text: of any cybersecurity threats, and have not experienced any cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: Dime Community Bank ("Dime", "the Bank") maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM

secItem: Item 1C


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into our approach to risk management, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). The Company uses recognized frameworks from the National Institute of Standards and Technology as guidelines to inform its cybersecurity policies, standards, and practices. We generally approach cybersecurity matters through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: BOYD GAMING CORP

ticker: BYD


text: Our approach to managing cybersecurity risks is integrated into our overall risk management strategy. The IT team conducts risk assessments as needed and mandates periodic cybersecurity training for all employees. Additionally, we engage third-party service providers, including legal counsel, threat intelligence experts, cybersecurity services providers, and cybersecurity consultants, to enhance our risk management efforts.

companyName: Avid Bioservices, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: Management plays a critical role in assessing and managing the company's material risks from cybersecurity threats. Cybersecurity efforts are overseen by the Chief Digital Officer, supported by a dedicated team. The Chief Digital Officer has over 20 years of experience in leadership roles in the digital domain at renowned organizations such as Nasdaq and TIAA. Their expertise encompasses a deep understanding of cyber threats, risk management strategies, and regulatory compliance requirements, which positions the Chief Digital Officer to lead the company against evolving cyber-related threats.

companyName: Altus Power, Inc.


text: The Information Security Governance Committee ("ISGC"), appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. It aids the Board in fulfilling its oversight duties related to IT security, aligning with the Bank's business strategy, and adhering to regulatory requirements. The Virtual Chief Information Security Officer ("vCISO"), who is also appointed by the Board, oversees the ISP and coordinates the ISGC.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: AIRGAIN INC

ticker: AIRG


text: Use of Consultants and Advisors: We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third-party consulting firm to evaluate our cyber processes including an assessment of our incident response procedures.

companyName: Inogen Inc

ticker: INGN


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct thorough security assessments of all determined high-risk third-party providers as deemed necessary, before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Vice President of IT, who oversees the Company's cybersecurity function.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our information technology ("IT") team, which includes both our internal staff and retained consultants with IT and cybersecurity expertise, is led by our Vice President of IT who has more than 25 years of experience managing and securing technology infrastructure and is certified in cybersecurity by the Information System Security Certification Consortium. The IT team has responsibility for, among other things, developing and implementing practices, procedures and controls designed to identify, assess and manage cybersecurity programs and risks. The IT team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our IT team is supplemented by a security committee, comprised of representatives from key functional areas of our business and includes both our CFO and our Sr. VP of Human Resources to whom the Vice President of IT reports.


text: Aspire recognizes that cybersecurity is not solely a technology issue but also a people and process issue. We invest in ongoing employee training and awareness programs to empower our staff to recognize and respond to potential security threats effectively.

companyName: Aspire Biopharma Holdings, Inc.

ticker: ASBP


text: Under our cybersecurity risk program, we provide all of our employees with periodic cybersecurity training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Q32 Bio Inc.

ticker: QTTB


text: The Harley-Davidson CISO meets regularly with our Head of Digital to review and discuss our cybersecurity and other information technology risks and opportunities. Our cybersecurity incident response plan sets forth a security incident management and reporting protocol, with escalation timelines and responsibilities.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT and operational technology, or OT, environments; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT and OT environments for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • cybersecurity tabletop exercises for members of our cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: We proactively work to address cybersecurity risk through our Digital & IT Risk Management Program, which focuses on identifying, assessing, responding to, monitoring and remediating cybersecurity-related risks. Parker's dedicated Cyber Security team utilizes the National Institute of Standards and Technology (NIST) Cyber Security Framework as its primary resource for identifying areas of risk and benchmarking and implementing continuous improvements. Our technical security configuration employs a centrally managed, layered approach, including hardened PCs, endpoint security detection software, email security, firewall appliances, and various network security protections. We employ enhanced security measures for operational technologies and secure account management, including recently adding a secondary anti-malware solution to our existing software to bolster our company-wide defenses. Additionally, we utilize third-party security monitoring services to further improve our 24/7 monitoring capabilities. We also maintain a third-party risk management program designed to oversee, identify, and reduce the potential impact to Parker and our customers of a security incident at a third-party vendor, supplier or other provider.

companyName: Parker-Hannifin Corp

ticker: PH


text: Engagement with Third-Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, helping our cybersecurity strategies and processes remain consistent with applicable generally adopted industry best practices. Our collaborations with these third parties include: • regular audits, threat assessments and penetration testing; • consultation on security enhancements; • bug bounty program for identifying security weaknesses in our products and services; • designing partnership with third party vendors; • using our in-house security tools as customers; and • global incident response experts for potential critical cybersecurity events.

companyName: JFrog Ltd

ticker: FROG


text: In the current digital environment, companies may be the target of cyber-attacks or other malicious efforts to cause a cyber incident. These cyber incidents can include, but not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. The possible consequences of such an attack include but are not limited to loss of data, damage to the Company's reputation, interruptions to our operations, and/or the need to pay ransom.

companyName: Vystar Corp

ticker: VYST


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit and Finance Committee, which is comprised entirely of independent directors with information security experience, oversees and monitors the company's information security programs. Additionally, one of our independent directors has a CERT Certification in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute. The Chief Information Officer (''CIO'') meets with the Audit and Finance Committee regularly to report on risks, mitigation, initiatives, compliance and outcomes and the Audit and Finance Committee reports relevant information to the full Board.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity " in our risk factor disclosures in Item IA of this Annual Report on Form 10-K.

