text: We depend on the functioning, availability and security of our information systems, including financial, data processing, communications and operating systems. Several information systems, such as software applications and cloud platforms, are provided by third parties. Our cybersecurity risk framework is designed to allow us to identify, assess and manage the cybersecurity risks we face in relation to, our systems and the information we process.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: The Chief Information Security Officer is accountable for managing the enterprise information security department and delivering the information security program. The responsibilities of this department include cybersecurity risk assessment, a portion of defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance and third-party risk management. The Company's information technology department works together with information security in defense operations and is responsible for business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and the Company's second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. The Company's Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: PROSPERITY BANCSHARES INC

ticker: PB

secItem: Item 1C


text: These management team members are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Quantum-Si Inc

ticker: QSI


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Twin Vee PowerCats, Co.

ticker: VEEE


text: Further, employees outside of our technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, we provide our employees with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulations, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all employees. In addition to company policies that we make available to all employees, our awareness training provides clear reporting and escalation processes in the event of suspicious activity.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Our Manager of Security Engineering provides frequent briefings to management regarding the Company's cyber security risks and risk-mitigation efforts, which may include recent incidents and related responses, newly identified risks, changes to the security program, and activities of third parties and vendors, as appropriate. Management provides cybersecurity updates to executive management and the Board through meetings and materials shared in connection with those meetings, as well as ad hoc updates when there are material developments or changes.

companyName: Life360, Inc.

ticker: LIF


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team (and team personnel who support our information security program) has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity third party vendors and consultants. In addition, our team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external vendors and consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. The team is led by our Vice President of Technology, who also currently serves as our Chief Information and Security Officer, and has over 25 years of industry experience leading IT for organizations of similar sizes. Team personnel who support our information security program have relevant educational and industry experience, including holding similar positions at previous large companies and government entities.

companyName: Beauty Health Co

ticker: SKIN


text: Our CISO is responsible for setting the strategy and communicating cybersecurity risks. Our CISO's team is also responsible for defining policies, standards, architecture and processes for cybersecurity globally. With over 28 years of experience in the field of cybersecurity, our CISO brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," " We depend on our information technology systems and those of our third-party collaborators, service providers, contractors or consultants. Our internal computer systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, disruptions, or incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations" in this Annual Report on Form 10-K.

companyName: 89bio, Inc.


text: Our cybersecurity risk management strategy relies on input from certain members of management, including our Senior Vice President of Engineering and Chief Information Security Officer (reporting to our Chief Executive Officer) in consultation with our General Counsel and Head of Global Affairs (reporting to our Chief Executive Officer), our Chief Privacy Officer (reporting to our General Counsel) and input from various leaders who participate in our Privacy and Security Council. This team helps us understand cybersecurity threats and risks, establish priorities, and determine the scope, elements, and implementation of a cybersecurity program. The team is also responsible for integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.

companyName: Grindr Inc.

ticker: GRND


text: Risk Management and Strategy Daily, we are threatened by system intrusions, social engineering attempts and web application attacks. These threats and attempts are directed at payment data, employee credentials, system passwords and personal information. We have developed and implemented a risk-based framework to address them. We consider cybersecurity a top risk within our enterprise risk management protocol, which is subject to oversight by our Board of Directors.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Our employees represent the foundation of cybersecurity protection and are a key line of defense, and we seek to strengthen their ability to target risks by proactively training active employees and contractors each year. We update our online security awareness training annually to review key policies and practices for security. To engage our workforce and inform employees of applicable security topics, we provide a monthly internal cybersecurity newsletter. Our monthly campaign on mock phishing emails is designed to serve as a reminder to employees to refrain from clicking on fraudulent emails disguised as safe content. We also assign enhanced cybersecurity training to employees who have access to potentially sensitive governmental information.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management experts, to assess and enhance our cybersecurity oversight. Our third-party security firms periodically assess our cybersecurity process against the National Institute of Standards and Technology Cybersecurity Framework. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities. We also regularly consult with industry groups on emerging industry trends.

companyName: Verve Therapeutics, Inc.


text: Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's IT, legal, enterprise risk and compliance, internal audit and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Revance Therapeutics, Inc.


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Aemetis, our customers, suppliers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks.

companyName: AEMETIS, INC

ticker: AMTX


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, in the event of a cybersecurity incident, incident response strategies from our Chief Financial Officer. The audit committee updates the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.

companyName: Lifeward Ltd.

ticker: LFWD


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.

companyName: TCW Direct Lending VIII LLC


text: The Company has a firewall that protects the whole network, including intrusion protection, virus protection and other subscription-based protection that updates regularly. For those with remote access there is end-to-end encryption with a secure VPN to access the server. All computers, including those in office and any remote user's computers have an antivirus software from a company that specializes in cybersecurity that has been installed and maintained by an outside IT consultant. The software is updating and reviewing any cyber threats on a continual basis. Additional services provide email filters to minimize phishing and spam emails. Employees are trained to not open suspicious emails and to never open attachments unless they are expecting an attachment from that Company or individual.

companyName: BAB, INC.

ticker: BABB


text: We maintain a comprehensive information security policy that is intended to maintain the security and confidentiality of client information, protect against threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. We have a written information security program that is aligned to our information security policy and designed to assess, identify and manage risks that result from cybersecurity threats. The program is overseen and executed by a team of experienced, certified cybersecurity professionals. Our information security program is centered on preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and cyber incidents while ensuring our processes continue to operate effectively.

companyName: SANDY SPRING BANCORP INC


text: To prepare and respond to incidents, we have implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. We engage third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Our CDO and CISO work to protect the Company's information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with the Company's cybersecurity incident response and recovery plans and processes as described above. The CDO is responsible for corporate-wide data security, and the CISO is responsible for developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The CDO and CISO are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity incident response and recovery plans and processes, as described above. The CDO and CISO also periodically meet with certain corporate officers, such as the Company's Chief Financial Officer and General Counsel to review and discuss cybersecurity issues.

