text: Our Cybersecurity Manager has experience spanning multiple OCC and FDIC regulated financial institutions across the nation. He holds various cybersecurity related certifications and is currently registered with the International Information Systems Security Certification Consortium as a Certified Information Systems Security Professional (CISSP) member in good standing.

companyName: FIRST BANCSHARES INC /MS/


text: The Company maintains technical and organizational safeguards, including vulnerability assessments, endpoint monitoring, penetration testing, employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms to protect the Company's assets and operations. In addition to our internal information security team, we rely on services from various third parties, including a Managed Security Service Provider ("MSSP") and services from an IT solutions organization. To evaluate the effectiveness of these internal and external efforts, Kelly adopted the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") and is assessed against the NIST CSF by a third-party firm at least annually. We use the assessment, reviews and exercises to ensure that the Company's information security program and processes for managing material cybersecurity risks are responsive to changes in the threat environment.

companyName: KELLY SERVICES INC

ticker: KELYA

secItem: Item 1C


text: Cybersecurity Risks We are currently not aware of any material cybersecurity incidents or threats that have impacted the Company or our business, financial condition, results of operations, employees or customers in the past three years. However, we and our customers routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems, including digital ordering solutions through which more than 85% of our domestic sales originate. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential internal and customer information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third party providers, will prevent breakdowns or incidents affecting our or our third party providers' databases or systems that could adversely affect our business. For a discussion of these risks, see "Item 1A—Risk Factors—Information Technology and Cybersecurity Risks—Disruptions of our critical business or information technology systems could harm our ability to compete and conduct our business" and "—Failure to maintain the integrity of internal or customer data could result in damage to our reputation, loss of sales, and/or subject us to litigation, penalties or significant costs."

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Vice President of Information Technology to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Our CISO is responsible for the oversight, implementation and compliance of our cybersecurity program and mitigation of cyber-related risks. Our current CISO has more than 20 years of industry experience and over 5 years of experience with development, training and controls of effective enterprise cybersecurity programs. Our CISO's responsibilities include, but are not limited to, (a) reviewing our enterprise risk register and functional risk register, (b) maintaining adequate processes to manage the identified risks under our cybersecurity program, (c) analyzing logs of cybersecurity threats and vulnerabilities, (d) overseeing prevention, detection, mitigation and remediation efforts and (e) developing, maintaining and ensuring team familiarity with the above mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports the implementation of our cybersecurity program and internal reporting, security and mitigation functions.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: In addition, a biennial cybersecurity risk assessment is completed with an external third party to provide us with a more complete view of our cybersecurity risk. We retain a prominent cybersecurity consulting firm to assist with, and advise on, our cybersecurity and incident response program. We engage on a quarterly basis with our auditors on matters regarding cybersecurity and maintain a robust control environment, in compliance with the Sarbanes-Oxley Act of 2002, as amended, that includes controls to protect the confidentiality, integrity and availability our data.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors—Risks Related to Our Business" of this Annual Report for more information regarding the cybersecurity risks we face.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: Business and Operational Risks • cyber and other security threats or disruptions faced by us, our customers or our suppliers and other partners, and changes in related regulations • our ability to attract and retain a qualified, talented and diverse workforce with the necessary security clearances to meet our performance obligations • the performance and viability of our subcontractors and suppliers and the availability and pricing of raw materials and components, particularly with inflationary pressures, increased costs, shortages in labor and financial resources, supply chain disruptions, and extended material lead times • impacts related to health epidemics and pandemics and similar outbreaks • our exposure to additional risks as a result of our international business, including risks related to global security, geopolitical and economic factors, misconduct, suppliers, laws and regulations • our ability to innovate, develop new products and technologies, progress and benefit from digital transformation and maintain technologies to meet the needs of our customers • natural disasters • products and services we provide related to hazardous and high risk operations, including the production and use of such products, which subject us to various environmental, regulatory, financial, reputational and other risks • our ability appropriately to exploit and/or protect intellectual property rights

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: The CTO and CISO have served in various roles in information technology and information security for over 28 and 25 years respectively and hold relevant professional certifications. The Adviser's CCO and CFO, each hold undergraduate and graduate degrees in their respective fields, and each have over 15 and 28 years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: We regularly review industry recommendations, best practices, and standards regarding cybersecurity and information technology. NIST (National Institute of Standards and Technology), CIS (Center for Internet Security) and CISA (Cybersecurity and Infrastructure Security Agency) are some of our primary resources for information. We seek to meet or exceed the standards of, and recommendations by, these organizations as well as those of our third-party technology vendors. We require in-depth annual cybersecurity training for all of our end users as well as refresher training throughout the year. We have processes in place to prevent, identify, manage, and mitigate any occurrence timely, and we engage an independent firm to perform annual assessments of our network security and infrastructure. In addition to our existing methods of detection, monitoring, and mitigation of cybersecurity threats and incidents, we implement new technologies, controls, and policies with the goal of protecting our business, employees, investors, customers, and suppliers.

companyName: ATRION CORP


text: We have not encountered any incidents from cybersecurity threats to date, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: NovoCure Ltd

ticker: NVCR


text: In accordance with our board policy for incident management and business continuity planning, we have implemented security incident response plans and security incident response teams. These teams include members from multiple functional areas of our organization that identify, investigate, respond, and resolve cybersecurity incidents. Cybersecurity incidents are evaluated and ranked by severity and prioritized for response. We also evaluate the need to include the use of third parties to assist us in the response to a cybersecurity incident. Our Senior Vice President of Power Supply leads the security response teams, and the activities of the security response teams are overseen by our senior management team. Based on the severity of incident, members of the senior management team determine whether the incident requires immediate escalation to our board of directors.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: Cyber Risk Management and Strategy Kymera uses, stores and processes data for and about our research programs, clinical trials, employees, and suppliers. We have developed and maintain an information security program designed to assess, identify, and manage risks from cybersecurity threats, including to our data and systems. We conduct periodic assessments of our assets, including internal and external security testing, as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We have adopted an Incident Response Policy that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. have not encountered cybersecurity challenges that have, or are reasonably likely to, materially impair our operations or financial standing.