companyName: Journey Medical Corp

ticker: DERM


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. Although the Audit Committee maintains primary responsibility for oversight of cybersecurity risks through the ERM program, responsibility related to oversight of cybersecurity risks is also delegated to other committees in alignment with their focus charter responsibilities. For example, the Technology and Innovation and Governance Committees assist with the cybersecurity programs through their oversight of our technology, digital, and innovation strategies and product integrity program, respectively.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, conducting risk asse ssments and maintaining business continuity and disaster recovery plans.

companyName: EMERSON RADIO CORP

ticker: MSN


text: At the executive and management level, the CISO has primary responsibility for the development, operation, and maintenance of FirstEnergy's cyber security program. The CISO has 5 years of experience in technology risk management, all of which have been with FirstEnergy, and an additional 23 years of experience in information technology. The CISO has passed examinations and received the International Information System Security Certification Consortium Certified Information Systems Security Professional certification. The CISO reports directly to FirstEnergy's Chief Information Officer. Under the CISO's oversight, FirstEnergy's cyber security team implements and provides governance and functional oversight for cyber security controls and services. Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Chief Information Officer, legal, and the executive leaders as appropriate based on the severity of any such risk or incident. In addition, regular updates from the cyber security teams, in conjunction with real-time escalation on an as-needed basis, are also used to update the risk landscape.

companyName: FIRSTENERGY CORP

ticker: FE


text: We experience cybersecurity threats and incidents from time to time. However, as of the date of this report, we have not experienced a cybersecurity threat or incident that has materially affected the Company in at least the last three years. While we are not currently aware of any risks from cybersecurity threats that are reasonably likely to materially affect the Company, please see Part I, Item 1A. – "Risk Factors – Malicious cyber-attacks, attempted cybersecurity breaches, and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties."

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") processes. As part of our ERM processes, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: OptiNose, Inc.


text: Our management team, including our CIO, Chief Information Security Office (CISO) and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO (to whom the CISO reports) regularly attends meetings of the Committee. Our management team's experience includes decades of experience working in information security, advanced education, and information security certifications.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: Management and Governance of Cybersecurity Risk To manage our cybersecurity risk, we employ a cross-organizational steering committee, the Information Security Steering Committee ("ISSC"), that supports the direction and governance of our enterprise-wide Information Security Program. The ISSC is chaired by our Chief Information Security Officer ("CISO") and is comprised of accountable senior business leaders including our Chief Compliance Officer ("CCO"), Chief Risk Officer ("CRO"), legal counsel, and human resources, procurement and business segment leaders. In addition to the ISSC, we have defined risk functions to cover overall enterprise risks and information technology and cybersecurity risks within our enterprise risk management framework, including, but not limited to: our IT Risk Management program, led by our CISO; our Responsible Artificial Intelligence ("RAI") Program, led by our Chief Digital Information Officer; Compliance, led by our CCO; Internal Audit, led by our Chief Audit Executive ("CAE"); Enterprise Risk Management programs led by our CRO; Third-Party Risk Management, comprised of business and information security leaders; IT due diligence processes, led by business, technology and information security leaders; and our Corporate Insurance Program, including cybersecurity insurance, led by our Treasurer.

companyName: Elevance Health, Inc.

ticker: ELV


text: Under our information security framework, our Board and our Risk Management Committee are primarily responsible for overseeing and governing the development, implementation, and maintenance of our WISP program, with the Board designating our Risk Management Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least twice a year from our CISO or their designee. Our Risk Management Committee receives reports on cybersecurity at least four times a year, with ad hoc updates as needed. In addition, our Risk Management Committee annually approves our WISP program.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Okta, like other companies, is subject to a wide variety of cybersecurity attacks on its systems and networks on an ongoing basis and with increasing sophistication. In addition to threats from traditional computer "hackers," malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, Okta and its third-party service providers now also face threats from sophisticated nation-state actors and organized crime groups who engage in attacks (including advanced persistent threat intrusions). In the face of this threat landscape, Okta remains committed to protecting its systems, internal networks and its customers' systems, and the information that it and they store and process.

companyName: Okta, Inc.

ticker: OKTA


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation, impact our ability to operate, and other material adverse consequences.

companyName: Willdan Group, Inc.

ticker: WLDN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We could be held liable for damages, our reputation could suffer, and our business may be materially impacted due to service interruptions, from security breaches, cyber-attacks, other cybersecurity events or incidents or disclosure of confidential information or personal data".

companyName: DXC Technology Co

ticker: DXC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of NetScout's management, including our CISO, who reports to the CIO and has over 25 years of experience, the CCO, and the Senior Director of Engineering for security.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a cross-organizational approach to addressing cybersecurity risk. We are committed to maintaining robust governance and oversight of cybersecurity risk and have implemented mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. The Board of Directors, its Audit Committee and our management, including our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), contribute to our cybersecurity and risk management processes designed to help us respond in a timely and effective manner to emerging threats in a dynamic cybersecurity landscape.

companyName: Qorvo, Inc.

ticker: QRVO


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity and, will, from time to time, brief the full Board on our cybersecurity risk management program. From time to time, our Committee members receive presentations on cybersecurity topics from our internal or external experts as part of its continuing education on topics that impact public companies.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes robust reviews with our technology partners who provide the commercial off the shelf software applications we rely on from, among others, Yardi, SalesForce and UKG.

companyName: VINEBROOK HOMES TRUST, INC.


