text: As part of the above processes, we regularly engage with assessors, consultants, auditors and other third parties, including by annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: MSCI Inc.

ticker: MSCI


text: Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management methodology. Our Board and the Audit Committee receives periodic updates from our Chief Financial Officer and more frequently as needed, regarding the overall state of our cybersecurity preparedness, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents. The Audit Committee and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.

companyName: SurgePays, Inc.

ticker: SURG

secItem: Item 1C


text: Cybersecurity Risks The Company faces a number of cybersecurity risks in connection with its business, although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date. The Company has not experienced any material cybersecurity incidents to date. Notwithstanding the extensive approach the Company takes to address cybersecurity, it may not be successful in preventing or mitigating all cybersecurity incidents or threats. For more information about the cybersecurity risks the Company faces, see the risk factor entitled "Technology is used in operations, and any material failure, inadequacy, interruption or security failure of that technology from cyber-attacks or other events could harm the Company's business" in Item 1A- Risk Factors.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: We have a Vice President, Information Technology, whose team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and prepare the Company and its employees to address cybersecurity risks. The Vice President, Information Technology has a Master of Science in Information Technology and has implemented cybersecurity programs at four companies in the biotechnology industry over a 20-year career.

companyName: Verve Therapeutics, Inc.


text: The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any material incidents to upper management in a timely manner whenever they occur.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. See Item 1A. Risk Factors under, A cyber-attack or other breach of our, our distributors, or our supply chain partners' information technology systems could have a material adverse effect on our business, financial condition and/or results of operations.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: We are in the process of formalizing the Audit Committee 's responsibilities to oversee our cybersecurity risk exposure and the steps taken by management to monitor and mitigate cybersecurity risks. Once these responsibilities have been established, the cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk advisory services will brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis. This will include updates on our processes to prevent, detect, and mitigate cyber incidents. In addition, material cybersecurity risks and/or events, should they occur, will be reviewed by the Board, at least annually, as part of our corporate risk oversight processes.

companyName: Sachem Capital Corp.

ticker: SACH


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and protected health information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our information technology department, which is led by our Director of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, and other contractors and suppliers. We also conduct regular employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: BIORA THERAPEUTICS, INC.


text: We also provide our employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. We conduct regular phishing tests and provide additional training as appropriate. We have a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: The Company's Information Technology team has established an information security management system to safeguard the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. This system is integrated with our Quality and Business Management Systems and, aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure ("IRP") that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: Cybersecurity threats are constantly evolving, which drives the evolution of our responses. Typical activities for our information security team include system monitoring, new hire and annual training, testing and evaluation, including "phishing" exercises, and publication of tips and best practices. The results of this testing are communicated to corporate leadership, including to the Technology Committee of the Board of Directors. Our CISO reports to the Technology Committee as requested, but no less than quarterly.

companyName: MAXIMUS, INC.

ticker: MMS


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: The Director of Information Security and information security managers carry broad manager level cyber security certifications, and the technical teams carry relevant specific technical certifications related to both Information Technology and Operational Technology security.

companyName: Noble Corp plc

ticker: NE


text: Our systems are monitored 24/7 for cybersecurity threats, and we utilize a variety of tools to reduce the risk of data breaches and cybersecurity events. We maintain an Incident Response Plan that outlines the steps to be taken in the event of an incident, which could include a potential or actual data breach. The plan identifies a designated team, including associates and third-party experts, responsible for incident response and summarizes the steps, including escalation protocol, for determining whether an event has occurred and the nature and scope of the event (if applicable). The plan also summarizes protocol for notifying impacted persons, which may include customers as well as other applicable agencies or persons, including law enforcement and regulatory authorities.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: In 2024, we undertook the following initiatives: further enhanced our data protection and threat-intelligence capabilities; improved our processes for third-party risk management; continued mandatory cybersecurity education for all employees; and incorporated social engineering to our phishing simulations. When we engage third parties, we have policies and processes to govern their access and reduce the risks associated with their access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: Cybersecurity incidents have increased in number and severity and it is expected that these trends will continue. Techniques used in cyberattacks evolve frequently, are increasingly sophisticated, and may not be recognized until launched. Cyber-attacks can originate from a wide variety of sources, including both internal and external sources, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to broadly disrupt the operations of financial institutions. We may be unable to fully prevent cyber-attacks due to the inability to anticipate, detect, or recognize threats to our systems, or to implement effective preventative measures against all breaches. In addition, we do not have control over the cybersecurity of the systems of our customers, counterparty, and third-party service providers.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, and monitoring and detection tools to allow our information security team members to assist us in identifying vulnerabilities in our systems before they are exploited by malicious threat actors. Our information security activities are overseen by our Chief Technology Officer, who has over 25 years of experience in information technology, including security, encryption, system design, programming and compliance, and leaders from Information Technology, Legal and Finance teams, who have an average of 20 years of experience in information technology, security, compliance and auditing.

companyName: Proto Labs Inc

ticker: PRLB


text: Cybersecurity threats encompass potential hazards such as malicious code, employee misconduct, advanced persistent threats, fraud, and phishing attacks. These risks have the potential to lead to information technology system failures, threat to water supply, or compromise of sensitive information.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage, cybersecurity incident, or data breach.

companyName: Disc Medicine, Inc.

ticker: IRON


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: We leverage multiple managed security service providers to monitor key system and network activity on a 24 hour basis to detect and alert the information technology team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources. The Bank utilizes cybersecurity tools to detect and prevent successful phishing campaigns. All employees receive three training sessions annually covering social engineering, phishing and current scam events, followed by periodic testing.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: The PSO reports to our Audit Committee and ESC on cybersecurity risks. Our Chief Information Security Officer (CISO) meets with the ESC and Audit Committee periodically in an effort to review the company's cybersecurity risks, the company's prevention, detection and remediation efforts of cybersecurity incidents (as appropriate), and key cybersecurity performance indicators. We also maintain procedures designed to escalate certain cybersecurity risks and incidents to members of executive management and the board of directors, as appropriate.

companyName: Everpure, Inc.