companyName: Bone Biologics Corp

ticker: BBLG


text: Our Board of Directors (the "Board") is ultimately responsible for the risk oversight of the company, including, cybersecurity and privacy risks. Our Board has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Our Audit Committee is charged with reviewing and discussing our policies with respect to risk assessment and risk management, which includes overseeing our major financial, privacy, security, cybersecurity, and technology risk exposures and the steps our management has taken to monitor and control these exposures. At the management level, our Head of Cybersecurity and the cybersecurity teams are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our current Head of Cybersecurity has 20 years of industry experience, including serving as an enterprise Chief Information Security Officer for many years and having extensive experience in developing and leading risk management programs. Additionally, our Head of Cybersecurity holds multiple industry standard security certifications, including CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager).

companyName: Wayfair Inc.

ticker: W


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Board of Directors is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Board of Directors on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on RetinalGenix's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: RetinalGenix Technologies Inc.

ticker: RTGN


text: Board and Committee Oversight - Our Board of Directors has ultimate oversight of the Company's cybersecurity programs and strategy, with the Audit Committee maintaining oversight responsibility in reviewing cybersecurity and other information technology risks. The Audit Committee assess the steps management has taken to monitor, minimize or control such risks or exposures. The Company's Chief Information Officer presents a cybersecurity report to the Audit Committee each quarter. The report includes updates of recent cybersecurity threats, current key performance indicators of security controls and summaries of any recent incidents at the Company.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: At Hexcel, we are committed to the security of our products and services, the protection of employee, customer and Company data, and the safeguarding of our manufacturing capability. Our cybersecurity program is led by our Chief Information Officer ("CIO"), who has over 20 years of experience in information technology leadership and 10 years of experience directly overseeing our information security program and holds a Master of Business Administration in technology management. As a part of our cybersecurity program, we have engaged, and in the future may continue to engage, third-party consultants and advisors, including a third-party consultant with extensive experience designing, leading, and maintaining the implementation and assurance frameworks for organizational information, to provide virtual chief information security officer services, including establishing a security architecture, policies, practices, and response capabilities.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: We have retained an outside cybersecurity firm for our managed security services, which reports to our VP of IT. The cybersecurity firm has professionals with more than 20 years of experience working in information technology-related roles and degrees in Information Technology, including cybersecurity, Certified in Risk and Information Systems Control (CRISC), and Global Information Assurance Certifications in Security Essentials (GSEC) as an Intrusion Analyst (GCIA). The cybersecurity firm has extensive experience is supporting firms in applied knowledge of information technology governance and security frameworks that include: ISO 27000, NIST, HITRUST, ISC2, ITIL, and COBIT.

companyName: Adeia Inc.

ticker: ADEA


text: Roivant and the Vants' cybersecurity programs are informed by industry standards and include periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management and monitoring tools, designed to monitor, identify and manage risks from cybersecurity threats and incidents. In addition, we have implemented employee security and awareness training related to cybersecurity threats and incidents.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: Cybersecurity risk is a component of Advanced Energy's broader risk management program and managed at the highest levels of the company, starting with Advanced Energy's CIO, who meets with the Chief Executive Officer and other members of executive management regularly to discuss issues, assess risks, and coordinate company-wide cybersecurity initiatives. Our CIO leads a dedicated cybersecurity technical team that manages, monitors, and enforces compliance with the cybersecurity program.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Third-party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor and its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.

companyName: ENTERPRISE BANCORP INC /MA/


text: The Audit Committee receives periodic updates from our director of information technology. These updates include matters such as ongoing changes in our external and internal cyber threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cyber and technology-related risks, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: We have continued to expand investments in information security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting mechanisms, and engaging experts. Information security awareness trainings are a compliance requirement for employees. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts.

companyName: AtriCure, Inc.

ticker: ATRC


text: The Company's comprehensive approach to cybersecurity and its associated risk management framework requires, when applicable, the engagement of certain third parties, which could include law enforcement, vendors, and other software or service providers. The Company leverages substantial technological tools and partners to augment and enable the efforts of its internal cybersecurity team. These third parties assist with various cybersecurity functions including monitoring, threat detection, vulnerability management, network segmentation, mobile device management, data protection, tabletop exercises, semi-annual penetration testing, multi-factor authentication, and threat intelligence.

companyName: Vertiv Holdings Co

ticker: VRT


text: Our SCI Technology subsidiary has been certified under the U.S. Cybersecurity Maturity Model Certification (CMMC) program. We also engage third-party experts to improve our cybersecurity posture, including through penetration testing.

companyName: SANMINA CORP

ticker: SANM


text: Board of Directors' Oversight and Management's Role Through the Company's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and information technology risks. The Board or Audit Committee regularly reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, the Company's Director of Information Systems is responsible for upward reporting of emerging cybersecurity incidents.

companyName: OneWater Marine Inc.

ticker: ONEW


text: As of March 31, 2025, the Trust's business strategy, operations, or financial condition have not been materially affected by, and are not likely to be materially affected by, any cybersecurity threats or incidents.

companyName: Frontier Funds


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: Our business is subject to risk from cybersecurity threats and incidents. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or those of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Ventas considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Ventas, Inc.

ticker: VTR


text: Our manager's cybersecurity risk management program, which is subject to our oversight, is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.

companyName: ALEXANDERS INC

ticker: ALX


text: Material Effects of Cybersecurity Incidents As of the date of this Annual Report, we have experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems. We do not believe these cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in "Item 1A. Risk Factors" in this Annual Report, as updated by Getty Images' subsequent SEC filings. The risks described in such filings are not the only risks facing Getty Images. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial may materially adversely affect Getty Images' business, financial condition, or results of operations.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Our cybersecurity program, which is discussed in greater detail above, is led by our CISO, who has over 20 years of prior work experience in various roles with large public companies involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. In addition, our CISO manages a team of highly trained and experienced cybersecurity professionals in support of the cybersecurity program.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Board of Directors does not have a standing risk management committee. Instead, our Board of Directors as a whole has oversight responsibility for risk management, which it administers directly as well as with the assistance of standing committees of the Board of Directors that will address risks inherent in their respective areas of oversight. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks, including cybersecurity.