text: To strengthen our cybersecurity posture, we engage with external assessors, auditors, and consultants for regular risk assessments, penetration testing, and vulnerability analyses, allowing for proactive identification and mitigation of potential threats. We also rigorously verify the cybersecurity practices of our third-party service providers, vendors, and partners, conducting due diligence before establishing relationships and ongoing monitoring to verify compliance with our cybersecurity standards.

companyName: Spectaire Holdings Inc.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us has not occurred or will not occur in the future. For additional information on risks from cybersecurity threats, please see Item 1A Risk Factors.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: As one of the world's largest cybersecurity solution providers, we routinely defend against advanced persistent threats both internally and for our clients. Our cybersecurity risk management program is an integral part of our overall enterprise risk management program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: The foundation of risk oversight at Equinix is our Governance, Risk and Compliance Committee ("GRCC"), overseen by the Nominating and Governance Committee of our Board. The GRCC is a global, cross-functional group currently comprised of global senior leaders, across functions such as Legal, Compliance and Risk Management. The GRCC considers enterprise and emerging risks via Equinix's Enterprise Risk Management Program (the "ERM Program"). Our ERM Program focuses on the identification, assessment, management, monitoring and reporting of key business risks. Risk identification involves periodic risk surveys and/or risk interviews with key business process owners and executives to identify key strategic, operational, financial, regulatory, compliance and external risks at the enterprise level. Our next global risk assessment to identify enterprise risks will be conducted in the first half of 2025. In addition, the ERM Program also includes an Emerging Risks Team of business leaders at Equinix, representing a majority of business functions, that meets monthly to identify fast-moving, potentially impactful risks.

companyName: EQUINIX INC

ticker: EQIX


text: Customers are also sources of cybersecurity risk to the Company and its information assets, particularly when their activities and systems are beyond the Company's own security and control systems.

companyName: AIRWA INC.

ticker: YYAI


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. We maintain an Information Security Incident Response form that directs a detector of any incident to report such incident to our Information Security Officer, whom we contract through a third-party service provider. Following notice of any such incident, our Information Security Officer would then work with our Chief Financial Officer and our Board to establish an appropriate response plan and to determine the materiality of the incident and any disclosure obligations.

companyName: TAO Synergies Inc.

ticker: TAOX


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser's GHIC. The Adviser's GHIC has extensive experience in managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since 2021 and has worked in the financial services industry for more than 15 years, during which the CCO has gained expertise in assessing and managing such risks applicable to the Company.

companyName: BC Partners Lending Corp


text: A team led by the CISO implements and maintains systems designed to detect and prevent cybersecurity threats, monitors important developments that may present risk to Mattel and third-party systems, and oversees the results of internal and third-party security reviews. The CISO provides regular updates to Mattel's CTO regarding critical and major severity security incidents involving Mattel systems, security incidents involving third parties that have the potential to impact Mattel's operations or involve sensitive customer, supplier, consumer, or employee data, and mitigation and remediation implemented to address such threats or incidents.

companyName: MATTEL INC /DE/

ticker: MAT


text: a cybersecurity incident response plan and governance charter are maintained by the cybersecurity incident response team. The cybersecurity incident response plan and supporting playbooks are utilized during table-top exercises and trainings. Participants may include information technology, business, corporate function, and external resources depending on the table-top scenario; and third-party supplier security reviews are conducted based on risk. Reviews may include the assessment of security architecture, connections between our systems and the third party, data security controls, and user access controls.

companyName: TE Connectivity plc

ticker: TEL


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: Invesco's Board of Directors oversees cybersecurity risk across the entire organization and receives updates at a minimum of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.'s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board to facilitate their oversight.

companyName: Invesco CurrencyShares Japanese Yen Trust

ticker: FXY


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.

companyName: BANNER CORP

ticker: BANR


text: The General Partner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the General Partner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.

companyName: NESTOR PARTNERS


text: Information regarding cybersecurity risks is communicated through various channels, including direct discussions between key leaders and Company management, and reports to the Board of Directors and its committees. The Board of Directors regularly receives updates from our compliance officer and senior IT leadership on the status of our cybersecurity measures and any significant developments.

companyName: Outdoor Holding Co

ticker: POWW


text: Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company. In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessment and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: Our cybersecurity program is informed by industry standards and includes processes for identification, assessment, and management of cybersecurity risks. With support from external vendors, we conduct internal and external risk assessments to assess our cyber program and develop strategies for the management of cyber risks. We also employ vendors and external partners to monitor for and manage threats, and we engage in testing to identify vulnerabilities and use third-party tools to scan for potential risks.

companyName: Markforged Holding Corp


text: Cyber risk management and strategy The Bank recognizes the critical importance of developing, implementing, assessing, and maintaining appropriate cybersecurity measures to safeguard information systems and protect the confidentiality, integrity, and availability of data. The Risk Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. The Chief Information Security Officer with experience in information technology and cybersecurity, is primarily responsible for implementing cyber risk mitigation strategies and is supported by a team of skilled professionals holding cybersecurity-related certifications.

companyName: FB Financial Corp

ticker: FBK


text: The Vice President of Information Technology oversees the population of third-party service providers connected to any of the Company's networks. The Company obtains a Report on Controls at a Service Organization Relevant to User Entities' Internal Control over Financial Reporting, Type 2 Report ("SOC-1 Report") that reports on the fairness of the presentation of the service provider's description of the service organization's system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives throughout a specified period. The SOC-1 Report is reviewed by Internal Audit. The Company limits access to information based on the nature of the services performed by third party service providers which provides a significant level of risk management before third-party access to data.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: A continuous effort to identify which risks are likely to affect the CXApp's strategic objectives and consequently security functions and business continuity of CXApp and documenting their characteristics. Analysis of Risks: An estimation of the probability (likelihood), impact, and prioritization of risks relative to each other.