companyName: DOVER Corp

ticker: DOV


text: Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. WTW seeks to manage cybersecurity risks consistent with its general approach to enterprise risk management ('ERM'). Technology and cyber risks that meet certain thresholds are escalated and tracked by the ERM team within the Risk function.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data entrusted to it, including by us and the Adviser, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, and other third-party service providers including for identity management solutions.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: Governance.

companyName: Apollo Infrastructure Co LLC


text: 36 MOODY'S 2023 10-K Company is audited in connection with requirements set forth in the Sarbanes-Oxley Act of 2002, and Moody's Analytics obtains third-party audits in connection with ISO 27001 and SOC 2 certification and attestation reports, respectively, for certain products. As previously mentioned, the Company also aligns with NIST standards in connection with information security, which it uses to evaluate its cybersecurity readiness and resilience, and is required to make various filings and comply with requirements in certain jurisdictions in which it operates.

companyName: MOODYS CORP /DE/

ticker: MCO


text: Further, we use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers and data/computing hosting companies. We have a vendor management program that, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. This vendor management program includes a security questionnaire, reviews of security assessments, and vulnerability scans related to the vendor, as well as the imposition of contractual obligations related to cybersecurity.

companyName: PetIQ, Inc.


text: Key aspects of our cybersecurity risk management program include: • Risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, key third-party partners, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for key third-party vendors and suppliers.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: Our global cybersecurity program is subject to an annual third-party assessment overseen by our board of directors and this assessment reviews all aspects of our cyber program. Findings are reported to our board of directors and, in response, ADP develops initiatives to improve our maturity across each of the pillars of the NIST Cybersecurity Framework. The status of these initiatives is then reviewed with our board of directors during its quarterly meetings. This governance process encourages an environment of continuous improvement.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Cybersecurity is an integral part of risk management at the Company, and we and Hess share a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We rely primarily on Hess' cybersecurity risk management program and processes, including policies, controls or procedures, which includes a cybersecurity incident response plan as well as our own property and casualty insurance that may cover damages caused as a result of a cybersecurity event.

companyName: Hess Midstream LP

ticker: HESM


text: The potential impact of cybersecurity risks on our business operations, results of operations, or financial condition is discussed in the "Technology and Cybersecurity Risks" section of Item 1A "Risk Factors." We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties, or settlement costs related to any cybersecurity breaches or incidents. However, measures that we take to identify, protect, detect, and respond from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations, and financial condition in the future. The following describes our risk management and strategy and corporate governance as it pertains to cybersecurity.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: Our established system of internal controls also provides for the Audit Committee to receive prompt information regarding any cybersecurity incident that meets established reporting thresholds, as well as for updates regarding any such incident until it has been fully remediated. The Audit Committee provides updates to the Board regarding such matters, as appropriate.

companyName: CubeSmart

ticker: CUBE


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Senior IT Manager and IT Manager regularly inform our management team of all aspects related to cybersecurity risks and incidents. This is designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained cybersecurity consultants.

companyName: GRAHAM CORP

ticker: GHM


text: The Partnership has an enterprise-wide business resiliency program, policy and framework to assist in planning for, and mitigating disruption to the Partnership's business operations from, incidents including cybersecurity events, through risk assessment, business impact analysis, response plan development, training, testing, and ongoing maintenance. The Business Resilience Department is responsible for creating and maintaining the Partnership's business resilience policy and framework and overseeing the program's implementation in collaboration with sponsors and leaders from the Firm's business areas. A Business Resilience Oversight Group comprised of general partners meets at least semi-annually and provides oversight of business resilience strategy, risk management, resources, performance, and integration into business processes. Specific elements of business continuity plans vary based on the nature of the processes involved but include planning related to human capital, real estate, third-party relationships and technology infrastructure. As part of its business resiliency planning, the Partnership has data centers in two geographically distinct locations and reviews the data center locations of its third-parties. A prolonged interruption at any site or of critical systems or software may result in an extended delay of service to the Partnership's clients and substantial costs and expenses.

companyName: JONES FINANCIAL COMPANIES LLLP


text: While we do not currently have dedicated cybersecurity personnel or a Chief Information Security Officer (CISO), responsibility for cybersecurity-related matters currently resides with our senior management team. Management oversees the implementation of basic safeguards, including secure login credentials, limited network access, and offsite data backups. We rely on third-party cloud-based software and IT vendors for the majority of our infrastructure and data storage, and we depend on their built-in security protocols.

companyName: Arculus System Co., Ltd.