ticker: PSTG


text: Blackstone's CSO will report to BXINFRA's Board of Directors and/or Audit Committee periodically on cybersecurity matters, including risks facing BXINFRA and the Sponsor and, as applicable, certain incidents. In addition to such periodic reports, BXINFRA's Board of Directors and/or Audit Committee will receive periodic reports and/or updates from management on the primary cybersecurity risks facing BXINFRA and the Sponsor and the measures we and the Sponsor are taking to mitigate such risks. In addition to such reports, the Board of Directors and/or Audit Committee will receive updates from management regarding changes to BXINFRA's and the Sponsor's cybersecurity risk profile or certain newly identified risks.

companyName: Blackstone Infrastructure Strategies L.P.


text: By conducting regular risk assessments, we believe we effectively manage both internal and external cybersecurity threats. Our cybersecurity strategy is specifically tailored to our organization's size, scope, and business needs, emphasizing the protection of data. Our security infrastructure includes advanced tools and protocols, such as firewall protections, secure user authentication, and up-to-date antivirus and internet security software, which we believe are fundamental components of our operational protocols designed to mitigate vulnerabilities and efficiently address security incidents. We also periodically assess and manage cybersecurity risks associated with our third-party service providers.

companyName: Cineverse Corp.

ticker: CNVS


text: The EROC oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The EROC receives regular presentations and reports on the Information Security Program, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has ultimate responsibility for the oversight of risk management, including risks from cybersecurity threats. The Board of Directors has delegated primary oversight of cybersecurity risk to the Cyber Security Risk Management Committee. The Committee, in turn, ensures its members either possess or have access to relevant cybersecurity and risk management expertise to effectively challenge and guide management's program. The Committee regularly assesses how management is managing these risks and reports on its activities to the full Board of Directors at least quarterly to promote effective coordination and ensure the entire Board remains apprised of the cybersecurity risk landscape and the program's effectiveness.

companyName: PHOTRONICS INC

ticker: PLAB


text: While we and our service providers have experienced cybersecurity incidents in the past, as of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operation, or financial condition. For more information regarding the risks we face, please read Part I, Item 1A. "Risk Factors—General Risk Factors—Various security risks, including cybersecurity threats, data breaches, and other disruptions, could significantly affect us."

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Service Provider Oversight HTH Procurement processes contract requests, contract renewals and onboard of vendors. Such process creates a single point of entry for all sourcing and contract requests. Vendors who match certain inherent risk levels are then sent to Vendor Risk Management ("VRM") for further review and due diligence. Vendors who host Non-Public Personally Identifiable Information or vendors who we deem materially critical, regardless of risk, are managed by VRM. The VRM's due diligence process is risk-based and serves as a verification and analysis tool to assist in the evaluation of risk associated with new vendor relationships and ongoing reviews of inherently high-risk and vital vendors. VRM also is tasked with monitoring managed vendors business continuity and disaster recovery processes.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: The deployment of updates and patches as they are available for all installed versions of enterprise software to reduce the exposure to vulnerabilities.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: As a defense contractor, we must comply with DoD cybersecurity requirements for handling Controlled Unclassified Information ("CUI") and requirements in the Defense Federal Acquisition Regulation Supplement ("DFARS") regarding reporting cybersecurity incidents to the DoD, including the DoD's Cybersecurity Maturity Model Certification ("CMMC") program. We are prepared to participate in this program and obtain associated CMMC certification. We also adhere to the standards set forth by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO") to ensure the highest level of security and operational excellence. Our commitment to compliance with these rigorous frameworks is integral to maintaining the confidentiality, integrity, and availability of our services and products.

companyName: Science Applications International Corp

ticker: SAIC


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks it faces, including the Company's addition, the Company's and the Bank's boards of directors, both as a whole and through the Bank's Enterprise Risk Management Committee ("ERM") is responsible for the oversight of risk management, including cybersecurity risks. In that role, the boards of directors and the ERM, with support from the Bank's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: Our Executive Director, Corporate Information Systems is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our Enterprise Incident Response Plan. Our Chief Legal Officer works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.

companyName: Vericel Corp

ticker: VCEL


text: We rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident. We seek to mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We plan to engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: Maison Solutions Inc.

ticker: MSS


text: Our cybersecurity risk assessment, management and strategy processes are led by our Vice President, Head of Technology. Our Vice President, Head of Technology has over 20 years of experience in various roles involving managing information security, managing privacy and data protection, developing cybersecurity strategy, and implementing cybersecurity programs. The Vice President, Head of Technology, a Certified Information Security Manager (CISM) with up-to-date credentials, is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through management of the cybersecurity risk management and strategy processes described above, including our incident response plan.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: The audit committee receives periodic reports from management concerning any significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Sprinklr, Inc.

ticker: CXM


text: We regularly review our cybersecurity policies, standards and procedures to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our cybersecurity efforts also include mandatory training for all employees and contractors on our security and privacy policies.

companyName: Zscaler, Inc.

ticker: ZS


text: While we are subject to continuous cybersecurity threats and attacks like most companies, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully under Item 1A. "Risk Factors," cybersecurity threats are continually evolving to become more sophisticated and there is a risk that we could experience compromise of our information technology systems and data. Accordingly, while we continue to make significant investment in physical and technological security measures, including third-party services designed to anticipate cyber-attacks and prevent breaches, we cannot provide assurance that we will be successful in adequately responding to, or preventing, cyber-attacks. We also maintain cybersecurity insurance that is regularly reviewed to assess whether there is appropriate coverage.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: Our CISO meets at least annually with each of the Compliance Committee and the Audit Committee to discuss cybersecurity threats and the risk management programs. The CISO provides information, as appropriate, about the sources and nature of risks the Company faces and how management assesses such risks. Our CISO also provides a quarterly report to the Audit Committee on trends and observations concerning cyber threats and actions being taken to mitigate those risks. The Chair of the Audit Committee reports quarterly to the full Board of Directors and that report includes a summary of the CISO's report.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: We maintain a comprehensive incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. This plan includes procedures for promptly reporting material incidents to the SEC, as required, and for communicating with affected stakeholders.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: The Company's risk management process and strategy, including cybersecurity risks, is the responsibility of the CRO and is supported by the Company's Risk Management Steering Committee ("RMSC"), which includes senior management executives, including the President and Chief Executive Officer ("CEO"), the Chief Financial Officer ("CFO"), and the Chief Investment Officer, among others. The RMSC provides oversight and advises the CRO on the Company's enterprise risk management framework and strategic risk exposures including cybersecurity risks. The Company's CISO and CRO provide updates through quarterly meetings with the RMSC.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: As discussed in more detail under the heading "Governance," The board of directors oversight of cybersecurity risk management is supported by the Audit Committee of the board of directors (the "Audit Committee"), which interacts with our Enterprise Risk Management function, our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including management's Cybersecurity Council.