companyName: CXApp Inc.

ticker: CXAI


text: The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, " We face risks related to our information technology systems, including potential cyber-attacks and security and privacy breaches ".

companyName: Vireo Growth Inc.

ticker: VREOF


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the experience of risk management, legal, information technology, and compliance personnel of the Advisor when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.

companyName: Kennedy Lewis Capital Co


text: The CIMT is responsible for coordinating the containment, response, investigation, reporting, and recovery related to a cybersecurity incident, and is an internally led management team made up of leaders from our Communications, Human Resources, IT and Cybersecurity, Legal and Compliance, Risk Management and other departments, including our IT Director, Cyber Security. Team members possess a broad scope of expertise, including cybersecurity, information technology, legal, compliance, risk management, insurance and crisis communications. The CIMT operates under the co-leadership of the General Counsel and CDO, who are responsible for oversight and composition of the CIMT, determining whether an incident warrants activating external service providers, providing updates to the Chief Executive Officer and Senior Management Team, keeping our Governance Committee as well as our Board of Directors informed as appropriate, and ultimately establishing and executing our enterprise-wide incident response strategy.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: From time to time, the Company experiences cybersecurity threats and attacks. Although no cybersecurity incident has materially affected the Company's businesses to date, FOX expects to continue to be subject to cybersecurity threats and attacks and there can be no assurance that the Company will not experience a material incident. For more information, see Item 1A., "Risk Factors—Risks Relating to Cybersecurity, Piracy, Privacy and Data Protection."

companyName: Fox Corp

ticker: FOXA


text: The COO and CISO provide updates to the audit committee of our board of directors (the "Audit Committee") on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies. In addition to such regular updates, and as part of our incident response processes, our COO is also responsible for informing the Audit Committee of material cybersecurity threats and incidents, based on management's assessment of risk.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Dow's Cyber Security Operations Center ("CSOC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or Dow internal information systems and incidents originating from third parties. The CSOC provides end-to-end operations for purposes of monitoring, detecting, alerting and responding to cyber incidents. The CSOC evaluates each incident in terms of its impact on Dow's and the Corporation's operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. The CSOC is also responsible for activating the containment and resolution efforts and third-party service providers are engaged where appropriate to support Dow through the resolution of the incident. The CSOC escalates incidents with significant impact and pervasiveness to Dow's Corporate Crisis Management Team for further action. After initial identification, the CSOC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.

companyName: UNION CARBIDE CORP /NEW/


text: We have a proactive strategy to manage the material risks stemming from cybersecurity threats. Our cybersecurity program follows the Cybersecurity Framework as defined by the National Institute of Standards and Technologies. The Cybersecurity program is the responsibility of our internal IT Security Team, which is overseen by our Vice President, Chief Information Officer (the "CIO").

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer, who leads a team responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, has extensive experience and background in information technology, cybersecurity, enterprise strategy, risk management. Additionally, our Chief Operating Officer chairs our Cybersecurity Incident Response Team, which is responsible for prevention, identification, containment, eradication and remediation of cybersecurity incidents. He consults with experts in enterprise security and risk management to ensure our intellectual property and devices are protected. While we have not experienced a material information security (cybersecurity) incident, we maintain an information security (cybersecurity) risk insurance policy as a matter of good practice.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: We rely on Hess' management team – including the Chief Risk Officer, the Head of Information Technology and the Chief Information Security Officer ("CISO") – for assessing and managing our material risks from cybersecurity threats. The team is primarily responsible for our overall cybersecurity risk management program and supervises both Hess' internal cybersecurity personnel and retained external cybersecurity consultants. Hess' Chief Risk Officer, who also currently serves as our Chief Financial Officer, has nearly 20 years of experience in this role and previously served as a consultant with Ernst & Young LLP's Risk Management and Regulatory Practice, where he assisted financial services and energy trading clients in establishing their risk management infrastructure. Hess' Head of Information Technology and Hess' CISO each have over 20 years of experience in information technology leadership in oil and gas. Furthermore, Hess' CISO holds a Bachelor of Science in Cyber and Data Security from the University of Arizona and is a Certified Information Systems Security Professional.

companyName: Hess Midstream LP

ticker: HESM


text: At the management level, the Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported, to the extent required by applicable law.

companyName: AWARE INC /MA/

ticker: AWRE


text: The members of our cybersecurity team have risk management backgrounds, certifications, and/or cyber experience in prior professional roles and at the Company. The team maintains expertise on cyber risk management through certified security professionals on staff, external training and affiliations with relevant organizations. Additionally, we regularly engage with third party assessors, consultants, and advisors as needed for reviews and testing of our cybersecurity risk management systems.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third party service providers. We classify third parties engaged by us based on risk and impact to our business. Classification is broken into tiers as follows:

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Review and Assessment of Information Security Program We conduct regular audits of our information security program, including third party assessments and review by our internal audit department.