ticker: AQLS


text: The Board of Directors provides oversight of the risk management program and setting the Corporation's cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. The Board has appointed a Risk Management Committee currently made up of six members of the Board with governance and oversight of the Corporation's enterprise-wide risk management program. The members of the Risk Management Committee collectively have years of business management and professional experience in the banking industry and other industries including exposure to cyber risk management considerations. The Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters. In fulfilling its role, the Risk Management Committee is actively engaged with management regarding cyber security procedures and controls to manage and mitigate cybersecurity-related risks. Management provides at least quarterly information security reports to the Risk Management Committee who provides a report to the Board of its discussions and decisions. These reports to the Risk Management Committee address management's efforts to monitor, detect and prevent cyber threats. In addition, the Board of Directors is engaged, as needed, in accordance with the Incident Response Plan.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: The Company's Board of Directors oversees cybersecurity risks consistent with its general risk oversight responsibility. The Audit Committee of the Board has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems and the general security, including cybersecurity, of the Company's people, assets and information systems. In support of this general oversight, the full Board reviews, at least annually, the most significant enterprise risks facing the Company, including cybersecurity risks, as identified in the Company's Enterprise Risk Management program. This review, which includes key members of senior management, covers key risks from information security that have been identified and corresponding action plans. The Audit Committee also receives regular updates from the Company's CIO and CISO about the Company's information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least three times a year, with interim updates as needed.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: UHS has a multi-tier risk management structure that includes regular reviews of laws, policies, vulnerabilities, and resource levels to address risks facing our organization. Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws. To address cybersecurity risks facing UHS, and in turn us, to the degree applicable, UHS has adopted a "continuous risk assessment" process. UHS, through a third party, conducts a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the maturity of its program and related controls. The results of that assessment are shared with management of UHS, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of technical controls, results which are reviewed by management of UHS and resolved in a timely manner. Other factors that feed into UHS' risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: The CSO provides, at least annually, updates to the Executive Committee on: • Strategic cyber and physical security initiatives • Current threat and risk landscape impacting the organization • Security compliance with regulatory requirements • Compliance with ISO 27001 framework • Number and impact of incidents reported through the BHE cybersecurity incident reporting process BHE's Cybersecurity Reporting Framework enables BHE to use a repeatable and timely process to identify, assess and manage any security incidents for materiality reporting. Each BHE business is required to report significant cybersecurity events to BHE. The Executive Committee and CSO together review incident reports to determine whether a cyber incident report should be filed with the SEC.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and our management and reports to the Company's Board of Directors and/or certain Board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: NEE operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE (information systems), including those used for the provision of functions to NEP, that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats), as well as on its operations, including its provision of services to NEP. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: We have designed our cybersecurity procedures based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). We have used NIST CSF as a guide to help identify, assess and manage cybersecurity risks relative to our business, but this does not imply that our cybersecurity program meets any particular technical standard, specification or requirement.

companyName: Forward Industries, Inc.

ticker: FWDI


text: We employ industry standard security controls and technologies to protect our information technology ("IT") environment and to monitor for and detect anomalous activity. Our IT security controls and technologies are designed to protect the confidentiality, integrity and availability of our processes and systems. Across our organization, our IT security architecture and controls are designed using a risk-based approach that takes into account the effectiveness of the controls, the likelihood and severity of the risk, the current threat landscape, known industry-specific threats and the likely impact of a breach with and without the respective controls. Our controls and technologies are evaluated regularly for their relevancy to the current threat landscape. We retain a risk register to catalog known risks and assess their potential impact on our organization, enabling our proactive management of such risks and the development and implementation of mitigation strategies. We also utilize independent third parties to perform annual penetration tests at each of our businesses, allowing us to internally and externally test the controls in our facilities, networks, devices and cloud environments. In addition, we maintain and test backup and recovery systems and disaster recovery of our critical systems that are required to support our core business operations.

companyName: Post Holdings, Inc.

ticker: POST


text: Impacts from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have been subject to certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. For additional information about the risks to our business associated with a breach or compromise to our information technology systems, see section Item 1A, Risk Factors – System security vulnerabilities, data breaches, and cyber-attacks could compromise proprietary or otherwise sensitive information or disrupt operations, which could adversely affect Perpetua Resources' business, reputation, operations, and stock price.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, third parties who assist with our PCI-DSS compliance assessments, and auditors who audit our systems to ensure adherence to the relevant standard under evaluation.

companyName: CONDUENT Inc

ticker: CNDT


text: Airship leverages third party applications and software to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: If indications are reported of an actual or threatened incident affecting our information systems or networks, or affecting a third party provider relevant to our security, we commence our incident response processes supported by the Global Security Organization. This comprehensive incident response process is designed to address possible and confirmed cybersecurity incidents and enable escalations and notifications to appropriate management and members of the audit committee.

companyName: Informatica Inc.

ticker: INFA


text: We rely on the cybersecurity strategy and policies implemented by Vista, the parent of our Adviser. Vista maintains, and we rely on, a comprehensive cybersecurity program that is aligned to the National Institute of Standards and Technology's Cybersecurity Framework as part of its enterprise risk management program, including physical and digital technologies and administrative, operational, and technical controls, to aid in efforts to identify, assess and manage cybersecurity risks. The program is designed to provide for the availability of critical data and systems, maintain regulatory compliance, manage material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents. Among other things, the program includes a risk management framework; controls designed to monitor our digital infrastructure and detect and alert to suspicious, anomalous, and/or malicious behavior and indicators of potential cybersecurity threats; regular scanning of our networks and systems to triage and manage any potentially exploitable vulnerabilities; regular tabletop exercises to test our incident response and business continuity and disaster recovery preparedness; and annual Information Security Awareness training for employees.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: The Audit Committee will receive reports, briefings and presentations from senior management, including our Director of Information Security, at periodic committee meetings, including, on a rotating basis, in-depth presentations on specific areas of risk and regular enterprise risk management updates as needed. In addition to scheduled meetings, significant developments or incidents, even if immaterial to us, are reviewed regularly by a cross-functional team, including the Chief Financial Officer and the General Counsel, to determine whether further escalation to the Audit Committee and/or the Board is appropriate, ensuring the Audit Committee's and the Board's oversight is timely and responsive. Our Incident Response Plan also includes immediate actions to mitigate the impact and strategies for remediation and prevention of future incidents.

companyName: Bark, Inc.

ticker: BARK


text: We actively participate in the cybersecurity community to stay current regarding best practices and continuously improve our security awareness posture. Our employees are engaged in security and privacy awareness training to enhance the protection of our systems and data. In addition, we incorporate data and privacy protection education in our customer engagement through ongoing resources, such as best practices content and security consultations. We also assess third-party service providers for cybersecurity risks at onboarding, refreshing as needed throughout our engagement.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: The Emergency Action Plan defines the handling of cyber related incidents with support of the cross-functional steering team to assess the potential materiality of cybersecurity events and to report on the detection, analysis, and containment from such events. As the severity of events meet certain levels as specified by the Incident Response Plan, those events are escalated to senior levels of management and reported to the Board of Directors. Our Board of Directors is responsible for the oversight of controls and procedures related to the public disclosure of material cybersecurity incidents.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: Our management team, including our Chief Operating Officer and Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. Our Vice President of Information Technology has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity incident response team and our retained external cybersecurity consultants.

companyName: Gritstone bio, Inc.


