committee in reviewing cybersecurity risks and disclosures thereof, and collaborates with both the Audit Committee and the Risk, Investment and Finance ("RIF") Committee of the Board to oversee material risks. Management, including the CISO, regularly updates the TIO Committee on cybersecurity-related matters.

companyName: Voya Financial, Inc.

ticker: VOYA


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal IT audit, IT security, governance, risk, and compliance reviews. To protect, detect, and respond to cybersecurity threats, we conduct the following activities at various intervals during the year, which vary in maturity across our business: • Regular network and endpoint monitoring; •24x7 security operations monitoring of our systems, networks and services to detect and act on weaknesses and potential intrusions;

companyName: Jamf Holding Corp.

ticker: JAMF


text: Cybersecurity Risk Management Program Overview We recognize the critical role that properly managing cybersecurity risk plays in maintaining the trust and confidence of our stockholders, the patients in our clinical trials, our employees, our business partners and our other stakeholders. Accordingly, our cybersecurity program is designed to identify, assess, manage and mitigate material risks from cybersecurity threats through a variety measures, including risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. In collaboration with our third-party IT service providers, a cross-functional team comprised of representatives from our administrative, finance and legal functions actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We also engage external experts, including IT experts, other consultants, and auditors to evaluate our cybersecurity measures and risk management processes.

companyName: CervoMed Inc.

ticker: CRVO


text: The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), applicable industry standards, and applicable data privacy and cybersecurity regulations. Annual technology and cybersecurity risk assessments are conducted to identify and evaluate applicable risks and controls designed to address such risks. In general, the Company seeks to identify, assess and manage material cybersecurity risks through a company-wide approach addressing the confidentiality, integrity, and availability of the Company's information systems and the information that the Company collects and processes.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: As discussed in more detail under the "Governance" heading, the Audit Committee provides oversight of the Company's cybersecurity risk management processes in collaboration with our Information Technology Leadership Team, Chief Legal Officer, Vice President of Risk Management and other internal and external experts.

companyName: WillScot Holdings Corp

ticker: WSC


text: The R1 Security Program Policy delineates responsibilities and initiatives to maintain our comprehensive Program. It includes frequent reviews and development of our security policies and standards, monitoring to detect potential threats or disruptions, testing of protocols to verify the effectiveness of our defense systems, and training for our workforce. Our teams continuously and proactively monitor our information systems for potential risks, threats, and disruptions, including at our U.S.-based third-party data centers. Through the use of our rapid response and incident management processes, which include our IT incident management and IT disaster recovery processes, we assess potential incidents and determine a course of action. This may involve risk mitigation, resolution plan development, and process improvements.

companyName: R1 RCM Inc. /DE


text: Incident History The Company has not experienced any cybersecurity incidents during the year ended December 31, 2024, or in any prior year that resulted in interruptions to normal business operations or breaches of systems.

companyName: i-80 Gold Corp.

ticker: IAUX


text: Incident Management We have implemented security procedures and measures in order to protect our information from being vulnerable to theft, loss, damage or interruption from a number of potential sources or events. LSB maintains and tests an incident response plan that outlines steps for the containment, investigation of, response to and recovery from cyber events. The plan also includes information pertaining to roles, responsibilities, and reporting process. This plan is a part of our formal, enterprise-wide crisis management process, which outlines a communication plan with executive leadership as well as guidelines for communication with the Board of Directors. Although we make efforts to maintain the security and integrity of our information systems and technology operations, these systems are subject to the cyber risk of incident or disruption, and there can be no assurance that our security safeguards, and those of our third-party providers, will prevent incidents to our or our third-party providers' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A. Risk Factors—General Risk Factors."

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: The Company has an Enterprise Risk Management (ERM) function to address enterprise risks, including cybersecurity. ERM is led by our Enterprise Risk Council, which consists of members of the CEO's staff. The Risk Council oversees the design and execution of the ERM function to allow for the identification, assessment, prioritization, management, monitoring and reporting of material risks. This includes an annual risk assessment and quarterly updates of the risk profile given current operating conditions. The Risk Council meets quarterly and provides reporting to the Board of Directors and relevant Board Committees given the nature of specific risks identified, which includes cybersecurity risk.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: As part of our overall risk management strategies, we also conduct cybersecurity trainings for personnel at all levels and in all departments.

companyName: Zhuoxun Hongtu Inc.


text: in Cybersecurity continuously invest in advanced cybersecurity technologies, including threat detection and prevention systems, encryption, and secure access controls. Our cybersecurity is part of our overall budget which is reviewed and approved by our board of directors to ensure adequate resources are allocated to protect our assets. the past fiscal year, we experienced no cybersecurity incidents.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: Notwithstanding these ongoing efforts and our multi-layered approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Tyler maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Please see Item 1A, "Risk Factors," for a discussion of cybersecurity risks.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Our CIO and other leaders work collaboratively across our organization to protect our information systems from cybersecurity threats and to promptly respond to incidents in accordance with our incident response plan, including the necessary steps to ensure remediation. Through ongoing communications, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to our board of directors when appropriate.