companyName: EQUIFAX INC

ticker: EFX


text: Our Audit Committee, which includes a member with cybersecurity experience, oversees our management of risks relating to information security and data privacy. At least semiannually, the Audit Committee is responsible for reviewing and discussing our risk exposures related to information security and data privacy with management. These management updates are designed to inform the Audit Committee of any potential risks relating to information security or data privacy and any relevant mitigation or remediation tactics being implemented. In addition, as part of our regular enterprise risk management assessments, cybersecurity risks are reported to and assessed by the Enterprise Risk Committee, comprised of senior leadership from key business functions.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: As of December 31, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: We apply NIST 800-53, which is a standardized risk management framework for managing and securing our information system. The first step in system authorization is system categorization.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: In today's digital age, the security and integrity of our information systems are of paramount importance. As a company, we understand the need to protect the confidentiality, availability and integrity of our systems and data. This disclosure aims to provide an overview of our approach to cybersecurity and the potential risks and threats we face.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Internal training and awareness – We provide training to our employees to help identify, avoid, and mitigate the risk from cybersecurity threats. Our employees are required to complete required cybersecurity awareness training upon hiring and also participate annually in required cybersecurity awareness training, unless on a leave of absence.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO, as of the date of this report, has experience in cybersecurity leadership roles at Microsoft Corporation, where he helped drive core security programs for the Windows operating system, including platform integrity, cryptography, data protection, identity and access control. He also held a leadership role in the mergers and acquisition security program at Salesforce, Inc., which included the assessment and remediation of security of potential and approved acquisitions. After he obtained his Bachelor of Science Degree in Electrical Engineering, he served for eight years as a Nuclear Submarine Officer for the U.S. Navy. He also has a Master of Business Administration degree.

companyName: Samsara Inc.

ticker: IOT


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information and operational technologies and protect the confidentiality, integrity and availability of our data. Our business is dependent upon our computer systems, devices, software and networks to collect, process and store the data necessary to conduct almost all aspects of our business.

companyName: Forward Industries, Inc.

ticker: FWDI


text: Our Board of Directors, or Board, considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management program.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a component of our internal control system. Cybersecurity awareness, including specific topics related to social engineering and email frauds, are included as a part of our annual employee training program. We have processes and controls, in particular with respect to our financial and reporting technology, to prevent and minimize cybersecurity risks and attacks. We rely on industry-standard third-party software and vendors for our core systems, including data storage, analysis and backup. As discussed under Item 9A – Disclosure Controls and Procedures, we are in the process of improving and enhancing our information technology policies and procedures for our information systems, including cybersecurity capabilities.

companyName: Kuvatris Therapeutics, Inc.


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. Further, we perform ongoing phishing simulations to help employees recognize, avoid and report potential threats that could compromise critical business data and systems. Additional mandatory training is provided to employees who engage in potentially compromising activities during these simulations.

companyName: STORE CAPITAL LLC


text: Our cybersecurity risk management program leverages the Center for Internet Security (CIS) framework. This includes the CIS Risk Assessment Method (CIS RAM) and CIS Controls Self-Assessment (CSAT). We are implementing CIS Critical Security Controls to assess and strengthen our risk management and cybersecurity posture against an evolving threat landscape.

companyName: Manitex International, Inc.


text: CIRT members regularly report to the Operational Risk Committee, which is part of our overall risk management framework. The Operational Risk Committee is responsible for incorporating risk management considerations into our business activities. The Operational Risk Committee reports to the Executive Committee, our principal management-level policy-making committee that reports directly to the Board. Under the Plan, the Executive Committee is responsible for escalating and informing the Board about significant cybersecurity incidents and steps being taken by management to address them. In the event of an ongoing threat incident, the CIRT may engage directly with members of the Executive Committee in real-time.

companyName: PJT Partners Inc.

ticker: PJT


text: Role of Management, Our Security Risk Committee ("SRC"), comprised of our Chief Security Officer ("CSO"), our Chief Legal Officer and representatives from the technology and product, people, IT and legal teams, is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CISO works with the SRC to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.

companyName: N-able, Inc.

ticker: NABL


text: Our Chief Information Officer has managerial responsibility for our cybersecurity risk program and is a member of our cybersecurity incident response team steering committee. Our Chief Information Officer has over 34 years of experience in information technology and cybersecurity, including leadership roles responsible for cybersecurity and data privacy for large publicly-traded and global companies. He graduated from Bellevue University with an M.S. in Computer Information Systems and an MBA.

companyName: California Resources Corp

ticker: CRC


text: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Monitoring Cybersecurity Incidents The ISO and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The ISO provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Our program framework and foundation are based on common security standards and frameworks, including ISO/IEC 27001/2:2022 and NIST Cyber Resiliency Framework and Model, in alignment with PCI DSS, privacy laws and regulatory requirements.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Cybersecurity Council, which includes the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Director of Risk, and Director of Information Technology & Cybersecurity.

companyName: EASTERN CO

ticker: EML


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. We leverage a defense-in-depth model to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.

companyName: Level 3 Parent, LLC


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Information Officer, Executive Vice President of Technology, and CISO, are responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks. Specifically:

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025, there have been no material cybersecurity incidents to report.

companyName: NORTHERN STATES POWER CO /WI/


text: The Adviser's Director of Information Technology, in coordination with relevant senior management and personnel of the Adviser, which includes our Adviser's Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, the Adviser's technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Adviser's Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer and employee information. • Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations. • Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to some employees based their roles. • Supplier risk assessments: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply-chain or who have access to our customer and employee data on our systems. Third-party risks are included within our risk management assessment program, as well as our cybersecurity-specific risk identification program. These considerations affect the selection and access to our systems, data, or facilities. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Third-party assessments: We have third-party cybersecurity companies engaged to periodically assess our cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.

companyName: CONTINENTAL RESOURCES, INC


text: We have a rigorous and comprehensive cybersecurity program managed by a dedicated team of subject matter experts and is led by our Chief Information Security Officer ("CISO"), who has extensive cybersecurity experience. We have implemented telehealth industry standard processes, policies, and tools, including regularly scheduled vulnerability scanning and third-party penetration testing to reduce the risk of vulnerabilities in our system.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify cybersecurity risks to our critical systems, information and our broader enterprise IT environment; • an information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Cerevel Therapeutics Holdings, Inc.