companyName: Marpai, Inc.

ticker: MRAI


text: We conduct monthly risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Republic's technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Cybersecurity organization, led by our Chief Information Security Officer (CISO), is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CISO has over 20 years of information technology, information technology audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: commenced reporting on such practices and risks. The plan for the future is that they will continue to report to the Board on cybersecurity at least quarterly. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. We believe we are appropriately staffed (as supported by IT consultants and service providers, as needed) to support a healthy cybersecurity posture given our size and scope.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: Board Oversight of Cybersecurity Risks The board of directors of the Company (the " Board ") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Information Security Officer ("CISO") of the Investment Adviser and Chief Compliance Officer ("CCO") of the Company regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and briefing on material risks from cybersecurity threats and material cybersecurity incidents impacting the Company.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: We have not experienced any cybersecurity incidents that have had a material impact on our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, refer to Risk Factors under Part I, Item 1A of this Annual Report.

companyName: Permian Resources Corp

ticker: PR


text: Incident Identification and Response A cyber incident detection system has been implemented to help promptly identify cybersecurity incidents. In the event of any cybersecurity incident, we have a cross-functional incident response plan that is designed to provide for escalating actions to identify the cause, contain the incident, mitigate the impact, and efficiently restore normal operations. The incident response plan is reviewed annually, and a tabletop exercise testing the incident response plan is periodically conducted.

companyName: Enviva, LLC


text: At the Board level, Atkore's cybersecurity is overseen by a subset of the full Board of Directors, specifically the independent board members. This oversight includes a quarterly review of Atkore's cybersecurity program, including key program metrics, initiatives, and developments. In addition, in the event of a significant cybersecurity incident, Atkore's policy and process requires timely engagement of and consultation with the Board of Directors.

companyName: Atkore Inc.

ticker: ATKR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program. Board and Committee members receive presentations on cybersecurity topics from our Chief Technology Officer and others within the Chief Technology Officer's team, as well as other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Commerce.com, Inc.

ticker: CMRC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Scientific Officer, President and Chief Operating Officer, Chief Financial Officer, Vice President Finance and General Counsel who also serves as our compliance officer. These members of management have prior work experience in various roles involving managing information security programs and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.

companyName: CalciMedica, Inc.

ticker: CALC


text: Our Information Security Program is further supported by regular educational and awareness training for employees. The training includes an annual assessment, focused on security, appropriate use, incident reporting, and social engineering, as well as multiple courses per year on global security trends and emerging risks. We also provide employees with educational materials about emerging cybersecurity threats and update employees when our information security policies are amended.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: Oversight of our information security program, including oversight of risks related to cybersecurity threats and the assessment and management of such risks, is accomplished through a governance structure which includes our Board, Audit Committee, and executive management.

companyName: Outset Medical, Inc.

ticker: OM


text: Management Oversight — We have implemented a cross functional ISMS governance committee that drives awareness and alignment across broad governance and stakeholder groups for effective cybersecurity risk management. The interim CSO and interim Data Privacy Officer ("DPO") co-chair the ISMS Governance Committee. The ISMS Governance Committee acts in alignment with the Data Protection Governance Committee, another cross-functional governance committee, which provides strategic direction and oversight over the company's program related to data protection. These governance committees have responsibility for oversight, resource allocation, capabilities and planning. Members of the ISMS committee review newly identified cybersecurity risks, evaluate the appropriate treatments, monitor the on-going status of risk remediation. The interim CSO and DPO regularly report to the audit committee on these matters.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity program. Our Board of Directors (the " Board ") is ultimately responsible for the oversight of the Company's security program. In the oversight of the program, the Board is focused on cybersecurity risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.

companyName: Simulations Plus, Inc.

ticker: SLP


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future.

companyName: LUB LIQUIDATING TRUST


text: The Company and its Board understands the importance of maintaining a secure environment for our products, data and systems that effectively supports our business objectives and customer needs. Cybersecurity risks are overseen by the Audit Committee of the Board. The Senior Vice-President and Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide ongoing and continuing reports to the Audit Committee, which includes information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, and benchmarking the Company against its industry peers. The CISO is responsible for navigating cyber risks, data access governance, security governance and global regulatory compliance related to cybersecurity regulations and industry standards. The Company also has a Chief Product Security Officer ("CPSO") who manages imbedding cybersecurity in the Company's products and services as they are being developed.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: With over 25 years of experience across diverse IT technologies, the CIO brings extensive expertise to the role. The CIO is also a member of the Company's executive leadership team, meeting regularly with the CEO, CFO, and other senior leaders. The CIO directly reports to the Board at least annually, addressing cybersecurity risks and strategy, and attends Board meetings to discuss cybersecurity matters as needed. The Audit Committee provides oversight of the information security program. The CIO reports to the Audit Committee annually on cybersecurity risks and related internal controls and attends quarterly meetings to provide updates and address any questions regarding cybersecurity and information technology systems.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: Like most large organizations, we face constant and dynamic risks related to cybersecurity. In recent years we have faced, and expect to continue to face, various attempted cyber-attacks of increasing sophistication. To date, we are not aware of any cybersecurity incident or threat that materially impacted or could reasonably be anticipated to materially affect our business, results of operations or financial condition. However, we cannot guarantee that we will not experience such an incident in the future. For a further description of these risks, see "Risk Factors – Risks Relating to Technology, Cybersecurity and Data Privacy," included in Item 1A of this Form 10-K, which should be read in conjunction with this Item 1C.