companyName: ON24 INC.

ticker: ONTF


text: While our enterprise risk management program considers cybersecurity risks alongside other significant business risks, we also maintain robust cybersecurity processes, technologies, and controls to aid our efforts to identify, assess, and manage material risks posed to our Company. Annually, we conduct an information security risk assessment, and we periodically review our security architecture and assess third-party vendors that we use. We continuously monitor for security risks and vulnerabilities posed by the technological tools and people enabled processes we utilize. In addition, we employ a range of tools and services, including network and endpoint monitoring, third-party penetration testing, and periodic tabletop exercises to ensure timely discovery of, response to, and remediation of, security incidents. While we assess and monitor for security risks and vulnerabilities posed by our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that our assessment and monitoring of such third parties will prevent or mitigate the risk of any compromise or failure in the information assets they own or control.

companyName: SecureWorks Corp


text: Aemetis utilizes a third-party cybersecurity and information security awareness training programs. Training is administered and tracked through online learning modules and ongoing phishing simulations. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.

companyName: AEMETIS, INC

ticker: AMTX


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and products and to enhance our internal controls and processes, which are designed to help protect our programs, systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest and colleague information.

companyName: Hyatt Hotels Corp

ticker: H


text: Chief Financial Officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. Leaders of our Ondas Networks and OAS segments, along with the Chief Financial Officer, meet quarterly to assess cybersecurity risks, identify emerging threats, and evaluate our risk management framework. The Chief Financial Officer provides quarterly updates to the Board of Directors on any cybersecurity-related risks. Our incident response plan includes notifying the Board of Directors of any material threats or incidents as they arise. Although these members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with in-house and third-party information technology specialists, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: Ondas Inc.

ticker: ONDS


text: Related to Cybersecurity Risks The IT Director oversees and manages the day-to-day functions of our cybersecurity risk management program. The IT Director reports to the VP of Information Technology and Facilities, or VP of IT. The IT Director and VP of IT roles are both held by individuals who each have over twenty years of professional information technology, or IT, management experience. The VP of IT meets regularly with the Audit Committee to report on and discuss information security and technology risks to our business, including our cyber risk management programs, controls, and procedures. The VP of IT and the Audit Committee also conduct a high-level review of the threat landscape facing our business, discuss risk mitigation strategies, and the prioritization of our remediation efforts.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: In addition, given the smart technology within our devices, our product security includes design protocols and is supported by quality systems testing and use scanning tools to assess and detect vulnerabilities that could affect our products.

companyName: Medtronic plc

ticker: MDT


text: In-sourced IT Services: By in-sourcing IT services in late 2023, we gained greater control over IT decisions, established a comprehensive knowledge base, and laid a framework allowing for unbiased assessments of future IT and cybersecurity investments. We have continued improvements using in-sourced IT services throughout 2024.

companyName: SES AI Corp

ticker: SES


text: Board of Directors and Audit Committee oversee our cybersecurity efforts to ensure effective governance in managing risks associated with cybersecurity threats. Our Director of Information Technology provides periodic updates to the Board of Directors and Audit Committee regarding our cybersecurity program, including status updates on various projects to enhance our overall cybersecurity posture.

companyName: CVD EQUIPMENT CORP

ticker: CVV


text: As a company in general, and particularly, as a government contractor, we understand the critical need to maintain all data and information systems in the safest, most secure manner. Accordingly, our approach to cybersecurity is multi-tiered and comprehensive. Our board of directors ultimately oversees our processes for assessing, identifying and managing material risks from cybersecurity threats. Our management, together with third party contractors, makes these assessments and periodically provides the board with a report and evaluation, including risk mitigation strategies. This report would also include any cybersecurity-related incidents which would give rise to a reporting requirement for the company. Although we consider our program for mitigating cybersecurity risks to be part of an overall risk mitigation strategy, we consider it a separate set of processes because of the unique concerns with keeping our and our customers' data secure.

companyName: APPLIED ENERGETICS, INC.

ticker: AERG


text: The Company has an Information Security Policy and Information Security Standards, which, taken together, describe the standards and minimum requirements that are expected of all business and information security personnel to protect the Company's information and technology assets. The policy provides a framework guided by security principles designed to address the confidentiality, integrity and availability of the Company's information assets in the context of internal, external, deliberate and accidental threats, while supporting the Company's information creation and sharing needs.

companyName: MOODYS CORP /DE/

ticker: MCO


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Boa rd Enterprise Risk Management Committee ("ERMC") is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the ERMC receives an overview from management and the management steering committee of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, describing the company's ability to mitigate those risks, and discussing such matters with our Chief Information Security Officer and Chief Information Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions. The Board engages external cyber security experts, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities and transformation designed to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.