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as a part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also assessing corresponding processes and procedures to mitigate those risks appropriately. Third-party business applications are also incorporated into these risk assessments.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: We have implemented practices to assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we rely on various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We have chosen Microsoft Corporation as our main provider for Cybersecurity and Governance services. Our technology management team assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are addressed promptly and documented to be incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the technology management team and tracked as part of our overall risk management program overseen by Board and its Audit Committee.

companyName: RYTHM, Inc.

ticker: RYM


text: William T. McLain, Jr., age 51, is Executive Vice President and Chief Financial Officer. Mr. McLain joined Eastman in 2000 and has served in high-level finance and accounting roles throughout the organization in the United States, Asia, and Europe. In 2011, Mr. McLain served as Director, Asia Pacific Finance, and in 2013 was appointed to International Controller. In 2014, Mr. McLain was appointed Corporate Controller until 2016 when he became Vice President of Finance. Prior to Eastman, Mr. McLain worked for the public accounting firm PricewaterhouseCoopers LLP. Mr. McLain was appointed to his current position effective February 2020.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: In addition, the Company has established procedures to ensure that management personnel are informed in a timely manner of known cybersecurity risks and incidents that may materially impact the Company's operations and that timely public disclosure is made as appropriate. The Company's Cybersecurity System is led by the Chief Information Officer ("CIO") in collaboration with a third-party virtual Chief Information Security Officer ("vCISO") and other third-party cybersecurity service providers which in turn assist in monitoring the Company's exposure from significant information technology suppliers, significant software as service providers and major vendors with access to the Company's information technology systems. The Company's CIO has 10 years of cybersecurity industry experience. Further, team members who support the Company's cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems, and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM). During the last three years, the Company has not experienced a material security breach and, as a result, the Company has not incurred any material expenses from such a breach. Furthermore, during such time, the Company has not been penalized or paid any amount under any information security breach settlement.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: Notwithstanding the extensive approach we take to prevent cybersecurity breaches, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse financial impact to our business. While GEO maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. There have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect GEO, including its business strategy, results of operations, or financial condition.

companyName: GEO GROUP INC

ticker: GEO


text: We have process, controls and technology infrastructure to maintain, protect, and enhance existing systems and develop new systems as needed to keep pace with continuing changes in technology, evolving industry and regulatory standards, and emerging cybersecurity and data security risks.

companyName: HERBALIFE LTD.

ticker: HLF


text: Our cybersecurity risk management program adheres to a comprehensive set of requirements and recommendations, including but not limited to those outlined by the Payment Application Data Security Standard (PA-DSS). This entails refraining from retaining complete card validation, code, or value, as well as PIN block data associated with access or payment cards. Stored account holder data is rigorously protected, and robust authentication features are provided to ensure secure access. All activities, including sampling, telematics, payments, and transactions, are securely logged. Measures are in place to safeguard wireless transmissions and conduct vulnerability tests on access points, portals, and payment applications. Network implementation is meticulously secured, with stringent protocols ensuring that account holder data is never stored on servers directly connected to the internet. The program also facilitates secure remote software updates and access to portals and payment applications. Encryption protocols are employed to safeguard sensitive traffic over public networks, and additional measures such as anti-tampering protection for emissions data and carbon credits issuance are implemented. Encrypted offsite backups are maintained, and a robust disaster recovery plan is in place to mitigate potential risks effectively.

companyName: Spectaire Holdings Inc.


text: Although we have not been the subject of any cybersecurity threats that have materially affected, or are reasonably likely to materially affect us to date, we have been and continue to be subject to cybersecurity risks in the normal course of our business, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "Protection of electronically stored data is costly and if Starz's data is compromised in spite of this protection, it may incur additional costs, lost opportunities and damage to its reputation."

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: The IS team, established by the service center's CIO and CISO, has dedicated cybersecurity staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering, and management of cybersecurity policies, standards, and regulatory compliance. The Company implements security standards that include SOC 1 and SOC 2 compliance. We align with a Cyber Security Framework and take a risk-based approach during control assessment and implementation, following the National Institute of Standards and Technology ("NIST") framework. We are committed to protecting our data, systems, and network and continually invest in enhancements to mitigate or reduce the impact of cybersecurity threats. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies to protect data security. External companies or agencies may provide consulting, guidance, assistance, or support in response to a cybersecurity incident. Employees receive regular training, at least annually, on cybersecurity threats and best practices to maintain information security.

companyName: Pennant Group, Inc.

ticker: PNTG


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and our critical information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, Guaranty has implemented comprehensive cybersecurity practices. Key components of the cybersecurity program include the following: • A dedicated cybersecurity team working closely with our Information Technology team to cover all critical cyber defense functions such as engineering, data protection, vulnerability management, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A risk assessment process that identifies and prioritizes material cybersecurity risks, identifies and evaluates the effectiveness of controls to mitigate the risks, and reports results to executive management and the Board of Directors. • A Managed Detection and Response ("MDR") service, which provides an additional layer of around-the-clock security monitoring (including intrusion detection and alerting) for information systems. • A training program that educates employees about cybersecurity risks, how to protect themselves from cyberattacks, and encourages general awareness about cybersecurity threats and how to stay safe online. • An incident response plan, which is tested periodically and outlines the steps that will be taken to respond to a cybersecurity incident. The Bank engages reputable third-parties to conduct various independent assessments on a regular basis, including but not limited to security audits, vulnerability assessments, and various other testing.