companyName: POOL CORP

ticker: POOL


text: We utilize a defense-in-depth approach, layering security starting with cloud-based tools through our perimeter all the way to the client and server end points with End Point Detection and Response solutions. We continue to invest and align advances in technology to strengthen our security posture. This year we implemented tools that provide additional visibility into lateral movement, enhancements for multifactor authentication, and patching of servers. Cyber risks and incidents are categorized by severity, evaluated for materiality, responded to based on defined incident response playbooks and then remediated accordingly. We perform organized tabletop exercises to test these practices and identify areas where opportunities for improvement can occur.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Upon the identification of a cybersecurity incident, the Incident Response Team ("IRT") initiates our Security Incident Response Policy. This includes determining the scope and risk level of the incident, the incident response, and the steps necessary to reduce the likelihood of reoccurrence. Depending on the severity of the incident, the IRT reports the incident to the Audit Committee, as well as communicates with other appropriate stakeholders. In addition, a summary of cybersecurity incidents, results of testing, corporate security training and planned enhancements are reported to the Audit Committee at least quarterly by the Vice President, Information Technology.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Berkshire and its Business Groups rely on third-party service providers for a variety of products and services to run their information systems. This dependence exposes Berkshire and the Business Groups, along with others who use these service providers, to the impact of a cyber-attack on their service providers. On occasion, a cyber-attack at a third party service provider could have a significant financial, operational or reputational impact to Berkshire. Berkshire and its Business Groups continuously monitor the risks associated with its service providers.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: The Board also has a standing committee (the "Cybersecurity Committee") that advises it on cybersecurity matters and provides strategic guidance and direction for our cybersecurity program. The Cybersecurity Committee convenes as necessary to address critical or emerging cybersecurity concerns and to ensure alignment on approach. Our CIO and CISO collaborate with the Cybersecurity Committee and report to the entire Board on a quarterly basis, or more frequently as needed. Additionally, the Cybersecurity Committee reviews the outcomes of our regular tabletop exercises with our CIO and CISO and ensures that lessons learned have been incorporated into the overall strategy.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Audit Committee of the Board of Directors (the "Audit Committee") is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, a company, we leverage the National Institute of Standards and Technology (NIST) Cybersecurity Framework to align with industry best practices and to develop policies and procedures, which include a Cybersecurity Response Plan focusing on detection, validation, mitigation, recovery, and refinement. In addition to the Cybersecurity Response Plan, we provide cybersecurity awareness training to our employees, including training on social engineering, phishing, password protection, confidential data protection, mobile security, and incident reporting, to help prevent and reduce the impact of potential cybersecurity events.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: Our IT, legal, and finance departments work with the information security function within the Company to help identify, assess and manage the Company's cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, internal or external audits, subscribing to and analyzing reports and intelligence feeds that identify cybersecurity threats and threat actors, conducting threat assessments (both internally and by third parties) for internal and external threats, evaluating our and our industry's risk profile, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, coordinating with law enforcement concerning threats, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, data encryption, network security controls, data segregation, asset management, tracking, and disposal, access controls, system monitoring, employee training, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, cyber insurance, and physical security mechanisms.

companyName: Turnstone Biologics Corp.


text: Our information security team is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. It works with other groups in the Company to understand the severity of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. The information security team has processes designed to keep the Company apprised of the different threats in the cybersecurity landscape – this includes interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending security conferences. The team also regularly monitors our internal network and out customer-facing network to identify security risks.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: Although we have no t experienced a cyberattack or other Cybersecurity incident that has materially affected us, we cannot guarantee that we will not experience Cybersecurity incidents that may have a material effect on us in the future. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cyberattacks and other unauthorized access, disclosure, and disruption.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: Additionally, as a public company, we are subject to Sarbanes -Oxley (SOX) requirements and must undergo independent audits of Information Technology General Controls (ITGC) in support of Internal Control over Financial Reporting (ICFR). These audits assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of financial reporting systems and data. If any control deficiencies that represent material cybersecurity risks were identified, those would be reported to the Audit Committee, and the results of these evaluations would be considered in the overall audit opinion for the Company.

companyName: WisdomTree, Inc.

ticker: WT


text: Our information security program is regularly evaluated by internal and external parties with the results of certain reviews reported to senior management and the cybersecurity committee. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our cybersecurity committee will also receive prompt and timely information regarding any material cybersecurity threats or incidents, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed. To mitigate the impact of any cybersecurity incidents, we maintain cybersecurity insurance in amounts that we believe are appropriate of our business, which provides coverage for such incidents.

companyName: BILL Holdings, Inc.

ticker: BILL


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and the Company will continue to assess and update our cybersecurity measures in response to emerging threats. a discussion of potential cybersecurity risks affecting the Company, please refer to Item 1A - Risk Factors.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: To identify and assess material risks from cybersecurity threats, using our enterprise risk management framework, we consider cybersecurity risks as part of our overall risk assessment and risk management process. Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management program serves as a second line of defense, bringing holistic risk oversight and serving as a partner to the business to help first line teams strategically manage risk. Our enterprise risk management function also establishes a risk and governance framework to help identify, prioritize and optimize risk-reward decisions. Certain risks identified by our enterprise risk management function, including cybersecurity risks, are monitored by our Risk Steering Committee, a senior management level committee that includes our Executive Team. The Risk Steering Committee's review of these risks in turn informs the risk management updates provided to the Risk Oversight Committee of our Board of Directors. Additionally, Internal Audit will annually review certain aspects of our cybersecurity program and the related Internal Controls, and our external auditor will test relevant controls around our cybersecurity program and incident reporting. We also do external testing, and in 2024 completed a NIST Cybersecurity Framework audit with Mandiant.

