text: We have policies and processes in place that are designed to assess, identify and manage material risks from cybersecurity threats. We regularly assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. We use recognized industry frameworks and standards as guides in identifying, assessing and managing cybersecurity risks relevant to our operations. For example, we primarily use NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) for this purpose.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive, process or transmit, and store in any format. We have a cybersecurity risk management program, which we refer to as our information security risk management program, in place designed to assess, identify, and manage material risks from cybersecurity threats to our information, data, or information technology systems utilizing a defense-in-depth security strategy that integrates our staff, technology, and operations to establish various security barriers across multiple layers of our operations. Our information security risk management program is designed to employ industry standard practices across our operations and business functions, including access controls, monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; resilience through detecting and responding to cybersecurity events, incidents, and data disclosures or breaches, business continuity, and disaster recovery capabilities; and investments in cybersecurity infrastructure and technology needs. Key aspects of our information security risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, continuous threat detection and response monitoring, and full incident response; • Routine cybersecurity training for all employees, including social engineering techniques, simulated phishing campaigns, physical access such as tailgating, privacy or handling of sensitive data, and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response, and disaster recovery procedures, including routine tabletop incident response exercises, disaster recovery tests, unannounced penetration tests, and security control assessments; • Network, infrastructure, and application security such as database activity monitoring, encryption, secure file transfer protocols, and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW

secItem: Item 1C


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk entitled "Our computer systems or data, or those of our collaborators or other contractors or consultants, maybe compromised, which could result in adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; significant disruption of our product development programs and our ability to operate our business effectively; reputational harm; and other adverse consequences."

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: The Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2023, and the Company is not currently aware of any cyber security attacks or breaches that are reasonably likely to materially affect the Company's business, business strategy, operating results or financial condition. However, as discussed under Item 1A "Risk Factors," specifically the risks titled "Risk of operational interruptions relating to computer software or hardware failures, including cyber-attacks," a cybersecurity incident could negatively impact sales and profits. The sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well controls are designed and implemented, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: Audits and Reviews. The data centers undergo regular third-party audits and reviews to validate its security controls and compliance with industry standards and regulations. These audits provide independent verification of the security posture and help build trust with customers.

companyName: AIRWA INC.

ticker: YYAI


text: As of July 31, 2025, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: Independence Power Holdings, Inc.

ticker: ITXP


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss " in Item 1A- Risk Factors.

companyName: Currenc Group Inc.

ticker: CURR


text: Our second line of defense includes the following: • Chief Technology Risk Officer: The CTRO provides independent oversight of our information security and technology risk programs and challenge of first line risk management and risk-taking activities pertaining to information security and technology risk. • The Executive Risk Committee: This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment, and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We maintain processes to inform and update management and, as needed, the audit committee, about security incidents that may pose a significant risk for the business, as applicable. In accordance with our incident response policies, our IT Security Team and Chief Financial Officer are responsible for establishing incident response teams to manage cybersecurity incidents, should any arise. Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."

companyName: Markforged Holding Corp


text: Arrow also regularly reviews and updates its existing internal controls and procedures and corporate governance policies and procedures intended to protect its business operations, which includes the security and privacy of the confidential information of its customers. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Our risk management processes include identifying and documenting key risks, assessing the potential business impact and likelihood of the identified risks, and developing mitigation plans for any risks that are deemed to be critical and or material. The Company uses various techniques to identify risks, up to and including input from our threat intelligence teams, which includes monitoring adversarial tactics and techniques, as well as annual penetration testing using third-party vendors. Once identified, these risks are assessed to evaluate potential impacts to us from compromised confidentiality, integrity, or availability of information systems, considering financial, operational, legal, and reputational risks. Risk ratings are determined by evaluating the threats, any vulnerabilities, and potential business impacts, and this information is documented in our risk register. The management of material risks from cybersecurity threats is assigned to appropriate personnel, with mitigation or remediation plans approved by executive management and reviewed regularly.

companyName: StoneX Group Inc.

ticker: SNEX


text: Like other technology companies, we have experienced cybersecurity incidents in the past. We have not, however, been materially impacted by any previous cybersecurity incidents. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K,including the risk factors entitled "Risks Related to Our Business and Operations: A cyberattack, security breach, or incident affecting us or the third parties we rely on or partner with could expose us or our customers and consumers to a risk of loss or misuse of confidential information and have an adverse effect on our reputation, brand, business, financial condition, and results of operations."

companyName: Blend Labs, Inc.

ticker: BLND


text: The Board is responsible for the oversight of the Company's operational and strategic risk management process. The Board oversees a company-wide approach to risk management, carried out by management. The Board determines the appropriate risk for the Company generally, assesses the specific risks the Company faces and receives regular reports of the steps taken by management to manage those risks. With regard to cybersecurity risk, the Board (through the Audit Committee) conducts an annual review of the Company's cybersecurity program, and the entire Board receives periodic updates on the Company's cybersecurity risk management progress through the Company's general enterprise risk management program described in the foregoing sentence.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: The head of IT, in coordination with senior management, including the CFO, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the head of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Xencor Inc

ticker: XNCR


text: The Board and Audit Committee are responsible for overseeing IT and OT risks from cybersecurity threats. The Board recognizes the importance of maintaining the trust and confidence of our customers, employees, regulators, and stockholders and the need to protect information stored on our and our vendors' systems, including personal and proprietary data.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties we rely on, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. The Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.

companyName: US BANCORP \DE\

ticker: USB


text: We have worked to develop our cybersecurity program to protect the confidentiality, integrity, and availability of systems and data. We have implemented administrative, technical, and physical safeguards that we believe are appropriate to the size and complexity of our business and the nature and scope of our activities. We evolve our cyber defenses to help minimize impacts from cyber threats to safeguard our assets and data.