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and MetLife's Privacy Office and tested through cross-functional annual exercises in various geographical regions of MetLife, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.

companyName: METROPOLITAN LIFE INSURANCE CO


text: Our cybersecurity incident response processes include the escalation of information about certain cybersecurity incidents, depending on the circumstances, to our CISO, members of management, and the Audit Committee of the Board of Directors.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: In addition, we engage with our third-party business partners to enforce our internal cybersecurity practices. We rely on all third-party business partners to maintain appropriate security programs; however, we cannot ensure in all circumstances that their efforts will be successful. We assess third-party cybersecurity controls through a detailed cybersecurity assessment and review and include security and privacy addendums to our contracts, where applicable. We also require that our third parties report material cybersecurity incidents to us, allowing us the ability to assess the impact of any reported incident on our operations.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Chief Information Officer (CIO) leads our cybersecurity program and reports directly to our Chief Executive Officer. Our CIO is supported by our internal IT team that assists our CIO in the day-to-day management of the cybersecurity program, including the cybersecurity incident response plan, training initiatives and third-party assessments. Our CIO has over two decades of experience in various cybersecurity functions, including implementing stringent cybersecurity measures to protect sensitive information and meet established security standards, extensive work in IT governance and operations, network intrusion and critical systems protection, Enterprise Resource Planning (ERP) systems, and data analytics.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: Elements of our cybersecurity risk management process include, but are not limited to, the following: • Annual cybersecurity risk assessments of critical infrastructure and systems; • Annual vulnerability scans and penetration testing; • Mandatory, bi-annual cybersecurity awareness training for all employees, including phishing exercises; and • An overarching written information security policy and written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Pluri Inc.

ticker: PLUR


text: The CLCO and the COO regularly inform our CEO and CFO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing our company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Notwithstanding the strength of CSB's defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, CSB has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, CSB's systems and those of its customers and third-party service providers are under constant threat and it is possible that CSB could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by the Company and its customers.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: We believe cybersecurity is a critical component of our overall approach to developing, implementing, and maintaining a security environment that safeguards our information systems and protects the confidentiality and integrity of our data. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: WideOpenWest, Inc.

ticker: WOW


text: Dow's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages International Organization for Standardizations 27001/27002 standards for general information technology controls, International Society of Automation/International Electrotechnical Commission standards for industrial automation, the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.

companyName: UNION CARBIDE CORP /NEW/


text: Our Board considers cybersecurity risk one of the most significant risks to our business. The Board has delegated to the Audit Committee oversight of cybersecurity, data privacy, and other information technology risks affecting the Company. The Audit Committee periodically evaluates our cybersecurity strategy to ensure its effectiveness. Our CTO and VPMIS provide quarterly reports to the Audit Committee, which also provides quarterly reports on its activities to the Board. Annually, the Board receives a comprehensive update regarding the Company's cybersecurity efforts, which may include a cybersecurity tabletop exercise, presentation by third party cybersecurity experts, or similar events. Several members of our Board and Audit Committee have cybersecurity, data privacy, or related experience from their principal occupation or other professional experience.

companyName: Public Storage

ticker: PSA


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, who reports directly to our Chief Executive Officer, along with key members of the Information Security Officer's team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by the Informaiton Security Program, as well as the Information Technology Committee, with the goal of addressing changing threats and conditions.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: We rely on FS Investments to engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We are also included in the FS Investments risk management program and processes, which include cybersecurity risk assessments.

companyName: FS Credit Real Estate Income Trust, Inc.


text: The Sponsor engages a selection of third-party security experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: Service Providers The Company relies on third-party vendor services and solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented an Outsourcing Management Policy which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Outsourcing Management program is audited as part of the Company's external audit program.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: Cybersecurity risk management is integrated into the Bank's broader risk management framework to foster a company-wide culture of cybersecurity awareness. Key risk indicators, aligned with the Board-approved Statement of Risk Appetite, are reported quarterly to multiple management level committees and the Risk Committee of the Board of Directors. This process ensures timely communication and escalation of issues along with the required mitigation and remediation efforts related to cybersecurity risks.

companyName: FB Financial Corp

ticker: FBK


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: a. Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. b. Ensuring that changes to security configurations are documented, approved, and tested.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Since our IPO, our sole business activities have been identifying and evaluating suitable acquisition transaction candidates. We do not operate any enterprise information technology systems of our own and have only a limited number of personnel. Our cybersecurity risk is assessed and managed by our management team, who limit the persons who have authorized access to our online accounts and limit the vendors whose services we utilize to a small number of reputable service providers. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Zapata Quantum, Inc.

ticker: ZPTA


text: Our Global Director of IT, in coordination with our executive officers, including our CEO and CFO, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cybersecurity incidents if any occur. Our Global Director of IT has over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters, including over 20 years of experience as an IT Director. Our CEO has over 30 years of experience in information technology and cybersecurity risk management at the Company and at similar companies, and our CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Identiv, Inc.