companyName: NextTrip, Inc.

ticker: NTRP


text: Our executive team and Board of Directors are actively involved in overseeing cybersecurity risks. The executive team and the CIO oversee the Company's information security efforts and cybersecurity governance. This team regularly reviews our cybersecurity posture and any incidents that have occurred.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: The Custodians have multiple, redundant cold storage sites, which are geographically distributed including sites within the United States. Cold storage locations of the Custodian are monitored by 24x7 on-site security, video surveillance and alarms, hardened room structures, and access to these facilities is controlled by multi-person controls, multi-team access rules, and multi-factor authentication. The locations of the cold storage sites may change at the discretion of the Custodian and are kept confidential by the Custodian for security purposes. Transactions from cold to hot storage require physical access, according to the above controls, to one or more cold storage facilities, as well as systematically enforced approvals and integrity verifications, before the secure device can be used to cryptographically complete the transaction. At no point during this process is the private key removed from the secure device(s) nor the cold storage facility. Once these security processes have been completed, a transfer on the Solana network can be executed, as signed using the private keys held offline in cold storage.

companyName: UPEXI, INC.

ticker: UPXI


text: Our IT management team, with oversight from our Board of Directors and Nominating and Corporate Governance Committee as well as members of our management team, including our Chief Operating Officer, Chief Financial Officer and General Counsel, are primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: AMBARELLA INC

ticker: AMBA


text: provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: CervoMed Inc.

ticker: CRVO


text: – Board of Directors – Enterprise risk management ("ERM") process: As part of the ERM process, executive management and the Board of Directors regularly review an assessment related to cybersecurity and data protection risks to identify material risk areas, assess processes to mitigate those risks, and identify process and procedure improvements to alleviate identified risks, including allocating appropriate resources. Cybersecurity and data protection focus areas of ERM include phishing, malware, data breaches, outdated software, staffing levels for key information technology positions, and risks associated with the use of third parties. – Audit and Finance Committee of the Board of Directors: The Audit and Finance Committee is responsible for discussing the Combined Company's major information technology risk exposures, including cybersecurity, and the steps management has taken to monitor and control such exposures. The Audit and Finance Committee dedicates attention to and provides oversight of certain cybersecurity risks. The Chief Digital and Technology Officer and Corporate Vice President, IT Infrastructure Operations and Security, meet with the Audit and Finance Committee regularly to assess management's progress on implementing process and procedure improvements related to cybersecurity. The Audit and Finance Committee also provides guidance on long-term and short-term cybersecurity strategies.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: Our management team, including our Head of IT and our Senior Vice President, Finance, has primary responsibility for developing and managing our overall cybersecurity risk management program. Our Head of IT supervises our internal cybersecurity personnel and our third-party cybersecurity vendors and consultants. Our management team has over 20 years of experience managing risks, including cybersecurity risks, at biotechnology companies and interacting with boards, and our Head of IT has served in various roles in information technology and information security for over 20 years.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: We use third -party service providers to perform a variety of functions throughout our business, such as internet hosting companies, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with any particular provider.

companyName: EMERSON RADIO CORP

ticker: MSN


text: Our cybersecurity team has an average of over 25 years of experience in information technology, security, and risk management, including individuals with a master's degree in business administration as well as a master's degree in cybersecurity.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: Our GISO has processes in place to stay informed of and monitor the prevention, detection, mitigation and remediation of cybersecurity risks, including but not limited to, employing appropriate incident prevention and detection software, employing industry-standard encryption protocols where appropriate, applying patches and implementing identified corrective actions in a timely manner, maintaining an incident response plan and related procedures and regularly conducting internal training, cybersecurity audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cyber incidents. We consider cybersecurity threats, along with other significant risks that we face within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that if realized, are reasonably likely to materially affect us.

companyName: Leslie's, Inc.

ticker: LESL


text: Cybersecurity Risks As of December 31, 2024, we have not had any known instances of material cybersecurity incidents. However, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Company maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack. See "Risk Factors—Risks Related to our Business—If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results."

companyName: American Homes 4 Rent

ticker: AMH


text: Our Information Security Team reports to our CCO. The CCO reports to the Compliance Committee, which includes the CFO and CLO. The CFO and CLO report directly to the Company's Chief Executive Officer. Each of the CFO, CLO and CCO report regularly to our Board of Directors on, among other matters, our global risk landscape and risk management efforts, including those related to cybersecurity risks.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. The SCC also analyzes emerging global cyber security risks and uses the expertise of its members to review DXC's current security posture and consider steps to take to mitigate such risks and implement improvements where it deems necessary.

companyName: DXC Technology Co

ticker: DXC


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • comparing our processes to benchmark standards, such as those set by the National Institute of Standards and Technology (NIST); • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • conduct annual customer data handling and use requirements training for employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Material Effects of Cybersecurity Threats Although cybersecurity risks have the potential to affect the business, financial condition, and results of operations, the Company does not believe that risks from attacks, including results from any previous cybersecurity incidents or threats, have materially affected or reasonably likely to materially affect the Company's strategy, operations or financial condition. However, no matter how well controls or designed or how well cybersecurity risk management procedures are implement, there can be no full assurance given that risk remains of an incident that could cause material harm to the business. See "Any significant IT systems-related failures, interruptions or security breaches or any undetected errors or design faults in IT systems could result in limited capacity, reduced demand, processing delays, privacy risks and loss of customers, suppliers or marketplace merchants and a reduction of commercial activity" in Item 1A, Risk Factors in this Annual Report on Form 10-K.

companyName: Mondee Holdings, Inc.

ticker: MOND


text: Our enterprise risk team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to functionally serve as a virtual chief information security officer ("CISO"), to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. The CISO is primarily responsible for leading our cybersecurity risk assessment and management processes. This expert has experience having served as the chief information security officer for an international commercial real estate services company and currently serves as chief executive officer of a cybersecurity firm focused on commercial real estate. He is supported by an internal cross-functional management team of IT and internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training and risk management efforts.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Material Risk Assessment The Company evaluates material risks from cybersecurity threats in terms of the potential impact on technology, information, data, and business operations, taking into account applicable laws and regulations, and with a focus on protecting the confidentiality, integrity, and availability of information, data and systems. Associated risk assessments are performed by the Company's risk analysts, subject matter experts, and information technology associates to identify, analyze, and quantify the risks and relevant objectives, and to determine the appropriate management action and priorities for managing the risks and implementing mitigating controls. Additional assessments to evaluate residual risk are performed when there are changes to controls that have the potential to create a material risk. Risk assessments also include appropriate considerations for regulatory and contractual requirements, and involve the Company's legal, data privacy, finance, and risk assurance functions as applicable.

companyName: GARMIN LTD

ticker: GRMN


text: In the ordinary course of our business, the Company is subject to cybersecurity threats and risks which it manages as an important component of its overall enterprise risk management strategy. To identify, assess, and manage cybersecurity threats and risks to our business, the Company has made significant investments in its processes, control environment, and technology solutions to help prevent and mitigate the impact of any such threats and risks. These processes include the use of sophisticated third-party software for continuous monitoring, the use of expert outside consultants, ongoing training and educational programs, regular and periodic updates on new cybersecurity threats and risks, incident response procedures, and the implementation of other cybersecurity best practices wherever possible. These processes also cover risks from cybersecurity threats associated with our use of information technology systems of third-parties upon which we rely.

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: Our management and board of directors (the "Board") recognize the importance of maintaining the capacity, reliability and security of our information technology environment and data security infrastructure to deliver on the expectations, and maintain the trust and confidence, of our customers, clients, business partners, employees and investors. The Board is actively involved in our risk management practices, including oversight of our overall enterprise risk management ("ERM") framework, in which cybersecurity risk management is reviewed by the Board on at least an annual basis. Our cybersecurity and privacy programs align with the recognized frameworks established by the National Institute of Standards and Technology and leverage the International Organization for Standardization and other applicable industry standards. The focus of our cybersecurity program is preserving the confidentiality, security and availability of our systems and data, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information technology team.

companyName: Seneca Foods Corp

ticker: SENEA


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. Our Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Innovation and Technology Committee. In connection with that oversight responsibility, our Senior Vice President of Technology and Chief Legal Officer meet with the Innovation and Technology Committee on a quarterly basis to provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: The company has a dedicated incident management team responsible for managing and coordinating its cybersecurity incident response efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the executive incident team and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The company's incident response team partners with other key stakeholders as appropriate to respond to cybersecurity incidents. The company maintains a cybersecurity and incident response program to prepare for and respond to cybersecurity incidents, which includes standard processes for reporting and escalating cybersecurity incidents to the executive incident team. Additionally, the company conducts at least one incident response test exercise on an annual basis, where members of a cross-functional team engage in a simulated incident scenario.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO and CISO, is involved in assessing and managing our cybersecurity risks. The CISO reports to the CIO (who in turn reports to our Chief Financial Officer, who in turn reports to the CEO), and both the CIO and CISO participate in global leadership team meetings. With over 26 years of experience, including over three years with the company, the CIO has been recognized externally for his leadership in technology innovation in the industry, and provides strategic leadership for the company's IT organization. The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Management receives information on cyber activities, incidents, and risk assessments quarterly from the VP/Corporate Information Security, Resilience and Data Officer (CISRDO), the SVP/Manager Application Systems, and the EVP/Operations during the Security and Information Security Committee and the Information Technology Steering Committee meetings. This information is also shared and discussed quarterly with the Enterprise-wide Risk Management Committee. Various key risk measures related to cyber risk are tracked and reported quarterly to the Enterprise-wide Risk Management Committee. Our VP/CISRDO has been with CTBI for six years and has extensive 30+ years of experience in information technology management roles in various industries. At December 31, 2024, our SVP/Manager Application Systems had been with CTBI for 33 years and held various information technology leadership roles, and our EVP/Operations had been with the company for 31 years, leading and guiding our technology teams. Effective January 31, 2025, our EVP/Operations retired, and our SVP/Manager Application Systems was promoted to EVP/Operations. The Board of Directors monitors cyber risk through quarterly reports from the Board's Risk and Compliance Committee.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Risks from Cybersecurity Threats As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, a third-party vendor recently informed us that Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our Exogen device to commercial payers experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. As a result of the Change Healthcare incident, certain of our patient billing and collections processes have been disrupted. While we have identified an alternative claim processing intermediary and have resumed claims submissions to some payers, this event may cause delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us. As of the date of this Annual Report, UnitedHealth Group is still investigating this incident, including any potential impact on claims and patient data. On March 7, 2024, UnitedHealth Group issued a statement indicating that it expects to begin testing and reestablish connectivity to the effected claims network to restore service beginning March 18, 2024. We do not presently believe that the Change Healthcare incident has materially affected, or is reasonably likely to materially affect the Company, including with respect to our claims collection and cash flows. We continue to evaluate the impact of the Change Health incident on our Company.

companyName: Bioventus Inc.