companyName: ETSY INC

ticker: ETSY


text: Our cybersecurity risk management program includes: • Cybersecurity incident detection and response plan to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. • Risk Assessment: Our enterprise-wide risk management programs and Information Security Review process is designed to identify, assess, document, monitor, and report information security risks. Based on this information, we evaluate the likelihood and impact of harmful events and deliver recommendations regarding a response to risks presented. Feedback from internal audits, external assessments, and industry benchmarks is used to improve our cybersecurity posture. • Training and Awareness: Implementation of enterprise-wide mandatory annual security awareness training for employees, including cybersecurity and data privacy training. We regularly deploy enterprise-wide phishing simulation tests with mandatory follow-up training and education, which are reviewed at least annually and are updated as needed. Additionally, we provide an easy mechanism for employees to report suspicious email messages to the information security team for additional investigation. • Security Tools Optimization: Utilize a variety of tools designed to protect our network and systems, including firewalls, intrusion detection and prevention systems, web content filtering protection, anti-virus and malware detection tools, system scans and full disk encryption. • Third Party Risk: Keysight's Third Party Cyber Risk Management is a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, processes, and procedures.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: These positions are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for preparing and approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Regulus Therapeutics Inc.


text: Sovos Brands maintains a risk-based information security program designed to identify, assess, manage and mitigate material risks from current and future cybersecurity threats. We have structured our program to align with the Center for Internet Security (CIS) Critical Security Controls (an industry recognized framework), informed by our risk assessment processes, which is intended to allow the program to evolve in response to the changing threat environment and as we continue to mature as a company. Our program includes implementing and maintaining information technology systems that monitor and track threats and vulnerabilities, maintaining written policies and procedures, carrying cybersecurity insurance, identifying risks arising from key third-party providers that host our material data, and delivering employee training and awareness regarding their responsibilities in securing our data and systems.

companyName: Sovos Brands, Inc.


text: We engage a third-party provider to identify, assess, and manage cybersecurity threats and risks which is achieved through monitoring and evaluating our threat environment and our risk profile using various methods including the use of manual and automated tools, analysis of reports of threats and threat actors, scanning the threat environment, and evaluation of our industry's risk profile.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: We operate in the biotechnology field, which is subject to various cybersecurity risks that could adversely affect our business. We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity risks. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Pluri Inc.

ticker: PLUR


text: We maintain a comprehensive process for detecting, assessing, and managing material risks from cybersecurity threats as part of our overall enterprise risk management system and processes. Our Chief Technology Officer ("CTO") oversees our Chief Information Security Officer and a dedicated team of information security professionals who are responsible for our cybersecurity risk management program. Our CTO oversees our information security professionals' efforts to prevent, detect, mitigate, and remediate cybersecurity and other emerging technology risks and incidents and the efforts for assessing and managing our material risks from cybersecurity threats. Our cybersecurity and risk management program includes technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools, and related services from third-party providers. Our CTO has over twenty years of extensive experience in information technology and security.

companyName: Churchill Downs Inc

ticker: CHDN


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: The last known cybersecurity breach occurred in 2020. The Company has not experienced any material cybersecurity breach in the years ended December 31, 2023, 2022 and 2021. The Company also has not incurred any net expenses from penalties and/or settlements from any material cybersecurity breaches during the years ended December 31, 2023, 2022, and 2021.

companyName: MAXLINEAR, INC

ticker: MXL


text: We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems.

companyName: YIELD10 BIOSCIENCE, INC.


text: We have also invested in various tools to protect our data and information technology. We maintain a robust system of data protection and cybersecurity resources, technology and processes, and we regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make ongoing strategic investments to address these risks, including maintaining insurance coverage to mitigate the potential financial consequences of cybersecurity incidents, and compliance requirements and help keep Company, guest and team member data secure. We monitor risks of sensitive information compromise at our business partners, where relevant, and reevaluate these risks on a periodic basis. In addition, we have a cybersecurity training program designed to educate and train employees how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees the awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. We also provide specialized training for employees in more sensitive roles. For example, we perform annual and ongoing cybersecurity awareness training for our restaurant management and restaurant support center team members. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards. We conduct regular drills, such as tabletop exercises led by third party consultants, to support our overall preparedness for a variety of scenarios.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness trainings and supplemental trainings as needed. All employees undergo annual training and there are additional trainings for certain roles and functions. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.

companyName: Primo Water Corp /CN/


text: Our Board of Directors oversees our risk management process. The Audit Committee, by way of Board delegation, retains oversight of the Company's cybersecurity risks. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board, as applicable. Our Vice President of Technology and/or Manager of Information Technology are responsible for leading the assessment and management of cybersecurity threats and periodically updating the Audit Committee as needed.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: We deploy stringent email filtering that prohibits incoming messages from insecure email systems (i.e., gmail, yahoo, aol, etc.) that are known to carry viruses, spyware, crypto ransom, etc. We perform regular internal and external penetration tests.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: The Company's Board of Directors, specifically the Audit Committee, is responsible for oversight and governance related to our cybersecurity processes and risk management. The CIO reports the results of the annual comprehensive risk assessment, including the evaluation of cybersecurity risks, the actions we have taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry to the Board of Directors on an annual basis and reports cybersecurity risk updates to the Audit Committee on a semi-annual basis, or more frequently should a cybersecurity risk or event emerge requiring additional communication. The Audit Committee will report on the cybersecurity risk updates it receives from the CIO to the Board of Directors or as needed have the CIO report subsequently to the full Board of Directors.

companyName: H&E Equipment Services, Inc.


text: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and cyber governance. In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss technology and cybersecurity risks and the Company's risk assessment and risk management policies, practices, programs and/or procedures that have been adopted to monitor, control, mitigate and manage such risks. In addition, the Audit Committee reviews management's reports on topics, including risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration.

companyName: Archer Aviation Inc.

ticker: ACHR


text: Our program is designed to identify, assess, and manage material risks from cybersecurity threats through practices that include: • required information security and privacy training supported by periodic phishing simulation exercises to reinforce awareness and enhance cybersecurity practices; • monitoring of network and system activity to detect unusual or suspicious behavior; • access management and access controls which aim to implement “least privilege” access; • multifactor authentication and encryption of sensitive data through “at rest” and “in transit” where feasible; • deployment of industry-standard security monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • business continuity and disaster recovery planning; and • a documented Incident Response Plan (“IRP”) that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents in coordination with our Legal and the Ethics, Compliance, and Data Privacy (“ECDP”) department.

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: The compliance team of the Company and Saratoga Investment Advisors will conduct ongoing due diligence of its significant service providers to determine whether the cybersecurity programs of service providers include, among other things, procedures and safeguards designed to ensure the protection of Critical Information and the information of the Company's stockholders and portfolio companies, as well as adequate responses in the case of a cybersecurity incident.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: Our business depends on the availability, reliability, and security of our information systems, networks, data and intellectual property. Any disruption, compromise or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships or loss of market share. In the last three years prior to filing of this Form 10-K, the Company has not experienced any significant information security breach.

companyName: Hub Group, Inc.

ticker: HUBG


text: Protection processes at DIRTT include: cyber awareness training, cyber awareness assessment (each employee is assigned a cybersecurity awareness grade calculated by a best in class cybersecurity vendor), implementation of identity and access controls, perimeter and endpoint security, annual vulnerability assessments and remediation, data encryption in transit, key vendor (third parties) control effectiveness assessment, and pre-implementation of software and systems cybersecurity assessments. Detection processes at DIRTT include: automated event collection, collation, analysis, alerting and end user incident reporting. Respond processes at DIRTT include: containment, communication, investigation and analysis, and long-term mitigation planning. Recovery processes at DIRTT include: impact identification and analysis, system restoration, internal and external communications as deemed necessary.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: b. A security team principally responsible for managing (1) our cybersecurity risk assessment process, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: Douglas Emmett Inc

ticker: DEI


text: We track key performance indicators and cybersecurity metrics to evaluate the efficacy of our cybersecurity controls and practices. Further, our cybersecurity program is periodically reviewed by senior members of management and adjusted as needed in an effort to maintain the program's agility and responsiveness as circumstances and technologies evolve, new cybersecurity threats emerge and regulations change.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: Our Chief Technology Officer (CTO), with over 25 years of experience in various disciplines of information technology, oversees the cybersecurity program. Reporting to the Chief Executive Officer, the CTO provides regular briefs to the Board of Directors (the Board) and executive management, informing them about prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as ongoing risks and threats.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: perform due diligence on third-party vendors and, based on our risk assessment, put in place contractual undertakings and oversight to manage and reduce the risks associated with third-party vendors;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents have been immaterial. This includes penalties and settlements, of which there were none. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business operations and financial condition. See "Risk Factors" in Item 1A.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Oversight of cybersecurity is integrated into the responsibilities of the Board. The Audit, Finance and Risk Committee (the AFRC) provides oversight of cybersecurity matters, particularly as they relate to financial risk and controls, integrity of financial data and public disclosures, and security of the cyber landscape across data and digital. The Safety and Reliability Committee (SRC) has oversight responsibility for security (physical, data and cyber) including as it relates to operational risk and controls, safety, operations integrity and reliability, and asset operations.

companyName: ENBRIDGE INC

ticker: ENB


text: Our management, with input from our Board of Directors, performs an annual enterprise-wide risk management ("ERM") assessment to identify and manage key existing and emerging risks for our company. Our ERM process assesses the characteristics and circumstances of the evolving business environment at the time and seeks to identify the potential impact, likelihood and velocity of a particular risk. Our senior executive management team has the overall responsibility for, and oversight of, our ERM process, and senior executives are assigned to monitor and manage top identified risks. Cybersecurity is among the top risks identified for oversight as a result of our last annual ERM assessment.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: At present the Company has minimal risks related to Cybersecurity as its operational business is not conducted on the internet or available through the internet.

companyName: DH ENCHANTMENT, INC.

ticker: ENMI


text: We have established and maintain various information security processes designed to identify, assess, and manage cybersecurity risks to our critical computer networks, third-party hosted services, communication systems, hardware, software, and vital data, such as intellectual property, confidential proprietary information, strategic assets, and non-clinical/clinical trial data (Information Systems and Data). Our Chief Operating and Financial Officer, Vice President of Information Technology, vCISO (Virtual Chief Information Security Officer), cybersecurity business partner and IT & Legal teams collaborate to address cybersecurity threats and risks, leveraging our risk register when needed. Our VP of Information Technology, vCISO, members of our in-house IT team, and our third-party cybersecurity business partner all play an active role in monitoring and assessing risks from cyber threats through a variety of methods including automated tools, third-party testing, tabletop incident response exercises, threat actor analysis, industry risk profiling, and collaboration with law enforcement.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: Our management team is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team has experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Skye for strategic cyber risk management, advisory and decision making.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: The Enterprise Risk Committee of the Company's Board of Directors (the "Risk Committee") is responsible for oversight of the Company's enterprise-wide risks as set forth in its charter. That includes oversight of management's actions designed to identify, assess, mitigate, and prevent or remediate material cybersecurity issues and risks, through the ISP and other activities. The CISO provides quarterly (or more frequent, as appropriate) reports to the Risk Committee and the Risk Executive Committee, along with periodic reporting to the full Board of Directors on the ISP, the ISTRM's activities, key enterprise cybersecurity initiatives, and other matters relating to the Company's cybersecurity profile and risks. The Risk Committee provides a report to the full Board of Directors at each regular Board meeting regarding the Risk Committee's risk oversight activities, including those relating to cybersecurity, and the Company maintains procedures for the CRO and/or CISO to escalate significant cybersecurity matters to the Risk Committee, Executive Committee, and/or the full Board of Directors, as appropriate.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: The Board of Directors has oversight responsibility for Saia's strategic and operational risks. Although the Board has delegated oversight responsibility for certain risks to its committees, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board regularly receives reports from the Executive Vice President and Chief Information Officer concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.

companyName: SAIA INC

ticker: SAIA


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. Major incidents emanating from cybersecurity threats are communicated to our Operational Risk team through our enterprise risk management system and escalated in accordance with our incident response plan. In addition, cybersecurity has been designated as a principal risk by the Risk Committee of our Board of Directors (the "Risk Committee"), which requires regular monitoring and reporting.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers. As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable. Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Board as appropriate.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Cybersecurity is an important area of focus for our Board of Directors. The Board of Directors reviews and discusses with our CIO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, any significant cybersecurity incidents and the emerging threat landscape. Our CIO discusses the same cybersecurity topics covered with the Board of Directors with the IEB. In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives.

companyName: Information Services Group Inc.

ticker: III


text: Our cybersecurity frameworks are informed by third-party standards relevant to our industry such as the National Institute of Standards and Technology, the Center for Internet Security and the International Standards Organization. We regularly test our cybersecurity defenses through both automated and manual testing to identify, prioritize and remediate risk. Alight also engages third parties to examine and report on the effectiveness of our controls relating to our systems, including those used in the cybersecurity frameworks.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Our board of directors oversees our risk management strategy with respect to cybersecurity threats. The board, through its Audit Committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our management, including our Vice President, Technology & Information Security, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: We extend our cybersecurity focus to third-party service providers by evaluating and monitoring their cybersecurity risks. High-risk vendors undergo continuous monitoring, and we maintain contractual agreements that mandate our third-party providers' commitment to managing cybersecurity risks, providing incident notifications, and being subject to cybersecurity audits.


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information and operational technologies and protect the confidentiality, integrity, and availability of our data. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to collect, process and store the data necessary to conduct almost all aspects of our business, including the evaluation of acquisition and development opportunities, the monitoring and evaluation of our existing properties and the performance of and data from our operators and the recording and reporting of financial information.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Under our comprehensive risk management program, the board of directors (Board) of the company maintains oversight of the most significant risks facing the company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program. The full Board retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, the Board receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: The Company is a late-stage clinical biotechnology company committed to applying scientific leadership in the field of localized cancer reduction leading to anti-cancer immune activation. Currently, management has not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk. Management assesses material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. To this end, the Company utilizes an outsourced information technology consultant to implement systems and procedures designed to reduce, respond to and monitor for cybersecurity threats and vulnerabilities. The outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems and has implemented systems and procedures to mitigate cybersecurity risks that the Company believes are appropriate for a company of our size, stage of growth and financial condition. In addition, the Company carries insurance with coverage for cyber events that it believes is suitable for a company of our size, stage of growth and financial condition.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: The Company's Security Operations Team, led by our Chief Information Security Officer, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company's Executive Security Steering Committee. The Company's Chief Information Security Officer holds high-level licenses and certifications relating to information security, including a Certified Information Security Manager from the Information Systems Audit and Control Association and a Certified Information Systems Security Professional and a Certified Cloud Security Professional from the International Information Security System Security Certification Consortium. The Company's Executive Security Steering Committee, chaired by the Company's Chief Information Security Officer and comprised of various cross-functional members of senior management, drives awareness and alignment across broad stakeholder groups for cybersecurity governance and risk management and reporting. The Executive Security Steering Committee receives quarterly reports from the Company's Chief Information Security Officer. The Compliance and Risk Committee receives regular reports from the Company's Chief Information Security Officer. The Compliance and Risk Committee periodically reports to the Board.

companyName: DraftKings Inc.

ticker: DKNG


text: We operate in the medical devices sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Both our executive management team and our board of directors are involved in the assessment, identification, and management of such risks, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Dror Ortho-Design, Inc.

ticker: DROR


text: Technical Safeguards As part of our Cybersecurity Program, the Company deploys technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: Our Information Security Program utilizes multiple layers of security controls that are intended to protect information assets and operations. As a guideline to manage our cybersecurity-related risk, we use the National Institute of Standards and Technology Cybersecurity Framework, which outlines information security measures and controls over five functions: Identify, Protect, Detect, Respond and Recover. This does not imply that we meet any particular technical standards, specifications, or requirements. Our risk management process is designed for the purpose of identifying, assessing and mitigating potential threats and uncertainties that may impact the achievement of our business objectives. This process involves engaging relevant stakeholders, conducting regular risk assessments, and staying informed about industry-specific risks and market trends. Identified risks are evaluated based on their potential impact and likelihood of occurrence.

companyName: RADIAN GROUP INC

ticker: RDN


text: We identify and assess areas of risk for our business on an ongoing basis, and we have developed, and regularly update and refine, comprehensive practices to manage and mitigate existing and potential risks to our business. As part of that process, we continually identify and assess areas of cybersecurity risk for our business using the National Institute of Technology Cybersecurity Framework 2.0 ("NIST CSF 2.0 Framework"). We have an information security risk management framework that has processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management includes the following elements: • a team dedicated solely to cybersecurity which is managed by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Digital and Transformation Officer ("CDTO"); • a third party risk management process that includes cybersecurity assessments of third party products and systems proposed to connect to our information systems environment or access or store our data; and • a cybersecurity incident response plan.

companyName: Ardent Health, Inc.

ticker: ARDT


text: The Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board of Directors in exercising oversight of the Company's cybersecurity, information security, and information technology risks. Periodically, the Audit Committee reviews and discusses with the Chief Financial Officer, who leads our cybersecurity program, the Company's policies, procedures, and practices with respect to cybersecurity, information security and information and operational technology, including related risks.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer, a member of our Executive Leadership Team ("ELT"). Our current acting CISO has a graduate degree in computer engineering and has worked in cybersecurity for over a decade. The information security team is comprised of approximately 60 employees, with dedicated teams assigned to governance, risk and compliance, identity and access management, strategy and architecture, and analytics and automation. The team operates from FactSet locations around the world, including offices in the U.S., India, the Philippines, and Europe.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Due to our reliance on digital technology and electronic communications to run our business, cybersecurity threats and incidents pose an ongoing and escalating risk to our internal and third-party provided information systems and data, reputation and shareholder value, results of operations and financial condition. Our Chief Technology Officer, who reports directly to our Chief Executive Officer, holds over 25 years of experience in information technology, specifically infrastructure, information security and fraud, and identity solutions at large global companies, and our Vice President of Information Technology ("IT") Governance, who reports to our Chief Technology Officer, holds 20 years of experience in various information security roles. Together, our Chief Technology Officer and Vice President of IT Governance ("IT leadership") oversee and lead our information security program and our business strategy, financial planning and capital allocation around our cybersecurity risk management and governance practices. We also have an established Incident Response Team ("IRT") to respond to and manage cybersecurity events. This team includes our IT leadership as well as senior leadership from our accounting, legal, corporate communications and risk management departments with subject-matter expertise and established tenure at Prologis in their respective areas. The IRT is tasked with taking appropriate action to safeguard the integrity of our information systems, data and network resources, investigate whether a breach occurred, define disclosures, communicate effectively with key audiences, including the Board as necessary, mitigate cybersecurity incident risks and provide a resolution through our cybersecurity incident communication protocols. Additionally, on an annual basis the IRT is involved and engaged in security initiatives, including tabletop exercises facilitated both internally and externally, to stay relevant on current practices in the areas of cybersecurity.

companyName: Prologis, Inc.

ticker: PLD


text: To ensure the integrity and security of our operations, we have implemented stringent processes to evaluate third -party service providers and vendors that have access to sensitive systems, as well as company and customer data. This evaluation may include due diligence procedures such as assessments of the service provider's cybersecurity posture or recommendations for specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood. These risk determinations are crucial in driving the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: TRANSCAT INC

ticker: TRNS


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not impact the Company's business in a material manner. At the effective date of this report filing, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on risks related to the Company's information technology systems, including cybersecurity threats that may materially affect the Company's business, see the risk factors included under Item 1A of this Annual Report on Form 10-K ("We Rely Heavily on Information Technology Systems to Operate Our Business and Any Disruptions to or Data Breach of These Technology Systems or if These Systems were Made Unavailable for Use, May Have a Material Adverse Effect on Our Business").

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive data and applications of our customers ("Information Systems and Data"). Rubrik, Inc.

companyName: Rubrik, Inc.

ticker: RBRK


text: Company does not have its own cybersecurity policy but relies on the policies and procedures of its Contract Research Organizations (CROs) and Software as a Service (SaaS) contractors that handle its data and software. We are committed to protecting the confidentiality, integrity, and availability of our information assets and complying with applicable laws and regulations regarding cybersecurity.

companyName: Mitesco, Inc.

ticker: MITI


text: The company employs a standards-based cybersecurity program aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), including ongoing assessment and continuous improvement to address the rapidly evolving threat landscape. Ball partners closely with a strong network of external partners, including conducting annual assessments of the cyber risk management program against the NIST CSF.

companyName: BALL Corp

ticker: BALL


text: We employ a range of tools and services, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessment and penetration testing, to update our ongoing risk identification and mitigation efforts. We have a cybersecurity assessment process, which helps identify our cybersecurity risks by comparing our processes to standards set by the Center for Internet Security. Our processes also assess cybersecurity risks associated with our use of third-party service providers. We proactively engage with key vendors, industry participants, and law enforcement/cyber threat intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: INSMED Inc

ticker: INSM


text: In 2025, we did no t identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Neolara Corp.


text: Our cybersecurity operations are led by our Chief Financial Officer. He is responsible for overseeing the development and implementation of our cybersecurity strategy, policies, standards and practices. He also oversees our cybersecurity team, which includes a staff member who has over 20 years of experience in the field. Our cybersecurity team monitors, detects, responds and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: We are, or may in the future become, subject to a variety of complex federal, state and local laws, regulations, rules and standards regarding data privacy and cybersecurity, including the privacy and information safeguarding provisions of the Gramm-Leach-Bliley Act ("GLB Act"), the Fair Credit Reporting Act ("FCRA") and the amendments adopted by the Fair and Accurate Credit Transactions Act of 2003, as well as various state laws and regulations. The GLB Act requires a financial institution to, among other things, disclose its privacy policy to certain customers and, in some circumstances, enables certain customers to opt-out of certain sharing of the customers' nonpublic personal information with nonaffiliated third parties. The GLB Act also requires financial institutions to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer information. In accordance with these requirements, we and each of our banks and operating subsidiaries provide a written privacy notice to each affected customer when the customer relationship begins and, to the extent required, on an annual basis. As described in the privacy notice, we endeavor to protect the security of information (including personal information) about our customers, educate our employees about the importance of protecting customer privacy, and allow affected customers to opt-out of certain types of information sharing. We and our subsidiaries also require business partners with which we share information (including personal information) to have adequate security safeguards and to follow the requirements of the GLB Act. The GLB Act, as interpreted by the federal banking regulators, and state laws and regulations require us to take certain actions, including providing notice under certain circumstances to affected customers, in the event that sensitive or personal customer information is compromised. We and/or each of the banks and operating subsidiaries may need to amend our privacy policies and adapt our internal procedures in the event that these legal requirements, or the regulators' interpretation of them, change, or if new requirements are added. Additionally, the federal banking regulators, as well as the SEC and related self-regulatory organizations, regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") have primary responsibility for assessing and managing material cybersecurity risks. Our CTO and COO are both seasoned computer scientists and technology entrepreneurs with over 25 years of experience.

companyName: VisionWave Holdings, Inc.

ticker: VWAV


text: Establishing a risk-appetite profile, which we review at least annually to regularly assess our cybersecurity infrastructure and software systems in a manner that ensures we capture their current state and identify emerging risks that would require changes in our cyber environment;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Related to Cybersecurity Risks In addition to the services provided by our MSP, we have also formed an IT Steering Committee, whose members include representatives from our management team as well as our MSP, to review our cybersecurity program initiatives and related program metrics. Our IT Steering Committee provides cybersecurity updates and reports to our Audit Committee at each quarterly meeting or would report more frequently if there was a need to do so.

companyName: Vivani Medical, Inc.

ticker: VANI


text: The Audit Committee of the Board of Directors, or the Audit Committee, provides direct oversight over cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: Cybersecurity | Cybersecurity Governance governance. Members of the Internal Audit organization participate as non-voting members of both the Technology Risk Committee and the Enterprise Risk Committee.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's cybersecurity risk management program controls meeting certain criteria.

companyName: CoreCivic, Inc.

ticker: CXW