companyName: Keenova Therapeutics plc


text: Our Chief Financial Officer provides periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Axonics, Inc.


text: The Company's Chief Information Officer, in coordination with the cybersecurity team, works to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of this program, the cybersecurity team addresses cybersecurity threats and responds to cybersecurity incidents in accordance with the Company's written incident response plan. The Chief Information Officer and cybersecurity team regularly meet to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and the Chief Information Officer consults with executive management, including the CEO, to report such incidents to the Audit Committee and the Board and initiate a response to incidents when appropriate.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas. This integration ensures a holistic approach to risk management, enabling us to address cybersecurity risks in the context of broader organizational risks.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Our CIO, Vice President of Infrastructure and Security, IT Security Director, and cybersecurity engineers have knowledge and experience to effectively implement, monitor, and maintain our cybersecurity posture. This team receives reports on cybersecurity threats from various business teams, and in conjunction with management, regularly reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks.

companyName: Leslie's, Inc.

ticker: LESL


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As part of our risk management program, we reference various security industry frameworks and other guidance, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), HIPAA, Service Organization Control Type 2 (SOC 2 Type II), and Sarbanes-Oxley IT General Controls (SOX ITGC), to help us assess, identify and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF, HIPAA, SOC 2 Type II, and SOX ITGC as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Ceribell, Inc.

ticker: CBLL


text: We have established internal reporting processes designed to ensure that our Board of Directors and the Audit Committee receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including external advisors to the extent appropriate.

companyName: Crane NXT, Co.

ticker: CXT


text: We have established a Cyber Incident Response Team ("CIRT") to provide an efficient, effective, and orderly response to technology related incidents and our Cybersecurity Incident Response Plan contains protocols for communication within this team and reporting to executive management and the Audit Committee.

companyName: SM Energy Co

ticker: SM


text: The independent director of the Board Charlie La is responsible for the oversight of risks from cybersecurity threats on behalf of the Board. Mr. Teng Ai Leng, our IT consultant and Tawny Lam, Chief Executive Officer of the Company report to Mr. Charlie La and Board of Directors for cybersecurity risks and incidents. Teng AI Leng has 29 years of working experience in the Information technology industry.

companyName: XMax Inc.

ticker: XWIN


text: Two key enabling bodies, ASGN's Enterprise Security Council ("Council") and the Security Operations Center ("SOC"), have primary responsibility for our overall cybersecurity risk management program and provide the structure necessary to set policy and direction as well as operationalize our required security posture.

companyName: ASGN Inc

ticker: ASGN


text: Cybersecurity risk management is integrated within our risk management framework. See "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations—Risk Management" for additional information on our risk management processes. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal and third-party assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance. An example of the assessment we use is the ISO 27001 assessment that was implemented started in 2020. Our team is continually evaluating our technology vendors and tools to ensure that we are managing evolving threats to the best of our ability.

companyName: TruBridge, Inc.

ticker: TBRG


text: Our risk management program also assesses third-party risks, and we have a third-party risk management program designed to identify and mitigate risks from vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when selecting third-party service providers. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: TrueCar, Inc.


text: As of December 31, 2024, cybersecurity incidents and threats have not had a material adverse effect on Federated Hermes' Financial Condition. See Item 1A – Risk Factors – General Risk Factors – Operations-Related Risks – Systems, Technology and Cybersecurity Risks for additional information regarding the cybersecurity risks to Federated Hermes' business, offerings, customers, shareholders and service providers.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: The Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. We exercise a detailed vendor due diligence evaluation during the onboarding, and periodic reviews of these vendors with access to sensitive Company data. The Company requires contracts of third parties to incorporate industry and regulatory standard clauses requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats in coordination with the Audit Committee and regularly discusses the approach to cybersecurity risk management with management, including the Company's CIO and CISO. The Board and the Audit Committee each receive quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and vendors. The Board and the Audit Committee also receive prompt and timely information regarding cybersecurity incidents that may meet company-established reporting thresholds, as well as ongoing updates regarding such incidents through resolution.

companyName: AGILITI, INC. \DE


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Company has implemented technical safeguards that are designed to defend the Company's information systems from cybersecurity threats. These safeguards include network security capabilities such as firewalls, intrusion prevention and detection systems; endpoint protection capabilities such as anti-malware functionality; and access controls, which are evaluated for accuracy on a quarterly basis. The Company has also implemented email protection to minimize phishing attacks and ensure integrity in digital communications. We baseline our assets according to the technical controls recommended in the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"). • Cyber Intelligence & Continuous Monitoring: The Company has established continuous monitoring of our environment through a third party and receives alerts on threats and policy violations to ensure we meet our 96 hour window to report material matters to the SEC. The Company is a member the Defense Industry Base ("DIB") and receives cyber intelligence based on current threat actors and tactics, techniques and procedures ("TTP's") from the DIB organization, the Federal Bureau of Investigation ("FBI") cyber division, Department of Homeland Security, and the National Security Agency Cybersecurity Collaboration Center ("NSA CCC"). • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts annual tabletop exercises that simulate a cyber attack to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: To ensure adherence to our cybersecurity policies and compliance with information security standards, independent third parties audit our practices each year and conduct infrastructure and application security assessments and penetration testing. We also mandate regular cybersecurity training for our employees. Further, our security incident response policies and procedures are documented and provided to all authorized personnel to guide them in detecting, responding to, and recovering from security events and incidents.