companyName: GUARANTY BANCSHARES INC /TX/


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY. NeurAxis has developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST or ISO 27001.

companyName: Neuraxis, INC

ticker: NRXS


text: As part of the above processes, we regularly engage consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. EDR System (Endpoint Detection & Response)

companyName: Entera Bio Ltd.

ticker: ENTXW


text: We recognize the importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and ensuring the safety and efficacy of our medical devices. Our cybersecurity risk management program, which is based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational and financial risk areas. We are dedicated to maintaining the highest standards of cybersecurity to protect our customers and stakeholders. We will continue to adapt to evolving threats and regulations to ensure the safety and security of our products and information.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: We rely on various third-party service providers and a cybersecurity incident at any of our third-party service providers could materially adversely impact us. We evaluate third-party service providers from a cybersecurity risk perspective using a range of measures, including information security and cybersecurity due diligence assessments, ongoing monitoring and evaluation of our providers, examination of available System and Organization Controls attestation reports, and inclusion security and privacy contractional provisions in our agreements with our providers. However, we rely on our third-party service providers to implement security programs commensurate with their risk, and we cannot ensure that their efforts will be successful.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to and breaches of our data and systems. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K. Cybersecurity Governance Cybersecurity is an area of focus for our board of directors and management.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: The Audit & Risk Committee meets on a monthly basis to receive updates from management, including leaders from Information Systems, Information Security, Risk Management, and Compliance, on matters of cybersecurity risks and mitigation initiatives. The leaders from these areas each bring over 20 years of professional experience and certifications in information technology, information security, information systems audit, compliance, and risk management. This group of leaders provides updates on existing and new cybersecurity risks, status updates on how management is addressing or mitigating cyber risks and cybersecurity or privacy incidents, and progress on key cybersecurity initiatives.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: While we attempt to mitigate cybersecurity risks by employing a number of measures, as described above, our employees, systems, networks, products, facilities and services remain potentially vulnerable to ransomware or sophisticated espionage. Depending on their nature and scope, such threats could potentially lead to the compromise of confidential information, improper use of our systems and networks, manipulation and destruction of data, defective products, production downtimes and operational disruptions, which in turn could adversely affect our reputation, competitiveness and results of operations or financial condition. No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: The Company evaluates risks associated with use of third-party providers through a lifecycle-based approach, conducting risk-based due diligence before engagement, using contractual provisions to apportion risk, and for certain third-party providers, engaging in architectural review and validation at the beginning of engagement. The Company uses third parties to assist with penetration testing, simulated attacks and survey and other threat intelligence reporting on third parties, as well as review and enhancement of associated response processes.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Our cybersecurity processes are largely designed and assessed based on the National Institute of Standards and Technology Cybersecurity Framework and the DOE's Cybersecurity Capability Maturity Model standards. This does not imply that we meet any technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SEMPRA

ticker: SREA


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), Chief Risk and Compliance Officer (CRCO), and Chief Information Security Officer (CISO) or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: KOHLS Corp

ticker: KSS


text: The Company is committed to incorporating industry best practices in its cybersecurity program. Its Information Security Management System (ISMS), which the Company uses in the identification of cybersecurity risks and their classification and evaluation, is based on the National Institute Standards and Technology (NIST) framework and International Organization for Standardization (ISO) standards. The Company invests considerable resources in its information systems and personnel to safeguard its operations. It also regularly engages with external security consultants and auditors to validate its overall cybersecurity and risk management posture.

companyName: SIGMATRON INTERNATIONAL INC


text: These members of management and the management technology steering committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Mechanics Bancorp

ticker: MCHB


text: The ISP, which is part of our Enterprise Risk Management Program, is organized in an operating framework that is supported by policies, standards, procedures, and guidelines that establish the information security control environment. The Information Security team collaborates with additional areas of our Enterprise Risk Management Program to ensure comprehensive risk oversight and reporting. The ISP is designed and implemented to comply with or exceed regulatory control requirements. Multiple internal and independent third-party assessments and audits are conducted annually to ensure our compliance with its policies, controls, and regulatory requirements.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Operational risk is inherent in the Corporation's activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breach, or failure of third parties, among other events. The result of these could be reputational harm, financial losses, or litigation and regulatory fines for the Bank. The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite. To govern, monitor and control operational risk, the Corporation maintains an Enterprise Risk Management ("ERM") Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk. These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees. The ERM Program includes managing material risks from cybersecurity threats.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: We take a risk-based approach to identify and assess the cybersecurity threats and risks that could affect our business and Information Systems and Data. Our Information Technology personnel help identify, assess and manage our cybersecurity threats and risks, and support our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods and tools to identify, assess and manage cybersecurity threats and risks, including, for example, automated tools, industry reports, third party threat assessments and penetration testing. In addition, we encrypt data at rest and maintain network security controls, such as firewalls and virtual private networks. We also conduct computerized system monitoring and access control, including asset management, tracking and disposal associated with onboarding and offboarding of personnel. We maintain cybersecurity insurance.

companyName: GERON CORP

ticker: GERN


text: Assessing, identifying and managing cybersecurity-related risks is integrated into the Company's overall Organization Risk Management (ORM) program. Cybersecurity related risks are included in the risk universe that the ORM program evaluates to assess top risks to the enterprise on an annual basis. To the extent the ORM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.

companyName: OSHKOSH CORP

ticker: OSK


text: Our cybersecurity risk assessment and management processes are overseen by our Chief Operating Officer and the IT Manager, who has worked in various roles responsible for securing networks, hardware, and other application systems. Our outsourced IT team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Risks from Cybersecurity Threats While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - We face risks relating to information technology and cybersecurity attacks, loss of confidential information and other business disruptions " and "Item 1A – Risk Factors - The use of artificial intelligence presents risks and challenges that may adversely impact our business and operating results or that of our tenants ".