companyName: Mechanics Bancorp

ticker: MCHB


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents have not materially affected or are not reasonably likely to materiality affect us, including our business strategy, results of operations or financial condition. See "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with third-parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures. For more information regarding the risks we face from cybersecurity threats, please see Risk Factors included in Part I, Item 1A of this Form 10-K.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: The Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the ERM approach and processes implemented by management to identify, assess, manage and mitigate risk. The Audit Committee is central to the Board of Director's oversight of cybersecurity risks and bears the primary responsibility for assessing and managing the Company's material risks from cybersecurity threats.

companyName: GoHealth, Inc.

ticker: GOCO


text: We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business processes and decision-making across the Company. Our information technology is connected to support the flow of information across our business processes. As such, our information technology infrastructure is susceptible to cybersecurity threats. We monitor our information security procedures and risk management systems and implement initiatives aimed at improving our cybersecurity measures. Our process for assessing, identifying, and managing information security risks include: • Internalization of Information Security Management. We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations. He also possesses relevant experience in improving a company's cybersecurity posture and data privacy policies. He holds a Bachelor of Science degree in Information Systems and oversees all of our information security initiatives, assesses cybersecurity risks, provides cybersecurity solution plans, identifies opportunities for the implementation of additional cybersecurity procedures and provides cybersecurity training to our employees and executives. • Third-Party Consultant. We engage a third-party information security consultant to assist in managing our risk posture. This consultant conducts periodic tests and analyses of our defensive and detective information security controls, including annual penetration tests and risk assessments as well as regular vulnerability scans and assessments. The consultant also provides live, interactive annual information security training to our employees and monitors the effectiveness of such training through quarterly phishing campaigns. The consultant also assists us in managing cybersecurity risks associated with third-party service providers by administering a due diligence questionnaire for the Company's third-party service providers that is inclusive of a cybersecurity risk assessment and provides guidance for remediation of security gaps. • Current Plans and Procedures. The Company has implemented an incident response plan ("IRP") and a Business Continuity Plan ("BCP"). The IRP establishes the organization, actions and procedures for recognizing and responding to information security incidents; assessing incidents; notifying the appropriate individuals, regulators or organizations about any incident; organizing the Company's response activities; escalating the Company's response efforts to named executive officers and the Board of Directors based on the severity of the incident; and supporting the business recovery efforts made in the aftermath of any incident. The IRP is designed to minimize the operational and financial impacts of an information security incident and is designed to be activated when a local incident responder determines that an incident has occurred. Similarly, our BCP provides details on information security incident response and subsequent business recovery actions.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service, and the loss of existing or potential suppliers or customers. In addition, breaches of our security measures and the unauthorized dissemination of sensitive personal, proprietary or confidential information about the Company, our business partners or other third parties could expose us to significant potential liability and reputational harm. As threats related to cyber-attacks develop and grow, we may also find it necessary to make further investments to protect our data and infrastructure, which may impact the Company's results of operations. In case of a cyber-attack, the Company may suffer losses that could have a material adverse effect on its business. As a global enterprise, we could also be negatively impacted by existing and proposed laws and regulations, and government policies and practices related to cybersecurity, data privacy, data localization and data protection. In addition, our customers may encourage, or require, compliance with certain security standards, such as the voluntary cybersecurity framework released by the National Institute of Standards and Technology (NIST), which consists of controls designed to identify and manage Cybersecurity risks, and we could be negatively impacted to the extent we are unable to comply with such standards. Our business is subject to cybersecurity risks.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: The Company's CISO leads the Cybersecurity and Digital Risk ("CDR") organization, which oversees the approach to identifying and managing cybersecurity and digital risk. The Company's current CISO has extensive technology and risk management experience in critical infrastructure sectors and is qualified as a boardroom certified technology expert by the Digital Directors Network. She serves on the U.S. President's National Infrastructure Advisory Council, examining and providing recommendations related to cross-sector critical infrastructure security and resilience. She serves on the board of directors of the Internet Security Alliance, has served, and continues to serve, as Chair of the Cybersecurity Council at Airlines for America, and has served as Chair and is currently a member of the board of directors of the Aviation Information Sharing and Analysis Center (A-ISAC). The CDR organization includes teams focusing on Cyber Defense, Identity & Digital Trust, and Secure Product Solutions & Aircraft Cybersecurity Operations. The teams include individuals with a broad array of cybersecurity expertise, including experience in offensive cybersecurity; application cybersecurity; product cybersecurity; cloud cybersecurity; infrastructure cybersecurity; cybersecurity systems; engineering and architecture; information technology cybersecurity; operational technology cybersecurity; identity and access management; vulnerability and asset management; cybersecurity threat intelligence; cybersecurity regulatory compliance; digital fraud; digital trust; incident response; insider threat assessment; and aircraft cybersecurity.

companyName: United Airlines Holdings, Inc.

ticker: UAL