companyName: SMARTSHEET INC


text: We have also established a Management Risk Committee ("MRC"), composed primarily of executive management, which meets regularly and is responsible for identifying, assessing, prioritizing and monitoring action plans to mitigate key risks.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Our IT security team regularly monitors the company's technology environment to address and investigate potential incidents. In the event of an incident, we would follow our internally developed incident response playbook, which includes but is not limited to guidelines for determining the severity of an incident, roles and responsibilities of the cyber response team, mitigation and recovery steps, and communication to internal and external stakeholders based upon nature and extent of the incident. We conduct regular external and internal penetration testing, "red teaming" exercises to seek to identify and remediate potential vulnerabilities, and other methods to ensure the readiness and effectiveness of our program and to continue to enhance our security posture. Our information security team also performs periodic tabletop exercises to simulate potential incidents in order to identify potential enhancements to monitoring and our incident response process.

companyName: Essent Group Ltd.

ticker: ESNT


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks Cybersecurity is integrated within the Company's Enterprise Risk Management process, which is the Company's systematic approach to identifying, managing and assessing major risk and safeguards, including cybersecurity. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. As a result, Katherine Dowling, the General Counsel and Vice President of the Sponsor, is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action, in conjunction with Hong Kim, the Chief Technology Officer of Bitwise. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Ms. Dowling receives periodic reports from the Experts, outside legal representatives and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation and testing. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: Cybersecurity risk is among the top risks that the Company actively monitors. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. The Audit and Finance Committee ("Audit Committee") of the Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee also oversees our cybersecurity risk and receives reports from our CIO on various cybersecurity matters, mitigation measures, and the status of our information security priorities. In addition, the Audit Committee reports to the Board of Directors on any significant cybersecurity incidents, such as the 2024 Cybersecurity Incident.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: We have implemented an Enterprise Risk Management ("ERM") program, managed by members of senior management, to identify, assess, and monitor key risks that are aligned with our strategic and business objectives. Our policies and processes are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We apply NIST best practices in how we implement security and privacy controls. We use NIST to define our practice in conducting risk assessments as well as to define our approach in managing internet of things ("IOT") device security. We have identified various cybersecurity risks that could adversely affect our business, results of operations, and financial condition, including violation of privacy laws; intellectual property theft; fraud; business interruption or ransomware; harm to customers or employees; and other legal and reputational risks. Resideo Technologies, Inc.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Our Chief Business Officer is responsible for the management oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us to address cybersecurity risks. Our Chief Business Officer has many years of experience overseeing company-wide legal and compliance risks. Our Chief Business Officer is supported by our outside information technology management/cybersecurity consultant and our managed security services provider.

companyName: KALA BIO, Inc.

ticker: KALA


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats. We maintain an information technology and cybersecurity program appropriate for a company our size, taking into account our operations and risks.

companyName: OZOP ENERGY SOLUTIONS, INC.

ticker: OZSC


text: Among other things, the program includes the following components: • security event monitoring and detection; • extended detection and response; • vulnerability scanning; • security awareness and privacy training for personnel; • phishing simulations; and • a cybersecurity incident response team. The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: As of the date of this Annual Report on Form 10-K, we have not identified risks from known cybersecurity threats, including or as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks to us from cybersecurity threats, see "Risk Factors" in Item 1A. of this report.

companyName: VERU INC.

ticker: VERU


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: ServiceNow, Inc.

ticker: NOW


text: The Company has adopted processes and procedures for incident detection, containment and response, which are provided through a variety of resources, including:

companyName: BELDEN INC.

ticker: BDC


text: Our Board has oversight of our strategic and business risk management and has delegated the oversight of cybersecurity risk management to the Company's Audit Committee. The Company's Audit Committee is responsible for overseeing all matters relating to the security of and risks related to the Company's information technology systems and procedures, including its cybersecurity and other information technology risks. The Audit Committee is responsible for ensuring the Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: Prior to joining KKR, KKR's CISO was the CISO at another large financial institution where he was responsible for their global information security program. KKR's CISO also has prior experience in various information security roles, including security architecture, application security, engineering and operations. He holds a Bachelor of Science in computer science from the New York University Polytechnic School of Engineering, is a Certified Information Systems Security Professional (CISSP) and holds a Series 99 – Operations Professional Exam certification.

companyName: KKR & Co. Inc.

ticker: KKR


text: The Company's management, including members of its ERM Committee, the Response Team, and the Company's SDIT, assess and manage material risks from cybersecurity threats. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the ERM Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity risk management processes have been integrated into the Company's overall enterprise risk management processes.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information and cybersecurity policies, processes, and practices. We maintain a Cybersecurity Incident Response Plan that establishes an incident response team led by our Head of Information Technology and describes our response protocol for cybersecurity incidents. To help protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Assessment of cybersecurity threats is included as part of our overall risk management processes.

companyName: IO Biotech, Inc.

ticker: IOBT


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption. Our management is generally responsible for assessing and managing any cybersecurity threats.

companyName: FORMATION MINERALS, INC.


text: Our cybersecurity risk management process, which is discussed in greater detail above, is led by our Chief Information Officer, Information Security Officer, Chief Risk Officer, and other staff as needed. Such individuals have collectively over 90 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and safeguarding corporate and customer information.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: The CISO is a senior-level executive responsible for establishing and executing MetLife's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee of MetLife, Inc. (the "Audit Committee") quarterly and, as necessary, to the full Board of Directors. These regular reports include updates on MetLife's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of MetLife's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to MetLife.