ticker: BVS


text: protection of sensitive information; detection, assessment, and response to cyber threats; and continuous improvement of our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged approach to address cyber threats and incidents that includes (i) implementation of various industry best practices, (ii) proactive monitoring of our IT systems, (iii) ongoing employee training, (iv) quarterly phishing campaigns, (v) continued education for our cybersecurity team, and (vi) regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods, and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers, and other third parties. Our business involves the collection, processing, storage, and transmission of personally identifiable information and other sensitive and confidential information. This data is wide-ranging and relates to our employees, customers, and third parties.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: At the management level, our cyber program is managed by our ICSP group. The ICSP group consists of Information Technology (IT) managers, IT security subject matter experts, and internal audit personnel and is led by our Vice President of IT who has more than 25 years of experience in IT, enterprise security, and cyber risk management, a Bachelor's degree of Science, CIS, Information Technology and Master's of Business, Information Systems, and holds Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Data Privacy Solution Engineer designations. The ICSP group is in charge of developing, maintaining, and measuring compliance with the information and cybersecurity governance program, as well as monitoring cyber incidents and implementing mitigation measures as part of an evolving, dynamic external environment. Our approach to cybersecurity incident reporting and response planning is governed by our incident response plans established for each of our business units. The plans outline the processes related to detecting, assessing, investigating, mitigating, and remediating cyber incidents, as well the communication and reporting plan and the required personnel to be included in the process and communications.

companyName: Otter Tail Corp

ticker: OTTR


text: In evaluating cybersecurity incidents, management considers the potential impact to customer privacy as well as results of operations, controls, and financial condition, as well as the potential impact, if any, to the Company's business strategy or reputation. As of the date hereof, we are not aware of any risks from cybersecurity threats, including risks from any past cybersecurity threats, that have materially affected our business or results of operations. However, future cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition. For more information on risks associated with cybersecurity threats, see the risk factor titled "Cybersecurity, Data Privacy and Information Security Risks" in Item 1A-Risk factors.

companyName: Walgreens Boots Alliance, Inc.


text: The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified through regular automated vulnerability scanning tools and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the Information Technology and Information Security Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the FFIEC CAT to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company's information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.

companyName: LAKE SHORE BANCORP, INC.


text: We have designed and implemented processes to assess, identify, manage, detect, and respond to material cybersecurity risks and threats to our IT systems, including the prevention, detection, mitigation, and remediation of cybersecurity incidents in order to protect the confidentiality, integrity, and availability of our IT systems and the information residing on those systems. These processes are part of our overall risk management process and are embedded in our operating policies, procedures, and controls.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: During the normal course of business, we have experienced and expect to continue to experience a range of cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."

companyName: Aramark

ticker: ARMK


text: We devote significant resources to network security, data encryption, employee training, monitoring of networks and systems, patching, maintenance and backup of systems and data. We also follow best practices for IT and data security as our IT controls are aligned with DFARS / NIST 800-171 IT Security Standard for US Government Contractors. Although there have been no cybersecurity incidents have been material to the Company to date, cyber-attacks are continually becoming more sophisticated, and our IT network is still potentially vulnerable to threats and incidents in the future.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the fiscal year ended March 31, 2024.

companyName: QDM International Inc.

ticker: QDMI


text: Our risk management program considers cybersecurity threat risks alongside other risks as part of our overall risk assessment process. We believe that integrating our cybersecurity risk management into our broader risk management framework promotes a company-wide culture of cybersecurity risk management and ensures that cybersecurity considerations are an integral part of decision-making at every level.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Members of the Audit Committee have experience in overseeing and managing cybersecurity and data privacy risks.

companyName: Cipher Digital Inc.

ticker: CIFR


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: While the Board has overall responsibility for risk oversight, the Board recently delegated to the audit committee of the Board the responsibility for assisting the Board with cybersecurity disclosure matters. In its oversight role, the Board is expected to specifically consider risks that relate to the reputation of the Company and the general industry in which we operate, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: The Board, in coordination with the Risk Committee, oversees the Company's risk management program, which includes risks arising from cybersecurity threats. DMC's Chief Information Officer (CIO) manages the Company's cybersecurity program and is responsible for leading and coordinating cybersecurity activities across the organization. The CIO reports directly to our Chief Executive Officer and has extensive information technology experience.

companyName: DMC Global Inc.

ticker: BOOM


text: Risk Management and Strategy have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our Company from cyber threats as well as secure our networks and systems. Such processes include safeguards, response plan, and review of our policies and procedures to identify risks. We engage an external party to enhance our cybersecurity oversight.

companyName: Inmune Bio, Inc.

ticker: INMB


text: Management's Role in Managing Risk and Monitoring Incidents The leaders of our Information Security organization are responsible for assessing and managing our material risks from cybersecurity threats and supervision of both our internal information security personnel and our retained external cybersecurity consultants.

companyName: Vista Outdoor Inc.


text: We have an Information Security Third Party Risk Management Policy, as well as a Vendor Code of Conduct, which contractually requires each third-party service provider accessing our or our customers' information systems to comply with our information security policies, as well as to meet a minimum set of information security and data privacy and protection standards in connection with their delivery of products and/or services to us. We also engage a third-party service provider to assess our third-party suppliers for potential risks and effectiveness of controls related to information security and data privacy protection that are relevant in the context of their delivery of services.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Our Executive Vice President of Technology, who reports directly to the Chief Executive Officer and has over 17 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We may be harmed by breaches of security of information technology systems or our confidential consumer, employee, financial, or other proprietary data."

companyName: NOODLES & Co

ticker: NDLS


text: Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer, who leads a team responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, has extensive experience and background in information technology, cybersecurity, enterprise strategy, risk management. Additionally, our Chief Operating Officer chairs our Cybersecurity Incident Response Team, which is responsible for prevention, identification, containment, eradication and remediation of cybersecurity incidents.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: The Chief Security Office maintains a comprehensive metrics and reporting framework, underpinned by an extensive data set allowing for global, regional, and divisional views. Security metrics and reporting provided to Deutsche Bank Group s governance forums at all seniority levels support appropriate security risk awareness and decision taking. The Management Board receives a comprehensive quarterly information security risk posture report, as well as ad hoc information if required. Furthermore, the Chief Security Officer provides regular updates on material topics relating to security to the Supervisory Board's Committee responsible for technology, data and innovation.

companyName: RREEF Property Trust, Inc.


text: We acknowledge the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, harm to our candidates, associates, employees and clients; operational disruptions; violation of privacy laws and regulations; breach of confidentiality and other contractual obligations; litigation and legal action; financial and reputational harm. We leverage cybersecurity technologies and established processes, procedures, and controls to identify, assess, and manage material cybersecurity risks.

companyName: TrueBlue, Inc.

ticker: TBI


text: Our executive officers are responsible for the day-to-day management of the material risks that we face. Our executive officers are led by a third-party consultant, who oversees company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The third-party consultant is advised by their Security Operations Center Manager with a variety of technical certifications, as well as extensive background in IT infrastructure, risk mitigation, and incident response planning.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: Our company has stringent processes and management that is used to assess, identify, and manage risks from unauthorized access through our information systems that may affect confidentiality, integrity, or availability of our information systems. We utilize the appropriate National Institute of Standards and Technology (NIST) controls for our sector and undergo yearly SOC II audits. These audits as well as our routine senior management level reviews ensure that our processes are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents that may affect our data. We require coordinated IT security guidelines with our partners and vendors to mitigate risk associated with the distribution and holding of data sensitive to our company. A core portion of our business is as a channel partner for cybersecurity services through our Overwatch solution. This solution includes robust detection and response capabilities managed by a 24x7 US-based security operations center with dedicated senior leadership to the process and programs included in Overwatch. We utilize the same program that we offer as a service as our internal solution. In addition, we have hardware, site, and network protections around our physical devices that are located both onsite at High Wire Networks as well as a fully managed offsite data center.

companyName: HIGH WIRE NETWORKS, INC.

ticker: HWNI


text: Management of the Company is responsible for the day to day risk management process, specifically the Director of IT, who reports and operates under the direction of the Chief Financial Officer (CFO), who then reports directly to the Audit Committee regarding such risks. The CFO provides updates to the Audit Committee on cybersecurity risks and threats annually, but the Director of IT attends both the Audit Committee meetings and the Board meetings to provide further updates on cybersecurity and other IT related matters. At a minimum, the Audit Committee is given updates on a quarterly basis, but if a situation were to arise, the Audit Committee would be notified once the Company was aware of the issue.

companyName: ESCALADE INC

ticker: ESCA


text: Our Chief Information Officer (CIO) meets at a regular cadence with a member of the board of directors who is the board's cybersecurity designee. The CIO also briefs the audit committee on the effectiveness of Wolfspeed's cyber risk management program quarterly or in accordance with significant events. In addition, the board of directors is advised by our CIO on Wolfspeed's cybersecurity risk exposures and steps taken to monitor and mitigate cybersecurity risks.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Our cybersecurity risk management program includes but is not limited to the following: • risk assessments performed both internally and by external vendors to assist in the identification of material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise Information Technology (IT) environment; • contracting with and use of third-party service providers, where deemed necessary, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; • adoption of a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for selecting and working with key service providers, suppliers, and vendors that takes into account our assessment of their criticality to our operations and their respective risk profiles.

companyName: PRICESMART INC

ticker: PSMT


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess potential material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: RAMBUS INC

ticker: RMBS


text: Increased global cybersecurity vulnerabilities and threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. We regularly experience cyberattacks aimed at our information systems and networks, including those that store sensitive data about third parties. We have established a Global Information Security Program, which is administered and overseen by the Company's Chief Information Security Officer ("CISO"), that establishes minimum requirements we adhere to in order to provide a secure environment for developing, implementing, and supporting our information technology and systems. Our Global Information Security Program is designed to maintain compliance with various regulatory requirements and certification standards, including those under HIPAA, HITECH, PCI, ISO, SOC and SOX, as we aim to have world-wide, generally accepted, best practices.

companyName: WEX Inc.

ticker: WEX


text: of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Prevention System (IPS) that scans data in transit to help prevent the execution third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common approaches, reporting channels, and governance processes that apply the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Lemonade, Inc.

ticker: LMND


text: Additional Information We have not identified any known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including the risk factors that are described under the heading "Cybersecurity and Information Technology Risks," for more information regarding the risks we face from cybersecurity incidents that could adversely impact our business and operations, harm our reputation and subject us to claims or litigation.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Mission Cloud assists us in the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes related to our Amazon Web Services infrastructure, and we leverage that information to assess and help prepare us and our employees to address cybersecurity risks.

companyName: Freeze Tag, Inc.

ticker: FRZT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials ("Information Systems and Data").

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Management and Strategy Overview continue the process of designing and implementing a formal risk-based approach to cybersecurity which aligns with corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and will be based on a cybersecurity framework, such as the National Institute of Standards and Technology ("NIST") Cybersecurity protect our IT systems and information from cybersecurity risks, we use and continue to implement various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Management Experience Our CDO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CDO joined PTC as Chief Digital and Information Officer in January 2022 and is responsible for PTC's global information technology (IT) team, overseeing PTC's digital infrastructure and working with business leaders to guide PTC's digital process optimization strategy. He has more than two decades of IT and operations leadership. Before joining PTC, he served as Global Vice President and Chief Information Officer for Avaya, where he led a globally-dispersed team of 1,200 IT professionals to support the entire global Avaya enterprise. Prior to Avaya, he held technology leadership roles at Arise Virtual Solutions Inc., Oracle, and Colorado College.

companyName: PTC INC.

ticker: PTC


text: Outside Consultants: The Company engages various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to, among other things, externally audit our systems against top information security standards, including controls for Payment Card Industry Data Security Standard (PCI DSS) and conduct regular testing of our networks and systems to identify vulnerabilities.

companyName: POTBELLY CORP

ticker: PBPB


text: Several experienced information security professionals report to our Chief Information Security Officer and he is supported by a team of trained cybersecurity team members. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: FOOT LOCKER, INC.


text: The CISO is a retired Air Force veteran who has served in various roles in information technology, information security and the U.S. Government for over 30 years. The CISO most recently served as the Chief Information Security Officer of Optiv Security and previously served as the Executive Director, Classified Cybersecurity, at Lockheed Martin. The CISO holds an associates degree in criminal justice from the Community College of the Air Force, an undergraduate degree in information technology from the University of Phoenix, and a graduate degree in information systems security from Colorado Technical University. The CISO has attained the professional certifications of Certified Information Systems Security Professional with a concentration in Management, Certified Chief Information Security Officer, and Certified Ethical Hacker.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: With a focus on both product and enterprise security, the security program has been set up to protect our information systems from cybersecurity threats as part of our development lifecycles and our ongoing business operations. We implement various technical and operational processes to help prevent, identify, escalate, investigate, resolve, and recover from vulnerabilities and security incidents in a timely manner. These include, but are not limited to, monitoring and detection tools, internal and third-party penetration testing, continuous testing by a dedicated red team, a comprehensive bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our services before they are exploited, and annual and ongoing security awareness training for employees.

companyName: Match Group, Inc.

ticker: MTCH


text: The Engineering and Operations Committee of our Board has oversight of our cybersecurity program and the risks from cybersecurity threats. The Engineering and Operations Committee is briefed quarterly with both oral and written reports on cybersecurity including cybersecurity risks. Our Board receives oral briefing on cybersecurity including cybersecurity risks no less than once per year and our Board is provided access to all written reports provided to the Engineering and Operations Committee.

companyName: Tri-State Generation & Transmission Association, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our information security and legal functions. Our head of information technology is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program. Although we design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This means that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications, or requirements.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: The Risk, Compliance and Planning Committee of our Board of Directors provides oversight of the information security program including cybersecurity and is chaired by an independent director. Cybersecurity metrics are reported to the committee quarterly. Additionally, management has established an Information Technology Executive Steering Committee focused on technology impact, and an Enterprise Risk Management Committee focused on business and risk impact, both consisting of executives and department leaders across multiple domains. These committees generally meet quarterly and more frequently when warranted. The information security department holds a monthly security meeting with the managers from the information technology department to discuss significant security incidents and status of the threat landscape. The Information Security Officer reports significant cybersecurity or privacy incidents and the state of the information security program to the Risk, Compliance and Planning Committee of the board on a quarterly basis. The Risk, Compliance and Planning Committee of the Board of Directors provide a report of activities to the full board at each quarterly board meeting.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: We continue to invest in IT Security to improve technical capabilities, streamline response effectiveness, and harden preventive, detection, and response measures, while growing the core security organization to support business growth efforts.

companyName: CONMED Corp

ticker: CNMD


text: The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to defend the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate. To ensure prompt reporting and compliance with SEC requirements, the Board has adopted a "Cybersecurity Incident Materiality Assessment Policy."


text: The incident response team also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training, among other things. We have also retained an outside cybersecurity firm which would assist with containment, eradication, and recovery efforts, as needed.

companyName: American Homes 4 Rent

ticker: AMH


text: We provide technical safeguards that are designed to provide commercially reasonable protection of our technology and information systems. We actively monitor and assess the impact of potential cybersecurity threats to our technology systems. We partner with public and private organizations, such as the Food and Agriculture Information Sharing and Analysis Center (Food and Ag-ISAC), to understand and modify our programs to respond to an ever-evolving threat landscape. We implement training and awareness practices to mitigate human risk, including regular phishing awareness campaigns, mandatory computer-based training and internal communications.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Risks that could affect us are an integral part of our Board and Audit Committee deliberations throughout the year. Cybersecurity risks are integrated into our enterprise risk assessment process, which is reviewed by our Board at least annually. Our Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while the Audit Committee has been delegated the authority to oversee and periodically review the security of our information technology systems and controls, including programs and defenses against cybersecurity threats. The Audit Committee discusses with management our cybersecurity risk exposures and the steps management has taken to mitigate such exposures, including our risk assessment and risk management policies. On a quarterly basis, our cybersecurity leadership team updates the Audit Committee on the overall status of our cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been fully addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Cybersecurity Council, which includes the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Director of Risk, and Director of Information Technology & Cybersecurity.

companyName: EASTERN CO

ticker: EML


text: Risk assessments are conducted when we onboard certain new services and new vendors, including third-party vendors, applications, and other technology services, and when there are significant changes to IT or security architecture. Further, we monitor key vendors to understand how such vendors manage cybersecurity risks and threats during the term of their provision services or products to us.

companyName: VSE CORP

ticker: VSEC


text: Risk Assessment Procedures: We conduct periodic risk assessments to identify potential cybersecurity threats and vulnerabilities within our IT infrastructure. These assessments are conducted using various software tools and methodologies that enable us to evaluate our systems critically and comprehensively. Our risk assessment process includes, but is not limited to, the analysis of: • Hardware and software configurations; • Network and data access protocols; • Encryption standards; and • Compliance with relevant industry and regulatory standards.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The Corporation recognizes the importance of cybersecurity in achieving its business objectives, safeguarding its assets, and managing its daily operations. Accordingly, the Corporation integrates cybersecurity risks into its overall enterprise risk management system. The Audit Committee oversees the Corporation's risk management approach and structure, which includes an annual review of the Corporation's cybersecurity program.

companyName: EXXON MOBIL CORP

ticker: XOM


text: We execute a holistic approach to our standards, policies, practices, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats, all of which are integrated into our overall risk management program. Our cybersecurity program is guided by industry-wide recognized standards, including The National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Our EVP and Chief Financial Officer is responsible for the oversight of the Company's information technology and cybersecurity function, which consists of five employees and is led by our VP, Information Systems & Solutions. Our VP, Information Systems & Solutions has over 25 years of experience in information technology leadership, including oversight of information technology general controls and management of information technology security and cybersecurity programs. The information technology and cybersecurity team also includes our Director, Information Technology, who has held information technology leadership roles for over 15 years, including in management of infrastructure, applications, information technology security, and cybersecurity prevention and education programs. The Audit Committee of the Board of Directors oversees the evaluation of the policies and practices developed and implemented by the Company with respect to the risk assessment and risk mitigation of information technology and cybersecurity matters.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: Roivant and the Vants' cybersecurity programs are informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify and manage risks from cybersecurity threats and incidents. In addition, we have implemented employee security and awareness training related to cybersecurity threats and incidents.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: As an externally advised company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. We rely on our Adviser's cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats to us. This cybersecurity program is designed to protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. Our Adviser's practices align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed and these assessments incorporate various activities including information security assessments and independent reviews of our information security control environment and operating effectiveness. We utilize managed detection and response systems, endpoint protection, content filtering aimed at blocking malware and software to eliminate phishing, ransomware, and fraud. We also utilize multi-factor authentication on all sensitive applications and information entry-points, review access to data regularly, and have failover-protected business disaster recovery and backup storage systems. The Company conducts cybersecurity training and testing programs regularly.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: Once a risk is identified, we analyze the risk and assign a risk classification based upon a combination of factors, including data volume, legal and regulatory requirements, privacy considerations, and intellectual property considerations. Risks are classified as (i) Low Risk, where unauthorized disclosure could be expected to have a limited adverse effect on operations, assets, or individuals; (2) Medium Risk, where unauthorized disclosure could be expected to have a serious adverse effect on operations, assets, or individuals; or (3) High Risk, where unauthorized disclosure could be expected to have a severe or catastrophic adverse effect on operations, assets, or individuals.

companyName: Clene Inc.

ticker: CLNN


text: Risk is inherent with every business, and we face a number of risks, including strategic, financial, business and operational, legal and compliance, and reputational. We have designed and implemented processes to manage risk in our operations. Management is responsible for the day-to-day management of risks we face, while our Board of Directors, as a whole and assisted by its committees, has responsibility for the oversight of risk management. Our Board of Directors administers its cybersecurity risk oversight function directly and may choose to administer this function through its committees as well.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: Management of Cybersecurity Risks and Cybersecurity Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: In the event of an urgent cybersecurity incident where full Audit Committee or Board involvement is not practical or timely, the Chairperson of the Board of Directors, the Chairperson of the Audit Committee, and the Chief Executive Officer have been appointed as an incident oversight group.

companyName: GREIF, INC

ticker: GEF


text: Our CISO is a member of our management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO works in coordination with other members of the management team, including, among others, the Chief Digital Officer, the Chief Financial Officer, the Chief Compliance and Risk Officer and the General Counsel and their designees. We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: PFIZER INC

ticker: PFE


text: The Audit Committee of our Board of Directors reviews risks related to information technology, including cybersecurity, and receives reports from our executive officers and third parties on cybersecurity matters. Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. Our Chief Technology Officer oversees cybersecurity matters, with support from our internal information technology team and third parties. We expect that our cybersecurity risk management processes and strategy will continue to evolve in response to the evolution of the cybersecurity threat landscape.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: The Bank has not experienced any material losses relating to cybersecurity threats or incidents as of September 30, 2025. Material cybersecurity incidents are escalated to the Board and evaluated for disclosure in accordance with SEC reporting requirements.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the Adviser oversee the establishment of and adherence to the cybersecurity program and plays an oversight role regarding cybersecurity preparedness. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: Andalusian Credit Company, LLC


text: Our Chief Security Officer (CSO) is ultimately responsible for cybersecurity at Progressive, with management oversight of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the Chief Executive Officer, other members of the executive team, and the Board of Directors' Technology Committee. Our CSO has served in this capacity at Progressive for more than 11 years and, prior to joining us, had over 10 years of cybersecurity experience in the banking industry. Our CSO is also a member of our Management Risk Committee, which leads our Enterprise Risk Management program, and as a member ensures that cybersecurity risks remain a focus of the overall risk management process.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Our Board has oversight of all cybersecurity threats and incidents. On a quarterly basis, and more often if warranted, the CISO, or the CEO in coordination with the CISO, reports to the full Board any potentially material cybersecurity threat or incident and our activities regarding the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: We have installed and continually upgrade an array of protections against cyber-intrusions. Our cybersecurity risk management processes are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework, as well as various other regulatory requirements and industry-specific standards. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products and related services. These controls include multifactor authentication on all critical systems, firewalls, encryption, anti-virus protections, intrusion detection and prevention systems and identity management systems. We provide mandatory cybersecurity awareness training of threats to associates at least annually and routinely deploy simulated phishing tests to increase security awareness.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: The Information Security function is led by the Chief Information Security Officer (CISO), under the direction of the Chief Information Officer (CIO). The Company's CISO, who was appointed in August 2021, has over 20 years of experience within information security and is both a Certified Information Security Manager and a Certified Information Systems Auditor. Key responsibilities of the Information Security function include developing cybersecurity strategies; managing cybersecurity governance; performing cybersecurity risk assessments; ensuring compliance with security standards and regulatory requirements; managing identity and access; monitoring cybersecurity threats; validating cybersecurity alerts; preparing for and responding to cybersecurity incidents; business continuity and disaster recovery plans; and creating security awareness through periodic trainings of both Company leadership and Associates. The CIO, CISO and the Company's Chief Legal Officer, who also serves as the Chief Compliance Officer, have oversight responsibilities of the Company's cybersecurity program.

companyName: SpartanNash Co


text: An incident management program to effectively and efficiently identify, review, and escalate incidents with the appropriate stakeholders (e.g., CEO, CFO, Legal, Finance, and others, as required).

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the following:

companyName: PlayAGS, Inc.


text: Audit Committee regularly receives updates from management with respect to our efforts to manage data protection, cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to our Audit Committee include updates on our data security posture, results from internal audit and third-party assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also regularly engages with Management on technology risk-related topics.

companyName: Expion360 Inc.

ticker: XPON


text: Continuous Review: The Company regularly reviews its cybersecurity standards, and procedures and evaluates the effectiveness of implemented security controls. The Company adjusts its cybersecurity standards and programs as necessary.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: Our CISO has served in various senior roles in information technology and information security, in both the public and private sector, for over two decades and maintains a Certified Chief Information Security Officer professional certification. Similarly, the other members of our global cybersecurity services team have a broad range of cybersecurity training and experience in both the public, including military and law enforcement, and private sectors and maintain various certifications in relevant subjects.

companyName: FISERV INC

ticker: FISV