companyName: AGREE REALTY CORP

ticker: ADC


text: In connection with our adoption of artificial intelligence (AI) tools in our business, including AI tools customized for our business and a variety of Amgen-built tools for use across applications, the Company established an AI Governance Council composed of cross-functional leadership that oversees the safe adoption of third-party AI services, including by establishing guardrails to reduce risks and allocating resources to provide staff training on the proper use of AI and responsible AI practices. The AI Governance Council is co-sponsored by our Chief Compliance Officer and Senior Vice President, Artificial Intelligence & Data.

companyName: AMGEN INC

ticker: AMGN


text: As part of its oversight of its risk management framework J.P. Morgan's Cybersecurity Team provides our board of directors with periodic updates concerning cybersecurity risk matters. These updates generally include information regarding cybersecurity and technology developments, J.P. Morgan's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Adviser's and J.P. Morgan's efforts to address those incidents. Our audit committee assists our board of directors in this oversight.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: The Board of Directors and the Audit Committee receive briefings from the Company's Senior Vice President and CIO, Executive Vice President and Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to their regularly scheduled meetings, Board members, the CIO, CFO and CEO regularly engage in ad hoc conversations regarding emerging or potential cybersecurity risk and developments in the cybersecurity domain. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board of Directors conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: In the ordinary course of our business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented policies designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. While we have taken measures designed to protect the security of the confidential and personal information under our control, we cannot provide absolute assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

companyName: CLOUDASTRUCTURE, INC.

ticker: CSAI


text: Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, cybersecurity risks associated with our information technology systems and the systems of our vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See "Item 1A. Risk Factors - General Risks – Information Technology and Internal Controls - We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents could harm our ability to operate our business effectively."

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: All possible cybersecurity incidents are reported to our General Counsel for consideration of materiality. Our General Counsel escalates consideration of materiality to our Chief Executive Officer, Chief Financial Officer and other corporate officers as appropriate. The Company does not utilize any third-party service providers for consideration of materiality for cybersecurity incidents. Upon determination that the Company has experienced a material cybersecurity incident, the Company will disclose the incident within four business days as required by regulation. Our Board is also notified of any material cybersecurity incidents immediately upon determination of materiality.

companyName: PROASSURANCE CORP

ticker: PRA


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical safeguards designed to protect the security and privacy of confidential, personal and proprietary information. Our cybersecurity program is aligned with notable control frameworks such as the NIST CSF (National Institute of Standard and Technology Cybersecurity Framework) and ISO (International Organization for Standardization) 27001.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Board Reporting. At least annually, the CIO reports to the Board the overall status of the Cybersecurity Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. The Audit Committee assists the Board in meeting its responsibility to oversee cybersecurity and data privacy strategies and practices. On a quarterly basis, the Audit Committee receives updates on (a) our progress meeting objectives established in our cybersecurity maturity roadmap, (b) relevant reported cybersecurity events in the overall market and evolving risks, (c) results of work performed by our information security organization (ex. penetration tests, cybersecurity program maturity assessments) and (d) detailed reports of cybersecurity trends within the Firm. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests, and other tests and assessments.

companyName: KFORCE INC

ticker: KFRC


text: Risk Management and Strategy LP places utmost priority on ensuring consistent and uninterrupted operational capability, as well as securing confidential business assets. We have systems and processes in place to assess, identify and manage cybersecurity incidents, and those systems and processes are integrated into our overall enterprise risk management system. We invest heavily in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents, and we have maintained a strong focus in consistently reviewing fundamental cybersecurity practices and ensuring we are reviewing emerging threats.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: Park assesses, identifies, and manages risks from cybersecurity threats consistent with its broader risk management and operations systems, processes, and controls. Park's information security and cybersecurity operations teams have primary responsibility for guarding against cybersecurity threats. The teams employ numerous security tools such as for threat detection, alerting and monitoring, data loss prevention, vulnerability remediation, and including end-point protections, webproxy, anti-malware, and email security protections. Park uses multi-factor authentication for computer and mobile devices, encryption technology, and requires virtual private network access to Park's network for all remote employees. Park engages in annual recovery and information security tabletop exercises to simulate threats and events. Park engages third parties on an annual basis to conduct and report on penetration testing exercises. Park administers mandatory security awareness training to all associates on a monthly basis, enhanced administrator access training for security-related positions on an annual basis, and routinely administers employee email phishing testing and training. Topics of training include escalating suspicious activity, malware, insider threats, and email security.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: We are regularly audited and assessed pursuant to the System and Organization Controls (SOC 2) established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We regularly use the Cybersecurity Framework published by the National Institute of Standards and Technology–a framework of standards, guidelines, and best cybersecurity practices–to evaluate our security program and to plan improvement.

companyName: Samsara Inc.

ticker: IOT


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer with support from our cybersecurity team, updates the Audit Committee on at least a biannual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. The Audit Committee also regularly reports on discussions regarding cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP) and GIAC Certified Incident Handler, as well as experienced information systems security professionals and information security managers. Additionally, our internal Information Security Committee, composed of leaders from key departments, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: Management of Third-Party Risks. Our suppliers, subcontractors and third-party service providers are subject to cybersecurity obligations and controls. Prior to engagement, we assess the cybersecurity posture of third-party service providers who store, process, or transmit our information as a service, or connect to our networks. We also require our suppliers, subcontractors and third-party service providers to agree to cybersecurity-related contractual terms and conditions of purchase. Many of these third parties are also subject to regulatory requirements in mandatory government procurement clauses, including those contained in the U.S. Federal Acquisition Regulation and U.S. Defense Federal Acquisition Regulation Supplement, which obligate adherence to a generally accepted cybersecurity framework, such as NIST, and occasional assessment of their implementation of cybersecurity controls as a condition of contract award or during contract performance. Finally, we require these third parties to notify us of cybersecurity incidents that impact us.

companyName: RTX Corp

ticker: RTX


text: Risks from cybersecurity threats may cause material disruptions to our operations and reputational harm, which could materially adversely affect our results of operations and financial condition. See Item 1.A Risk Factors, "We may be unable to adequately maintain our systems and safeguard the security of our data, which could adversely impact our ability to operate our business and cause reputational harm and, consequently, could materially adversely affect our results of operations and financial condition." on page 41 for more information about these risks.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team, IT department and other relevant team members work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have a trained group of people to carry out the activities of monitoring and detection of cybersecurity threats and respond to any cybersecurity threats or incidents. The Head of IT department is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners. The Head of IT Department reports to our Chief Executive Officer who reports to the Audit Committee at the board-level, as appropriate.

companyName: iQSTEL Inc

ticker: IQST


text: Cybersecurity Governance Key Information Security risks are overseen by our Security and Technology Risk Committee (the "STRC"), which escalates significant issues to our Enterprise Risk Management Committee ("ERMC"). The STRC, which is co-chaired by the Chief Technology, Data & Analytics Officer and the Chief Information Security Officer ("CISO"), is responsible for overseeing key risks related to technology and information security for the global enterprise. The STRC provides oversight to ensure key risks related to technology and information security have appropriate controls and mitigations in place. The STRC also oversees associated policies, projects and programs for enterprise risk assessments related to technology and information security. The ERMC is chaired by the Chief Risk & Compliance Officer, and includes the Chief Executive Officer, his direct reports and other key function heads or senior subject matter experts, including the CISO.

companyName: TransUnion

ticker: TRU


text: The Company's cybersecurity program and approach is overseen by its Board of Directors, in coordination with the Audit Committee, and Senior Leadership, along with its Vice President, Information Technology. The Vice President, Information Technology reports to the Chief Administration Officer and has more than 25 years of IT experience with over 10 years of cybersecurity and international business experience. The Board of Directors receives annual reports from Senior Leadership on the Company's cybersecurity risks. In addition, Senior Leadership updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents. The Board of Directors and Senior Leadership review the strategy, tools, metrics and latest trends affecting cybersecurity utilizing the NIST Cybersecurity Framework and CIS Controls as the foundation for its cybersecurity strategy and approach.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process to identify and mitigate risks from third parties, such as service providers, suppliers, and vendors.

companyName: CADIZ INC

ticker: CDZI


text: Cybersecurity is a significant and integrated component of CFSB Bancorp's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, we have not, to our knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Company.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to potential cybersecurity risks, and addressing cybersecurity threats and incidents to the extent they arise. This includes processes for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, implementing cybersecurity countermeasures and mitigation strategies and informing and updating management and, as needed, the audit committee of our board of directors of cybersecurity incidents that may pose a significant risk for the business, as applicable. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. An important component of this program is employee awareness of and vigilance regarding cybersecurity risks, which we promote through periodic training and testing.

companyName: Karuna Therapeutics, Inc.


text: The CITO and CIRO together lead efforts to design, implement and operate controls deemed appropriate for the management of Company information assets and systems. OIS manages the policies, control procedures, and control standards designed to identify, detect, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for the information technology security monitoring and incident response activities, the latter covering the response coordination to cybersecurity incidents under the leadership and pursuant to the direction of the CIRO. OIS also oversees the Company's cybersecurity training program for employees.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Our Chief Executive Officer, General Counsel, and Chief Accounting Officer provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: Our established recovery approach is designed to provide for the ready availability and use of our business-critical processes in the event of any downtime, disaster, or outages. We also seek to identify and mitigate the risks associated with the use of third-party service providers through the review of their security programs prior to our engagement thereof. Additionally, our control environment and internal audit process bring a systematic, disciplined approach to evaluate our risk management, control, and governance processes concerning cybersecurity and our information security framework.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Our cybersecurity program is designed to protect our information systems from cyber threats and to ensure the confidentiality, integrity and availability of systems and information used, owned or managed by the Company related to our employees, our customers and their users. This involves an ongoing effort to protect against, detect and respond to cybersecurity threats and vulnerabilities. LivePerson maintains a security risk management program that is tasked with determining the cybersecurity threats that pose the greatest risk to the Company. This program is managed by the Security Risk Committee, chaired by the Chief Security Officer ("CSO"), as well as representative members from security, operations, and internal audit leadership. The committee meets at least twice annually. A resultant risk assessment produced by the committee is leveraged to inform senior leadership and our Board of Directors on top areas of risk, as well as to shape the security and technology team's roadmap.

companyName: LIVEPERSON INC

ticker: LPSN


text: The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: To date, we have not identified any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents experienced by us or, to our knowledge, by any of our third-party service providers, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Our business and operations would suffer in the event of computer system failures, cyber-attacks or deficiencies in our cyber security or cyber security of our collaborators, vendors and other partners." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks.

companyName: COMPASS Pathways plc

ticker: CMPS


text: Our Executive Vice President of Technology has nearly 20 years of experience working in technology and technology infrastructure and has completed college coursework in computer engineering. Together with our Chief Corporate Officer and Chief Development Officer, our Executive Vice President of Technology oversees our cybersecurity risk management processes, including those described in "—Risk Management and Strategy" above. Our cybersecurity risk management program seeks to implement tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, as well as strategies to address threats and incidents.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: c. External Collaboration: We engage with external service providers, where appropriate, for assessing and testing our security processes and controls. d. Cybersecurity Awareness Training: Security awareness and training programs for our employees.