companyName: METROPOLITAN LIFE INSURANCE CO


text: Our executive team, in particular, our Senior IT Director and members of our IRT, have relevant degrees in computer information systems and extensive experience and background in network design and configuration, endpoint protection, privileged identity management, device encryption, cloud network and infrastructure, cloud email security, security information and event management (SIEM), and vulnerability assessments. This combined expertise is important to our cybersecurity risk management processes.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: Governance and Incident Disclosure Cybersecurity risk is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data. Cybersecurity risk management is an integral element of Customers' overall risk management strategy.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Our Cybersecurity Strategy Our cybersecurity strategy is built on "defense-in-depth" as recommended by the National Institute of Standards and Technology. We have processes in place to identify, assess, and manage material risks from cybersecurity threats. We have developed and implemented, and we continue to develop and implement, protective measures to reduce risk, manage incidents, and sustain our security posture. For example, in our efforts to lower the risk of ransomware attacks, we have increased our cybersecurity operations by strengthening our defense-in-depth approach to protections and controls, operational resiliency, cyber hygiene and monitoring. Specific steps include tool deployments to mitigate ransomware threats and impacts, as well as implementation of practices and enhancements to minimize the risk of ransomware launching and spreading across the organization. These efforts also include the ongoing identification, review and mitigation of vulnerabilities to our owned or operated systems. An additional protective measure to reduce risk with respect to the unauthorized access to confidential and sensitive data in Oncor's possession includes our data risk management (DRM) program. Our DRM program focuses on data loss prevention, including as the result of unauthorized access or acquisition, by taking proactive steps to limit confidential and sensitive information from being managed or distributed electronically in an unsecure manner. Led by our executive leadership team, as well as a governance committee and operational stakeholders, our DRM group provides formal guidance, including policies and standards, to reduce our data risk. We continue to participate, review, assess and adjust our mix of activities to improve our grid operations, digital perimeter security and information security. For example, we are evaluating and implementing additional governance focused defensive measures as a result of new National Institute of Standards and Technology guidance.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by the use of consultants as the Company does not have a full-time dedicated cybersecurity position in the Company. Our consultant has over 20 years of experience in information technology matters and is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The Board of Directors (the " Board ")

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: We use third-party service providers to perform a variety of functions throughout our business, such as SaaS providers and cloud hosting companies. We have a vendor management program designed to manage cybersecurity and privacy risks associated with our use of these providers. The program includes risk assessments for vendors security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and vulnerability scans related to the vendor and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity and privacy on the provider.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: SKECHERS USA INC


text: As part of its cybersecurity risk management program, Mattel utilizes cybersecurity assessors, consultants, auditors, and other third-parties to assist its internal team with network security, cloud security, endpoint security, data loss prevention, and security information and event management. In addition, Mattel utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents.

companyName: MATTEL INC /DE/

ticker: MAT


text: The likelihood of cybersecurity incidents is influenced by frequency risk factors. External factors include market trends in cybercrime, technological advancements in hacking methods, and geopolitical developments. Internal factors are shaped by our policies, the effectiveness of employee training, and robustness of system updates and maintenance procedures. External cybersecurity incidents events may include and are not limited to service disruptions due to email borne threat activities, ransomware, or denial of service attacks against us or our suppliers, while internal events may comprise of internal threats, subcontractors, or governance failures among other events.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: The Disclosure Committee assists in fulfilling our obligations to maintain disclosure controls and procedures and coordinates and oversees the process of preparing our periodic securities filings with the Securities and Exchange Commission. Cybersecurity incidents, based on their severity, are escalated to the Disclosure Committee by the SIRT. The Disclosure Committee is comprised of the Chief Executive Officer (CEO), Chief Operating Officer (COO), Chief Financial Officer, General Counsel, Chief Compliance Officer and Chief Accounting Officer. The COO represents the business units of the company and the CISO reports to the COO. The Disclosure Committee meets on a quarterly basis and more often, if necessary, and invites subject matter experts to meetings, as appropriate. We have policies and procedures in place designed to provide appropriate information of any matters to our Disclosure Committee that should be considered in advance of applicable public filings, including cybersecurity matters, and to address the proper handling and escalation of information to management and the Board of Directors or a committee of the Board of Directors. In addition to the oversight of the Board of Directors, members of our management are responsible for assessing and managing material cybersecurity risks.

companyName: UNISYS CORP

ticker: UIS


text: Terex utilizes the concept of defense in depth and deploys multiple layers of controls across operations to manage cybersecurity risk. Our GCG monitors and evaluates our cybersecurity infrastructure and performance on an ongoing basis through regular assessments, vulnerability scans, penetration tests and threat intelligence feeds, enabling Terex to identify, prioritize, and effectively manage risks. Additionally, our GCG engages an external third party to complete an annual red team penetration test to assess our preparedness. We apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We also provide awareness training to our team members to help identify, avoid and mitigate cybersecurity threats. Our team members with network access participate annually in required training, including spear phishing and other awareness training. Terex also conducts at least one cyber-incident tabletop exercise annually in collaboration with outside counsel, cybersecurity insurance carriers and/or other third parties. Our Senior Director, Risk Management, works closely with our VP Cybersecurity and information technology department to ensure we are aligned and covered with respect to any cybersecurity insurance coverage needs and overall risk management strategies.

companyName: TEREX CORP

ticker: TEX


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer and General Counsel and Chief Compliance Officer. Our management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response policy includes reporting to the audit committee of our board of directors for certain cybersecurity incidents.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: In connection with our use of third party services providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. To date, we have not been materially impacted by risks from cybersecurity threats or incidents and we are not aware of cybersecurity threats or incidents that are reasonably likely to materially affect our business. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business.