ticker: INVE


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on us. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by cybersecurity strategies we have put in place. Despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, mitigate, and remediate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. For more information about the cybersecurity risks we face, see the risk factor entitled "We depend on the proper functioning and availability of our management information and communication systems and other information technology assets (including the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third-parties, or an inability to effectively upgrade such systems and assets could cause a significant disruption to our business and have a materially adverse effect on our results of operations" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: We use third party partners to audit, assess, and test our cybersecurity program governance and control effectiveness on an annual basis. These engagements include an IT general controls review, internal and external penetration testing, social engineering testing, and incident response exercises. Findings and recommendations from these engagements are reported to the Enterprise Risk Management and Audit Committees.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation, including coordination with public relations and internal and external communications teams.

companyName: Molecular Templates, Inc.


text: Every quarter, we evaluate our cybersecurity posture and reassess whether significant changes in our business could impact our digital infrastructure. These assessments aim to identify potential internal and external threats, estimate their probability and possible impact, and gauge the effectiveness of our current policies and processes in mitigating these threats.

companyName: Revolve Group, Inc.

ticker: RVLV


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. The Company does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that the Company will not be damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: DarkPulse, Inc.

ticker: DPLS


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.. Our third-party consultant team is managed by our Chief Financial Officer who reports to the Audit Committee at the board-level, as appropriate.

companyName: SmartKem, Inc.

ticker: SMTK


text: Management is required to report to the Audit Committee on our strategy, risks, metrics and operations relating to cybersecurity and information security matters. Management is responsible for ensuring that personnel are provided with adequate resources and trainings to fully understand the guidelines and expectations for cybersecurity. Members of our management team may be asked by our chief financial officer to assist with IT security investigations in the event of a breach of our Cybersecurity Policy. Upon becoming aware of a potential violation of our policy or a breach of cybersecurity, the member of management must immediately document the violation and request the individual surrender possession of any devices that may have suffered a security breach. If any member of management that is unaware of the best course of action in dealing with an IT-related matter is required to contact our third-party IT representative.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: The Company's Chief Operating Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Operating Officer and the IT Security Operations Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Cybersecurity is an important area of focus for our Board of Directors. Our information security risk management program is designed to allow our Board of Directors to establish a mutual understanding with management of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board of Directors and its committees. As part of its broader risk oversight activities, the Board of Directors oversees risks from cybersecurity risks, both directly and through the Finance and Audit Committee (F&A Committee). As reflected in its charter, the F&A Committee assists the Board of Directors with the management and assessment of privacy and data security risk and is responsible for reviewing and discussing with management privacy and data security risk exposures, including, among other things, the potential impacts of those exposures on our business, financial results, operations and reputation. The F&A Committee also oversees our internal controls over financial reporting, including with respect to financial reporting-related information systems.

companyName: ORACLE CORP

ticker: ORCL


text: The Company's Senior Vice President of Technology's relevant cybersecurity expertise includes Certified Information Systems Security Professional designation (CISSP), ISO 27001 as well as over 20 years of experience as a technology and security professional.

companyName: Cottonwood Communities, Inc.


text: Our Global Information Security team is responsible for the information security strategy, policy, security engineering, operations, and cyberthreat detection and response. Our Global Information Security team, which includes a security operations center, seeks to protect the company against reasonably foreseeable cyberthreats and risks. The cybersecurity team members have the qualifications and certifications required for their roles. In addition, they have relevant industry experience in selecting, deploying, and operating cybersecurity technologies, initiatives, and processes globally. In order to stay ahead of potential threats and enhance our overall security posture, we rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants that we engage.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Seaboard acknowledges the importance of effectively managing risks linked to cybersecurity threats. Seaboard has implemented oversight mechanisms to ensure effective governance in handling risks linked to cybersecurity threats because of the impact these threats can have on operational integrity and stakeholder confidence.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Cybersecurity oversight begins with the Information Technology & Information Security Committee ("IT/IS Committee") of the Wintrust Board of Directors. The Wintrust Chief Security Officer ("CSO") and Deputy Chief Information Security Officer ("Deputy CISO") oversee the cybersecurity program. The CSO has a dual reporting structure, reporting to both the IT/IS Committee and the Vice Chairman/Chief Operating Officer of Wintrust. The CSO and Deputy CISO, each with extensive industry experience, manage a team of skilled professionals with cybersecurity expertise. This team governs our cybersecurity program that follows seven pillars: strategy; prevention, detection, response, measurement, compliance, and training. Our cybersecurity program employs a wide range of technological, administrative, and physical security measures designed to address the confidentiality, integrity, and availability of the information and data of both Wintrust and our customers. We have established policies, processes and procedures to monitor, report and respond to suspected or actual security events. A critical function of the cybersecurity program is the Security Operations Center, which is constantly monitoring Wintrust systems to detect threats. If any credible threats are detected, the Security Operations Center notifies both the CSO and Deputy CISO, and the appropriate response plan is initiated. The CSO will advise executive management and other relevant stakeholders as necessary. We coordinate with our third parties and vendor partners through assessments and due diligence before sharing or allowing the hosting of data. We also work with our outside partners to investigate security events that may have impacted our confidential and other information, and to leverage lessons learned during those investigations. In addition, we contractually require our third-party service providers that possess or process any Wintrust or customer information to adhere to certain security requirements, controls and responsibilities based on the risk profile of the relationship.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company has an ERM program to identify, evaluate, and manage risks, including cybersecurity risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape. Atleos' ERM programs support the Company's strategic objectives and corporate governance responsibilities. The ERM programs include the following primary objectives: • Establish a standard risk framework and supporting policies and processes to identify, assess, respond to, and report on business risks and opportunities, including cybersecurity threats; • Establish clear roles and responsibilities in support of the Company's risk management activities, including cybersecurity; • Ensure appropriate independent oversight of business risks and opportunities and the impacts of related business decisions on the Company's risk profiles and tolerances; • Ensure appropriate communication and reporting of business risks and opportunities including related response strategies and controls to Atleos' executive leadership and Board of Directors; and • Provide relevant training to executives, managers and employees.

companyName: NCR Atleos Corp

ticker: NATL


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Though management is responsible for the day-to-day management of risks the Company faces, including cybersecurity risks, the Board, as a whole and through its committees, has the ultimate responsibility for oversight of the Company's risks and risk management strategy. The company performs assessments to evaluate its cybersecurity risk as it relates to the organization and assets.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: The oversight of our cybersecurity risk management process is integrated into our overall risk management process. Through our enterprise risk management process, which involves a broad cross-functional group across many areas of expertise and is structurally independent of our business lines, we identify and assess risk and risk-mitigation actions, including with respect to cybersecurity risks. Continuing oversight of our cybersecurity risk is addressed by a group of stakeholders that includes our information technology ("IT") and cybersecurity leadership and IT leaders within our various facilities, with cybersecurity risk input provided from this team to our senior leadership team on a regular basis. In turn, our Chief Information Officer provides key updates on risk and mitigation strategies to the Audit Committee.

companyName: SHYFT GROUP, INC.


text: The management team includes members with IT backgrounds to guide our cybersecurity efforts. Management continuously assesses risk as internal and external factors evolve and remains committed to ensuring employees have the adequate resources and training to fully understand cybersecurity guidelines and expectations. In the event of a Policy breach, members of the management team may be asked by the IT Department to assist with security investigations. If any member of management is unaware of the best course of action in dealing with an IT-related matter, the manager shall immediately contact the Company's Head of IT. Upon discovering a potential violation of the Policy or a cybersecurity breach, the member of management must document the incident and request the individual surrender possession of any devices that may have suffered a security breach.

companyName: Bit Digital, Inc

ticker: BTBT


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other vulnerabilities; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Our program includes procedures to identify cybersecurity risks and threats of our suppliers and third-party outsourcing providers with whom we interface, or who store, process, host or transmit confidential patient and employee data or other confidential information. Our Strategic Threat and Intelligence Center manages our threat landscape and uses a variety of security technology and threat intelligence tools designed to detect, prevent, block, analyze, and respond to cybersecurity threats. We collaborate with government agencies regarding potential cybersecurity threats and work with consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. At least annually, we review and test our program to simulate emergent threats and scenarios that could arise from potential cybersecurity attacks and data breaches. Our cybersecurity program is based on multiple security frameworks, including the National Institute of Standards and Technology's NIST 800 Special Publication Information Security standard, MITRE ATT&CK Framework, the Payment Card Industry Data Security Standard, the System and Organization Controls for Service Organizations 2 (SOC 2), and ISO 9001:2015 and ISO 15189.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: We have implemented a range of logical and technical controls to appropriately restrict physical and logical access. We maintain authentication controls in line with industry-recognized standards, including audit trails and logs for access. Access privileges are updated following any change in personnel or system, and are reviewed periodically, with the frequency determined by the associated risk of the application or system.

companyName: Alector, Inc.

ticker: ALEC


text: We invest a considerable amount of resources in training, tools and other resources to manage risks from cybersecurity threats. Our cybersecurity program is led by an experienced team that creates cybersecurity policies and procedures and possess expert knowledge related to controls and safeguards related to cybersecurity. The cybersecurity team, led by the D.R. Horton CIO, is responsible for assessing and managing risks from cybersecurity threats. The D.R. Horton CIO receives reports on cybersecurity threats from the cybersecurity team on an ongoing basis and in conjunction with the CSRO, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The D.R. Horton CIO and CSRO work closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: Forestar Group Inc.

ticker: FOR


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. Our cybersecurity risk management program includes the following key elements:

companyName: CYANOTECH CORP

ticker: CYAN


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," above.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: Other than as disclosed in Part I, Item 1A "Risk Factors" above, including, without limitation, the risk factor under the heading "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively", risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: SEELOS THERAPEUTICS, INC.


text: The Bank engages reputable third-party assessors to conduct various independent audits on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Bank leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.

companyName: BCB BANCORP INC

ticker: BCBP


text: Company Processes for Monitoring Cybersecurity Incidents The CISO is regularly informed about developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO works with the SPCC to implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to seek to identify potential vulnerabilities. If a cybersecurity event involving the Company were to occur, the CDEC would be engaged to initially evaluate the potential materiality of the event and the potential need for public disclosure, and the SPCC and other members of senior management would be engaged to determine the timing and extent of the response and to consider whether any future vulnerabilities are expected. As part of this evaluation, the Company, through the SPCC, would also work to identify actions to seek to mitigate the impact and long-term strategies for remediation and prevention of future incidents. After an initial evaluation by the CDEC, the relevant information regarding the cybersecurity event and its potential materiality would also be promptly raised to the Company's Disclosure Committee for further review and evaluation as to whether public disclosure would be required.

companyName: Integer Holdings Corp

ticker: ITGR


text: Our information security program includes administrative, technical and physical safeguards and is designed to provide an appropriate level of protection to maintain the confidentiality, integrity and availability of our Company's and our customers' information. This includes protecting against known and evolving threats to the security of customer records and information, and against unauthorized access, compromise, or loss of customer records or information.

companyName: AMES NATIONAL CORP

ticker: ATLO