companyName: KALTURA INC

ticker: KLTR


text: We conduct an annual information security compliance training for all employees to enable them to detect and report malware, ransomware, and other malicious software and social engineering attempts that may compromise our IT systems. Employees also are subject to spear-phishing training campaigns, which allow us to assess the effectiveness of our training programs.

companyName: RLJ Lodging Trust

ticker: RLJ


text: • Internally conducted environment and vulnerability assessments. These include semi-annual assessments performed by Uber's security engineering teams. The findings from these assessments are reported to Uber's senior management, including the CISO, and the Board or Audit Committee. In addition, our internal audit function periodically conducts additional reviews and assessments, which are reported to the Audit Committee. • Independent third-party audits and assessments by industry-leading firms. These include regular assessments of Uber's information systems, business systems and cybersecurity infrastructure; reviews to identify opportunities to strengthen Uber's cybersecurity posture; and cybersecurity audits for purposes of maintaining Uber's Payment Cards Industry (PCI), ISO 27001 and 27002, and SOC1 and SOC2 certifications. • Cyber incident management. This includes efforts by Uber's security engineering team, at the direction of the CISO, to review potential incidents identified by Uber's internal teams, Uber's third-party service providers or external researchers through Uber's Bug Bounty program; identify those which represent potential or actual threats to Uber's systems, data or users; investigate and mitigate the cause and impact of such incidents; and implement safeguards to help prevent recurrence. Uber's CPO and legal team support such efforts, including in connection with legal or disclosure obligations triggered in connection with any such incidents. • Third Party Risk Management. Uber performs due diligence regarding its third-party suppliers, service providers and business partners. This includes requiring submission of evidence demonstrating third parties' ability to meet Uber's cybersecurity and data handling requirements. In addition, Uber's third-party suppliers and service providers who process Uber personal data are contractually obligated to notify Uber if they experience certain incidents impacting Uber personal data.

companyName: Uber Technologies, Inc

ticker: UBER


text: The Company relies on in-house information-technology specialists to assist in managing relevant risks. Any cybersecurity incident would be reported promptly to management and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: As part of our information security training program, employees and contractors participate in various cybersecurity awareness activities, including formal training exercises and simulated phishing events. We also contract with third-party cybersecurity firms to conduct simulated cyberattacks and perform regular penetration testing to assess the effectiveness of our security measures. We have also engaged with external subject matter experts to assess access management, information technology asset management and our cybersecurity policies.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Our management team, including our CICO and our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CICO and CISO collectively have decades of IT and cybersecurity experience in technology companies, including significant experience in senior-level leadership roles. Additionally, our CISO holds Certified Information Security Manager and Certified in Risk and Information Systems Control certifications. Our CICO and CISO are assisted by a cross-functional Information Security Steering Committee.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: Cybersecurity Risks We rely on internal and third -party information technology systems and networks to process, transmit and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers and employees. We use various internal and third -party information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information and personal information of our customers, suppliers and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management ("ERM") program, which leverages a "three lines of defense" model to manage risk within the organization. Such model incorporates 1) day-to-day/operational activities and controls that are managed at the business unit level; 2) identification, measurement and mitigation of inherent security risks via the use of internal control and cybersecurity maturity frameworks, operating policies, independent monitoring, risk management and compliance oversight; and 3) internal audit designed to provide objective and independent validation of the design and operating effectiveness of cybersecurity and information security controls. Technology risk (including cybersecurity and overall operational risk) is a key focus for the Company. We use a combination of manual and automated methods along with internal and external resources, to monitor, measure and mitigate cybersecurity risks.

companyName: First Financial Northwest, Inc.


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents, and there can be no guarantee that future incidents will not have a material adverse effect on its business. See Risk Factor " Breaches in security, whether cyber or physical, and related disruptions and/or our inability to prevent or respond to such breaches, has previously, and in the future could diminish our ability to generate revenues or contain costs, compromise our assets, and negatively impact our business in other ways " for more information on the Company's cybersecurity risks.

companyName: ULTRALIFE CORP

ticker: ULBI


text: In consultation with our cybersecurity team, we mandate annual cybersecurity awareness training for Company personnel, and regularly conduct simulated phishing attacks as a means to equip them with effective tools to detect and address cybersecurity threats as well as to communicate our evolving cybersecurity policies, standards, processes, and practices in the context of its information systems.

companyName: Vertiv Holdings Co

ticker: VRT


text: Reporting to Board of Directors The Executive Director of IT, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Legal Officer (CLO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues. See Item 1A "Risk Factors" – "Risks Related to Business Operations and Industry."

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Day-to-day management of cybersecurity risk is performed by the Company's Information Technology Security Team with direct oversight from the Chief Information Officer (the "CIO"). The Company's incident response plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CIO, who further escalates critical or high severity events to the Company's Cyber Incident Steering Committee (the "CISC"), which consists of the CIO, the Chief Financial Officer, the General Counsel, and the Internal Audit Manager. Additional senior management from relevant business units are included as needed based on the nature of identified cybersecurity incidents. The CISC is responsible for providing support, guidance, and oversight of UNIFI's incident response, including making a determination of materiality to evaluate the need for escalation and disclosure. The materiality evaluation is made using the framework established in the federal securities laws, with a focus on the importance of the information to a reasonable investor.

companyName: UNIFI INC

ticker: UFI


text: Our information security organization is led by our VP IT, who has over fifteen years of relevant experience, serving in various IT leadership roles within the medical device and medical technology industry. The VP IT is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, monitoring, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our VP IT reports to our CIO, who brings over 30 years of diverse strategic and operational experience in IT management, process leadership, digital, and technology modernization. Our CIO reports to the Chief Financial Officer.

companyName: Embecta Corp.

ticker: EMBC