companyName: NETWORK-1 TECHNOLOGIES, INC.

ticker: NTIP


text: Our Audit & Risk Committee receives quarterly or, if needed, more frequent reports on cybersecurity and information security matters from our Chief Information Security Officer, or CISO, and his team. The CISO has more than 25 years of experience in information technology and information security, particularly in the financial services industry, and our Information Security organization has more than 100 members, with expertise in application security; governance and compliance; program and vulnerability management; security engineering; security operations security assurance; and threat intelligence and security architecture.

companyName: NASDAQ, INC.

ticker: NDAQ


text: We depend heavily on various information systems and electronic resources to conduct our business operations. Additionally, a majority of our clients, service providers, and other business partners on whom we rely, including providers of our online banking, mobile banking, and accounting systems, utilize their own electronic information systems. Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals, as well as by malicious actors employing sophisticated and continuously evolving software, tools, and strategies. Given our status as a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious actors. For further details, please refer to the "Risks Related to Information Security and Business Interruption" section of the Risk Factors outlined in Item As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program; Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats; Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time; Managing and maintaining cybersecurity controls utilizing available people, processes and technology; Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers; Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: To date we have not experienced any cybersecurity threats and any risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: Blue Line Protection Group, Inc.

ticker: BLPG


text: Reviewing the security measures in the Company's Cybersecurity Policy annually or when there is a change in applicable laws or regulations or in business activities of Equus; and Conducting training as necessary for all CINV personnel; and Reporting cybersecurity matters to our Board of Directors who provide oversight of our Information Security Team.

companyName: Crucial Innovations, Corp.


text: Our cybersecurity risk management processes are led by members of our management team, who are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity risk management and strategic processes described above, including the operation of our Incident Response Plan. Our management team reports and provides updates to the Audit Committee on risks from cybersecurity threats quarterly or as needed.

companyName: Open Lending Corp

ticker: LPRO


text: Mark J. Costa, age 58, is Chair of the Eastman Chemical Company Board of Directors and Chief Executive Officer. Mr. Costa joined the Company in June 2006 as Chief Marketing Officer and leader of corporate strategy and business development; was appointed Executive Vice President, Specialty Plastics and Performance Polymers Head and Chief Marketing Officer in August 2008; was appointed Executive Vice President, Specialty Products and Chief Marketing Officer in May 2009; and became President and a member of the Board of Directors in May 2013. Prior to joining Eastman, Mr. Costa was a senior partner with Monitor Group, a global management consulting firm. He joined Monitor in 1988, and his experience included corporate and business unit strategies, asset portfolio strategies, innovation and marketing, and channel strategies across a wide range of industries. Mr. Costa was appointed Chief Executive Officer in January 2014 and named Board Chair effective July 2014. Mr. Costa also serves on the Board of Directors of International Flavors & Fragrances Inc.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Senior Auditor and Compliance Officer. Horizon's risk escalation framework requires progressive escalation of cyber security risks to Management and its Committees, then to Board Committees and, ultimately, to the Board.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: The foundation of our Cybersecurity Program is based on recognized best practices and standards for cybersecurity and information technology that include the Center of Internet Security ("CIS") Controls Framework. The CIS Critical Security Controls Framework is a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are mapped to and referenced by multiple legal, regulatory, and policy frameworks. This framework is employed to guide cybersecurity investments similar to third party audits and risk assessments. Our Cybersecurity Program employs a practical risk-based approach with a focus on addressing risk factors with the highest possible impact, high levels of likelihood, and least amount of existing compensating controls. Key risk factors, along with action plans and a status of identified matters are communicated to Executive Management, the Audit Committee and the Board as part of the CISO's quarterly updates. We have created and continually update, as required, a detailed cybersecurity incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification and which we implement in the event of a cybersecurity incident.

companyName: International Money Express, Inc.

ticker: IMXI


text: We require each third-party service provider who may have access to our systems and/or our sensitive data to confirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Cyclo Therapeutics, Inc.


text: The Company uses a multiple lines of defense management approach to managing cybersecurity. The Company's cybersecurity function is headed by the Senior Vice President Chief Information Security Officer ("CISO") who is responsible for managing information security risks by developing and implementing information security programs, policies, strategies, architecture, standards, and procedures and acts as the first line of defense. The CISO leads a team of security professionals in safeguarding the Company's critical data, systems, and assets against threats, breaches, and attacks. The CISO is responsible for ensuring the confidentiality, integrity, and availability of information assets.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: We design and assess our program based on the information security standards published by the International Organization for Standardization 27002 ("ISO 27002"). This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the ISO 27002 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Peakstone Realty Trust

ticker: PKST


text: The board of directors receives periodic reports from the CISO team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. Rubrik, Inc.

companyName: Rubrik, Inc.

ticker: RBRK


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that is based on their respective risk profile and criticality to our business.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: While Fluence's board of directors oversees all enterprise risks, the Audit Committee of our board of directors has primary responsibility for overseeing cybersecurity risks and management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly updates from the CISO and CIO. These updates typically cover topics such as: overview of material cybersecurity incidents that have occurred since the last update, overview of residual cybersecurity risks to our critical business assets, recent investments in our cybersecurity program, and relevant cybersecurity operational metrics. The Audit Committee will report material updates regarding cybersecurity to the Board.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: ProAssurance's Information Systems Security department, with assistance from third-party security vendors, regularly monitors the Company's systems for indicators of attack or compromise to mitigate the risk of cyberattacks. The Company continually enhances its cyber and information security in order to identify and neutralize emerging threats and improve its ability to prevent, detect and respond to attempts to gain unauthorized access to the Company's data and systems. ProAssurance regularly adds additional security measures to its computer systems and network infrastructure to mitigate the possibility of cybersecurity breaches, including firewalls and penetration testing. The Company encrypts sensitive information and data and utilizes stringent access controls. Team members are required to complete quarterly security training which encompasses a wide range of cybersecurity topics. This training informs all team members of the processes and procedures to follow in the case they encounter a possible cybersecurity threat. This training is reinforced through periodic simulated phishing tests.

companyName: PROASSURANCE CORP

ticker: PRA


text: Management establishes a cybersecurity-aware culture within the organization. This is done through regular training, awareness campaigns, and promoting a sense of shared responsibility for security.

companyName: DecisionPoint Systems, Inc.


text: Our Enterprise Security team monitors and manages system infrastructure to protect the Firm against threats. Our Cyber Risk Management program considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our Cyber Risk Management process includes risk assessment processes to identify risks, a risk evaluation process that includes risk acceptance or denial at all levels of the organization, and third-party vendor management where each vendor's security posture is assessed to understand how it strengthens Kforce's cyber supply chain. We have taken a defense in depth approach to the implementation of our cybersecurity controls. These controls are set to block and/or provide alerts on suspicious activities. Our around the clock security operation center responds as appropriate to risks identified, and performs the risk assessment and risk evaluation. Our risk register and risk remediation processes help us ensure we are tracking and addressing priority risks, as appropriate. Any potential risks or threats identified by the Enterprise Security team are communicated to the CISO and Information Security and Data Privacy Council.

companyName: KFORCE INC

ticker: KFRC


text: Our cybersecurity risk management program includes: • a written data security incident response policy and a security incident response plan that include detailed procedures for responding to cybersecurity incidents, determining severity of cybersecurity incidents and notifying appropriate internal and external parties; • third-party and internal risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team consisting of members of our information technology department, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • periodic tabletop exercises involving the security team, the data security incident management team, and members of management, with special sessions for the Board of Directors; • annual audit by a Payment Card Industry ("PCI") qualified security risk assessor to validate our PCI-Data Security Standard ("PCI-DSS") compliance; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • regular cybersecurity awareness training, including social engineering and phishing testing of our employees, incident response personnel, and senior management; • deployment of external tools designed to detect and protect against spam, malware and other cybersecurity threats and train personnel; and • third-party security event monitoring.

companyName: LANDS' END, INC.

ticker: LE


text: Our Vice President of Internal Audit, in collaboration with our General Counsel, facilitates our enterprise risk management ("ERM") process. Cybersecurity-related risks are included in our overall risk evaluation for our ERM process to determine top risks for the Firm on an annual basis. Our internal audit team, which reports directly to the Audit Committee, uses the ERM program to develop a risk-based audit plan, which is approved by the Audit Committee annually.


text: This adaptive approach strengthens our ability to anticipate and counter emerging threats. See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, and employees, has delegated oversight of our cybersecurity risk management to the Audit Committee. Our cybersecurity policies, standards, processes, and practices have been established as part of our risk management program and are based on recognized frameworks, including as adopted by the National Institute of Standards and Technology (the "NIST"). In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Nerdy Inc.

ticker: NRDY


text: We evaluate the cybersecurity posture of such third-party service providers, including whether such providers maintain appropriate security measures and, where appropriate, require them to implement and maintain reasonable security measures in connection with their work with us. Our Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives updates, as needed, on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: We recognize the importance of data privacy and security and are committed to safeguarding and protecting our own confidential information and other confidential information shared with us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of all our critical systems and information, which is integrated into our overall risk management program. This cybersecurity risk management program involves the strategic planning, operation, implementation, and monitoring of cybersecurity practices within our organization. Our cybersecurity program also includes a comprehensive incident response plan ("IRP") to respond to security breaches and cyberattacks.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits."

companyName: Regulus Therapeutics Inc.


text: During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. The Head of Information Technology will note the classification of the information potentially impacted, paying close attention to information classified as personally identifiable information and sensitive. The Head of Information Technology and appropriate personnel will determine whether the incident is likely to affect ongoing business operations. If such is the case (e.g., contamination is widespread across production systems), Monroe Capital's Incident Response Plan and Business Continuity Plan shall be invoked, as necessary. In determining the level of response, we have identified three criticality levels of incidents and events based upon the following criteria: • Risk to confidential data • Risk to business continuity • Risk to critical systems • Revenue impact • Client impact

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our information security program, including our auditors, independent assessors (for example, for penetration testing) of our cybersecurity program, internal and external legal counsel, and other consultants.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Gap Inc.'s Chief Information Security Officer ("CISO") oversees the cybersecurity program. The CISO reports to the Chief Digital & Technology Officer ("CDTO") and is responsible for assessing and maintaining the Company's cybersecurity risk management processes. The CISO informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, CDTO, and members of the Information Security, Information Technology and Privacy teams have broad experience and expertise in selecting, deploying and operating cybersecurity technologies, initiatives and processes around the world. Information about our executive officers' work experience, including our CDTO, is included in "Information about our Executive Officers" in Item 1, Business, of this Form 10-K.

companyName: GAP INC

ticker: GAP


text: We are steadfast in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the ongoing and changing cyber threat landscape, we are committed to invest in, improve and update our cybersecurity practices on an ongoing basis. Regular assessments, testing, audits, and training of all employees are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers.

companyName: Bogota Financial Corp.

ticker: BSBK


text: In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. In addition, we regularly review cybersecurity trends and, partially as a result of our prior cybersecurity exposure, have moved some of our internal servers to off-site locations.

companyName: Digital Locations, Inc.


text: We have implemented information technology and product security policies and standards across the company. We provide ongoing cybersecurity training for employees and conduct employee phishing tests. We maintain business continuity, disaster recovery, and incident management plans. We conduct tabletop exercises and penetration testing. We use third-party security tools that help prevent, identify, investigate and resolve vulnerabilities in our systems and products. Certain Ventus offerings are PCI DSS 4.0 compliant, and SmartSense and Jolt have achieved SOC 2 Type II attestation. These certifications require independent audits by external auditors. We are actively pursuing similar certifications for other product lines. We also have processes to oversee and identify cybersecurity threat risks associated with our use of new third-party service providers, including those who have access to our customer and employee data or our systems.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: We also utilize the services of third -party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review. Finally, Mutual Savings and Loan Association complies with its regulatory requirements by having federal safety and security examinations performed on a schedule dictated by the regulatory agencies. The results of these examinations are reviewed and approved by the Board of Directors. Additionally, all findings from these examinations are recorded and prioritized for remediation.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.

companyName: Liberty TripAdvisor Holdings, Inc.


text: At Track Group, Inc., we recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: Track Group, Inc.

ticker: TRCK


text: We have developed and implemented a cybersecurity risk management program to protect critical assets, scale with business growth, identify and mitigate threats, and enable us to conduct our business securely. The program's design utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework, while adapting certain elements to align with our specific operational needs and objectives. The program and other cybersecurity processes have been integrated into our overall risk management framework.

companyName: Hillenbrand, Inc.

ticker: HI


text: We continue to invest substantially in cybersecurity risk management, which is a core part of our overall enterprise risk management program. Our security program is based on ISO 27001, NIST 800-53, and GDPR frameworks to support our global business. We utilize various tools and processes to identify, monitor, evaluate, and address cybersecurity threats and incidents, including those involving third-party vendors and service providers. Our process includes identifying the source of a threat or incident, implementing countermeasures and mitigation strategies, and informing management and our board of directors about significant threats and changes in the cybersecurity landscape. We remain committed to investing in risk management tools and processes as cybersecurity threats evolve. Despite our efforts, we cannot guarantee that we can prevent, mitigate, or remediate risks in our own or third-party cybersecurity infrastructure.

companyName: AstroNova, Inc.

ticker: ALOT


text: As of the date of this annual report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition. Our board of directors (the "Board")

companyName: Armlogi Holding Corp.

ticker: BTOC


text: We engage third parties in connection with our cybersecurity identification, assessment, and response processes, including to periodically benchmark our cybersecurity program against the National Institute of Standards and Technology's Cybersecurity Framework. We also maintain active retainers with certain third parties that can be engaged in the event of a cybersecurity threat or incident. We have established a process to oversee and identify risks and cybersecurity threats associated with our third-party service providers, which includes the use of monitoring technology. We also survey certain third-party providers regarding their security controls.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: We utilize a layered approach in managing and protecting against cybersecurity threats and in detecting and responding to cybersecurity incidents. Although we have numerous practices and processes to protect against common cybersecurity incidents, some attacks or other breaches may still be effective. Such practices and processes are designed to detect, triage and contain these cybersecurity incidents. These controls include: • Identification: In addition to technology-based detection capabilities, there are numerous ways employees can report suspected or actual events, including through our internal information technology ticketing system, by emailing the cybersecurity or privacy team emails, or by submitting a report through the compliance hotline. External parties can also report a vulnerability through the link in the footer of our website. • Technical Safeguards: We leverage outside partnerships to gain intelligence on threats and continue to adjust our protection mechanisms (including firewalls, anti-malware functionality and access controls) to be effective. We have systems in place that are designed to securely receive and store information and to detect, contain, and respond to data security incidents. • Incident Response: We maintain a comprehensive incident response plan to guide our response to a cybersecurity incident. Events are analyzed and categorized into one of four severity tiers and an incident response team is formed (whose membership depends on the nature of the incident). In addition to taking actions to respond to and remediate the incident, the incident response team also considers external notification and disclosure obligations. The incident response plan provides for prompt escalation of certain cybersecurity incidents to a multi-disciplinary committee so that decisions regarding the public disclosure of such incidents can be made in a timely manner. • Testing: We engage in periodic assessment and testing of our policies, processes, and practices that are designed to address cybersecurity threats and incidents. For example, we hire a third party to perform an annual penetration test on our website, internal network, and cloud environments. Our other efforts vary from year to year, but have in the past included an information security maturity assessment, risk assessment, tabletop exercises, and threat modeling. The results of such efforts are reported to the Audit Committee of the Board (the "Audit Committee") and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessment, exercise or review. • Education and Awareness: We have a cybersecurity and information security training and compliance program in place to support our employees and directors. As part of this program YETI employees are subject to reoccurring phishing exercises. The results of these exercises are used to inform the subject matter and frequency of additional training modules that employees are required to complete. In addition, employees annually receive training on data privacy and information security, including cybersecurity. YETI also maintains a number of policies that apply to employees and contractors, including a Global Internal Data Protection and Privacy Policy, an Acceptable Use Policy, and a Password Policy.

companyName: YETI Holdings, Inc.

ticker: YETI


text: We have not been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, our systems and networks have been, and are expected to continue to be, the target of increasingly advanced and evolving cyber-attacks and cybersecurity incidents in the future may adversely impact our business, financial condition and results of operations, and we are continuing to actively monitor such threats. For more information, see "Item 1A, Risk Factors—Risks related to our general business and operations—Significant disruptions of our information technology systems could adversely affect our business" and "Item 1A, Risk Factors—Risks related to our general business and operations—A data security breach could adversely affect our business and reputation."

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Our Board of Trustees holds oversight responsibility over the Company's strategy and risk management processes employed by the Adviser, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Trustees and through its committees. The Board of Trustees regularly engages in discussions with management regarding the Adviser's risk assessment and risk management policies. In addition, the Audit Committee of our Board of Trustees (the "Audit Committee") oversees the management of systemic risks, including cybersecurity. The Audit Committee is briefed on the Adviser's information security program and cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports periodically to the Audit Committee, and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: TPG Twin Brook Capital Income Fund


text: Our Chief Information Officer ("CIO"), who reports directly to the Chief Executive Officer, oversees the Company's approach to managing cybersecurity and digital risk. Our CIO also regularly engages with cross-functional teams at the Company and partners with our dedicated technology risk management and privacy teams and collaborates with our internal audit department to review information technology-related internal controls as part of the overall internal controls process. Our information security strategic plan includes the development of a single detection and response team across both the corporate and product information and technology environments.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated with our overall risk assessment process and has been embedded in our operating procedures, internal controls and information systems.

companyName: CHARLES & COLVARD LTD


text: Risk Assessment and Management – We comply with the international standard ISO 27001, an Information Security Management System (ISMS), which helps safeguard the confidentiality, integrity, and availability of information through a structured risk management process. This approach assures stakeholders that cybersecurity risks are effectively managed. To support this commitment, we conduct regular risk assessments to identify, evaluate, and mitigate potential threats.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: As a company that provides managed support services and security solutions for client applications, databases and technology infrastructure, we are committed to protecting the confidentiality, integrity and availability of our and our clients' information assets. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. As described further below, we maintain a formal and comprehensive information security management framework based on the ISO 27001:2013 Information Security Management System standard and have implemented policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. Our Board, including the Audit Committee of our Board, and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component.

companyName: Rimini Street, Inc.

ticker: RMNI


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: Enterprise risk management ("ERM") at Spire oversees significant risks to the Company's ability to successfully execute on strategy and achieve corporate objectives. Spire's ERM is based on a structured, comprehensive process that leverages ISO 31000:2018, adopted and customized to the Company's needs, utilizing an ongoing process of risk identification, evaluation, treatment, integration and monitoring. ERM helps assess priorities and facilitate decision-making for resource allocation as it relates to risk management. Two risks prioritized by our Enterprise Risk Oversight Committee related to cybersecurity are cyber threats and vendor management. Additionally, the ERM process is structured to integrate with operational levels, where risk is managed, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 utilized by the Company's Information Security function for managing cybersecurity.

companyName: SPIRE INC

ticker: SR


text: Process Integration Our risk management processes, including Cybersecurity, are overseen by the Audit Committee of our board of directors. Our processes include ongoing information technology risk assessments, and third-party security risks assessments.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Our Chief Information Security Officer has more than 20 years of information security expertise and is primarily responsible to identify, assess and manage our material risks from cybersecurity threats. Our Chief Information Security Officer started his career as a security engineer and has held various leadership positions in the security function at Microsoft, Netflix, Bridgewater Associates and, most recently, Robinhood. He received a bachelor degree in management information systems and holds an industry certification.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Third-Party Cybersecurity Consultants: We engage trusted third-party cybersecurity experts to enhance our security posture, perform assessments, and provide strategic guidance, ensuring continuous improvement in our cybersecurity approach.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity attack or incident, such as a data breach, ransomware, malware, phishing, or other form of cybercrime, could adversely affect our operations, customer service, product development, and competitive position. Such incidents may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. They could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.

companyName: PSYCHEMEDICS CORP

ticker: PMDI


text: In addition, from time to time, the Board may constitute a special committee to focus on a particular cybersecurity matter or risk. As discussed above, in February 2023, we identified that we had become subject to a ransomware incident. Our Board of Directors responded quickly and constituted a special committee of the Board for cybersecurity, which included Gerald G. Colella, the Chair of our Board, Elizabeth A. Mora, the Chair of our Audit Committee, and Peter J. Cannone III and Joseph B. Donahue, each a member of our Audit Committee, to oversee the investigation, recovery, and restoration phases following the incident (the "Special Committee"). The Special Committee held 21 meetings during the first three months following the identification of the incident. At these meetings, our Chief Executive Officer, our Chief Financial Officer, our General Counsel, our Executive Vice President of Operations and Corporate Marketing, and our then-Chief Information Officer reported to the Special Committee on various aspects of the incident, including the information technology forensic investigation, business restoration and recovery activities, and the impact of the incident on our annual audit and assessment of internal controls as well as the filing of our Annual Report on Form 10-K for the year ended December 31, 2022.

companyName: MKS INC

ticker: MKSI


text: The Company's processes are designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to services that identify cybersecurity threats, analyzing reports of threats, conducting scans of the threat environment, evaluating threats reported to us and conducting vulnerability assessments to identify vulnerabilities.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: Our Security Culture We protect our information assets and manage risk by promoting a culture that communicates security risks, designs secure IT systems and operates according to approved processes to reduce the likelihood and impact of security incidents. We achieve this objective by: • Designing, implementing and maintaining solutions with appropriate security controls; • Sustaining solutions with required patching and vulnerability remediation; • Creating and executing controls in support of policy as well as regulatory compliance; • Ensuring that our policies, processes, practices and technologies proactively protect, shield, defend and remediate cyber threats; and • Delivering quality communications and annual training to stakeholders on cyber awareness and computing hygiene.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: Following these risk assessments, we redesign, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Vice President of Technology who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX