text: The Company's cybersecurity function, led by its Chief Information Officer ("CIO") and Senior Director of Information Technology ("IT"), as well as its Enterprise Security Architect and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. The Company's CIO has over twenty-five years of technology leadership experience including infrastructure design and management, software development, system implementation, cybersecurity, and network design administration. The Company's CIO also has experience in data protection for systems and has supported a complex global public enterprise environment with operations in over 200 countries. The Company's Senior Director of IT has over 11 years of experience developing and leading healthcare solutions and has led the development in web and infrastructure design, serverless architecture, database integrations, SMS, mass-email and mass phone notification solutions and holds a Sarbanes-Oxley Act (SOX) certification. The Company's Enterprise Security Architect has over seven years of experience in assessing risk and protecting data in various technologies from client/server software to cloud based solutions and holds a Certified Information Systems Security Professional designation, a GIAC Certified Incident Handler Certification, and Sarbanes-Oxley Act (SOX) certifications. The Company's Senior Director of IT and the Enterprise Security Architect also have experience dealing directly with numerous cyber security threats, breaches, detection and containment activities and strategies under strict requirements and expectations for HIPAA covered entities. The Company's cybersecurity function works, in certain circumstances, in partnership with its managed security service provider ("MSSP") and managed service provider ("MSP") to help identify, assess, and respond to risks from cybersecurity threats, including by monitoring and evaluating its threat environment using various methods including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating the Company's and its industry's risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning certain threats, conducting internal and/or external audits, conducting threat assessments for certain internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds. The Company's Security Incident Response Team leverages a cybersecurity managed detection and response partner, which monitors certain of its endpoints, cloud infrastructure, and networks for irregular activity.

companyName: TerrAscend Corp.

ticker: TSNDF


text: Gold Resource Corporation Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare the Company to address cybersecurity risks. As part of the overall risk management system, the Company monitors and tests safeguards and trains employees on these safeguards. Personnel at all levels and departments are made aware of the cybersecurity policies through trainings.

companyName: GOLD RESOURCE CORP

ticker: GORO

secItem: Item 1C


text: Risks from Cybersecurity Threats We are subject to increasing and evolving cybersecurity threats as cyber attacks against companies, including Verizon, have increased in frequency, scope and potential harm in recent years. While, to date, we have not been subject to cyber attacks that, individually or in the aggregate, have been material to Verizon's operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyber attacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Our information technology ("IT") cybersecurity team, led by our Head of Information Security, is tasked with monitoring and assessing cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring: • Restricted physical access to critical areas, servers and network equipment; • Cyber incident response, crisis management, business continuity and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.

companyName: A10 Networks, Inc.

ticker: ATEN


text: formation of a multidisciplinary cybersecurity incident response team; and cyber event simulation and tabletop exercises per year to hone the cybersecurity incident response team preparedness.

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: One aspect of the Company's information security program is focused on vendor selection. The Company evaluates all third-party vendors and service providers for their cybersecurity features and compliance with security requirements. Selected vendors, for example, must employ a variety of security measures to protect against unauthorized access, data breaches, and data loss. Pineapple Energy remains committed to maintaining the highest standards of data security and ensuring the integrity and confidentiality of our data.

companyName: SUNation Energy, Inc.

ticker: SUNE


text: As a part of its oversight of the key risks facing Axon, our Board of Directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. While the Audit Committee of the Company's Board of Directors (the "Audit Committee") reviews any significant legal, compliance or regulatory matters that may have a material impact on our business, financial statements or compliance policies generally, it does so in consultation with our ERC Committee with respect to any such matters that involve cybersecurity, data privacy or information technology. The Chair of our ERC Committee is also a member of our Audit Committee, which facilitates close coordination between the two committees on cybersecurity, data privacy and information technology matters.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: As of February 21, 2025, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we have not been materially affected by known cybersecurity threats affecting the Company, we and our hotel managers continue to face risks from cybersecurity threats that, if realized, could materially adversely affect us in the future. For more information on the risks related to cybersecurity threats, including threats faced by our hotel managers, see Part I, Item 1A. "Risk Factors — We face the risk of material data breaches and disruptions of our managers' or our own information technology systems, or the information technology systems of third parties on which we or our managers rely, which could materially adversely affect our business and results."

companyName: HOST HOTELS & RESORTS L.P.


text: Our internal professionals collaborate with external subject matter specialists, as necessary. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy our security standards. We periodically review our third-party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and/or threats from such engagements.

companyName: Optex Systems Holdings Inc

ticker: OPXS


text: All employees of the Company have ownership in managing cybersecurity and data privacy risks, however, oversight responsibility is shared by our BOD, Audit Committee, and cybersecurity management team. The Audit Committee is responsible for implementing our cybersecurity policies and provides regularly updates to the BOD Our cybersecurity management team, in conjunction with our third-party chief information security officer ("CISO"), conduct regular assessment and management of material risks from cybersecurity threats, including review with our internal cybersecurity management team. All employees and consultants are directed to report to our cybersecurity management team any irregular or suspicious activity that could indicate a cybersecurity threat or incident.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: The Company's DIS joined the Company in 2023 and has over 20 years of experience in information technology and cybersecurity. The DIS has held senior management positions in information security for the past ten years. The DIS holds several industry certifications including Certified Information Systems Security Professional ("CISSP"), Certified Information Systems Auditor ("CISA"), Certified in Risk and Management Systems Controls ("CRISC") and Certified Data Privacy Solutions Engineer ("CDPSE").

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk program and practices, including cybersecurity risks, with members of senior leadership and management. In turn, the audit committee periodically reports on its review to the full board of directors.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO), who reports to our Head of Enterprise Risk Management and receives input and support from our Head of Enterprise Risk Management and our Chief Technology and Transformation Officer. Our CISO has extensive experience leading and managing cybersecurity programs and in cybersecurity risk management. Our CISO has served in this position since 2014 and, before Genpact, was previously CISO at another US-listed public company. Our CISO is supported by our information security team, many of whom hold cybersecurity certifications and who collectively possess relevant experience in different areas of cybersecurity.

companyName: Genpact LTD

ticker: G


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are likely to materially affect the Company, including its business strategy, results of operations, or financial condition; however, as further discussed in Item 1A, Risk Factors, if we are unable to protect our information systems against service interruption, misappropriation of data, breaches of security, or other cyber-related attacks, our operations could be disrupted, we may suffer financial losses and our reputation may be damaged.

companyName: Burlington Stores, Inc.

ticker: BURL


text: The Company's cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CIO and the Senior Director of IT. The CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: As discussed above, our cybersecurity governance structure is integrated into several facets of us, which include: • Board of Directors: The Board has ultimate oversight responsibility for cybersecurity. The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. • Audit Committee: The Audit Committee is responsible for monitoring the effectiveness of our information system controls and security, including a periodic review of our cybersecurity and other information technology risks, controls, initiatives and action plans. • Chief Information Security Officer (CISO): Casey O'Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program. Casey has had a distinguished career holding IT management positions since 2015 and has been employed in the cybersecurity field since 2001. Casey holds a Bachelor of Science in Information Technology from Penn State University. • Information Security Governance: The Information Security Governance team is comprised of our senior executives and oversees the development and implementation of the cybersecurity strategy. • Cybersecurity Risk Management Team: The Cybersecurity Risk Management Team is responsible for identifying, assessing, and mitigating cybersecurity risks. • Incident Response Team: The Incident Response Team is responsible for responding to and recovering from cyberattacks.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our cybersecurity risks.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: We routinely conduct penetration testing across our various environments and networks, including our Restaurant Support Center, our restaurants and our cloud-based architecture and systems. We review penetration testing outcomes and take steps to address any meaningful findings, while documenting resolution steps these efforts.

companyName: Portillo's Inc.

ticker: PTLO


text: We use a third-party vendor to provide a suite of services to assess, identify, and manage material risks from cybersecurity threats. These services include providing us with a secure email platform, including content examination and data leak prevention; system monitoring and support, including patch management, anti-virus and threat hunting services; and system backup and recovery services. As we expand our business operations, we plan to evaluate the development of enhanced processes that will allow for the identification and assessment of cybersecurity risk that will be integrated into an overall risk management system, which will be managed by senior management and overseen by the Board of Directors. As part of these developments, we plan to identify and address cybersecurity risks related to our business, privacy and compliance issues through a multi-faceted approach that is expected to include third-party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with these planned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things, will consider: conducting proactive privacy and cybersecurity reviews of systems and applications, audits of applicable data policies, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security, and implementing appropriate changes.

companyName: LIBERTY STAR URANIUM & METALS CORP.

ticker: LBSR


text: Strategy and Governance The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the ETH Custodian and Additional ETH Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices. The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.

companyName: VanEck Ethereum ETF

ticker: ETHV


text: Our Board of Directors executes its cybersecurity risk oversight function as a whole and by delegating responsibility to the Technology and Cybersecurity Committee of our Board of Directors, which oversees our management of risks relating to information technology security and our cybersecurity policies, controls and procedures. The Audit and Finance Committee of our Board of Directors oversees our enterprise risk management program as a whole and risk management regarding major financial risk exposure, including the potential financial impact of cybersecurity incidents. The Technology and Cybersecurity Committee receives quarterly presentations and reports on cybersecurity and information security risks from management, including our Executive Vice President and Chief Information Officer ("CIO") and Vice President, Chief Information Security Officer ("CISO"). These presentations and reports address a broad range of topics, including progress of security initiatives, strategy, key performance indicators, cybersecurity risks, and notable cybersecurity incidents. In addition, the Technology and Cybersecurity Committee and the Board of Directors receive briefings from time to time from outside experts for an independent view on cybersecurity risks and emerging cybersecurity threats, including best practices and current trends in cybersecurity.

companyName: Performance Food Group Co

ticker: PFGC


text: We maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate guidance from NIST CSF and other industry best practices. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. Our employees receive a formal cybersecurity awareness training on an annual basis, including specific topics related to social engineering and email frauds.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risks from cybersecurity threats, however, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our liquidity, results of operations and financial condition, as well as damage our reputation. For additional information related to risks from cybersecurity threats, please refer to Item 1.A. — "Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our members, providers, or other third parties, could damage our reputation and brands, and substantially harm our business and results of operations."

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: Board of Directors The Audit Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. This includes the responsibility for reviewing and discussing with management and the Board of Directors our information technology use and protection, including, but not limited to, data governance, privacy, IT risks, compliance, cybersecurity and significant legislative and regulatory developments that could materially impact us, as well as the evaluation with management of the implementation and effectiveness of our controls to monitor and mitigate these risks and the oversight for any investigations related to specific cybersecurity or technology incidents. To fulfill this responsibility, the Audit Committee receives regular reports about cybersecurity risks from our CISO, and receives updates more often as needed, including in the event of a significant cybersecurity incident in accordance with our Cybersecurity Incident Response Plan. These regular reports periodically include information regarding the implementation and administration of the registrants cybersecurity processes, cybersecurity governance processes, status of projects relating to cybersecurity, cybersecurity matters relating to any particular products or services, summaries of any material cybersecurity threats or incidents and responses thereto, regulatory updates, updates on cybersecurity trends and the results of any assessments performed by internal stakeholders or third-party advisors.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: As of the date of this Report, we are not aware of any cybersecurity incidents, or a series of related incidents, that have had or are reasonably likely to have a material impact on the Company's results of operations or financial condition. For more information on our cybersecurity related risks, see Part 1, Item 1A. Risk Factors included elsewhere in this Report.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Our management team, including, our Chief Information Security Officer, Chief Privacy Officer, General Counsel, Director of Information Security & IT Compliance, Corporate Treasurer, and Internal Audit Senior Director, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes a wealth of expertise in navigating the complex landscape of cybersecurity, with a robust background in cyber risk management and incident response. With a collective experience that spans several decades, our team has successfully addressed and mitigated diverse cyber threats, ranging from sophisticated attacks to emerging vulnerabilities. Members of our management team hold industry-recognized certifications, including but not limited to CISSP, CISA, and CEH, underscoring their commitment to continuous professional development and adherence to the highest standards in the field.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A. "Risk Factors", including "If we experience significant disruptions in our information technology systems, our business, results of operations, and financial condition could be adversely affected".

companyName: SI-BONE, Inc.

ticker: SIBN


text: Nisha Patel, Director of Quality & Regulatory Affairs, whose expertise in regulatory compliance ensures that our cybersecurity policies meet the required standards.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Due to the increasing risk of third and fourth-party business relationships, we implemented a Third-Party Risk Management ("TPRM") Program to evaluate and monitor our network of external partners, vendors, suppliers, and service providers. Capabilities of our TPRM program include continuous monitoring of third parties, secure vendor remote access, and security architecture to protect against cyber threats introduced through other business-to-business ("B2B") system integrations. In addition to above, we have implemented and maintained the following cybersecurity measures as part of our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K): • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity Incident Response Plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Tabletop Exercises - periodic internal and vendor-led tabletop exercises to assess the effectiveness, relevance, and completeness of the Incident Response Plan and Business Resilience Plans; • Assessments - annual cybersecurity assessments, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel during onboarding and periodically throughout the year that highlights critical organizational risks through quarterly phishing simulation campaigns, "lunch and learns", monthly communication updates, and relevant cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments – review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes.

companyName: Enpro Inc.

ticker: NPO


text: Protection Systems Weatherford has made significant investments in cyber protection systems, including by engaging third party service providers to actively search and monitor information systems for vulnerabilities through penetration testing and other means. In addition, we use a comprehensive suite of cybersecurity tools and software, aligned with government and industry best practices, including multi-factor authentication, complex passwords and advanced security controls, across all major Weatherford systems in an effort to strengthen defenses and prevent unauthorized access.

companyName: Weatherford International plc

ticker: WFRD


text: Oversight of cybersecurity matters rests with our sole officer and director, Levi Jacobson, who evaluates service providers, monitors for potential incidents, and would be responsible for coordinating any response. We do not currently employ dedicated cybersecurity personnel or maintain outside consultants on a continuing basis, though we may engage external advisors in the event of a material incident. As we currently have only one director, board-level oversight and management responsibilities are consolidated.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: cybersecurity risk management program includes the following: multidisciplinary team comprised of personnel from information technology ("IT"), internal audit, accounting, and legal, as well as third-party cybersecurity experts principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents, and a third-party security operations center.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Our CIO, who reports to our Senior VP & Chief Financial Officer, oversees our cybersecurity function. The Cybersecurity Manager reports to the CIO, and the CIO and Cybersecurity Manager are responsible for assessing and managing risks from cybersecurity threats, as well as our overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response, and reporting on cybersecurity matters to the Board and executive management.

companyName: NPK International Inc.

ticker: NPKI


text: The Board has a standalone Cybersecurity Committee that is responsible for managing oversight of our cybersecurity-related investments, programs, plans, controls, and policies. The Cybersecurity Committee also provides feedback on cybersecurity-related matters, including, but not limited to, strategies, objectives, capabilities, initiatives, and policies. The Cybersecurity Committee meets during the year with the CISO and other members of our executive leadership team. In between meetings, the CISO periodically provides the Cybersecurity Committee with a written report on cybersecurity matters.

companyName: Dynatrace, Inc.

ticker: DT


text: Our Chief Information Security Officer ("CISO") leads our worldwide efforts in cybersecurity risk reduction and regulatory compliance. Our CISO oversees risk management across information technology operations, cybersecurity and data privacy. With over 20 years of experience across various industries, including Fortune 50 and 100 organizations, our CISO brings a comprehensive background in strategic cybersecurity leadership and risk management. This expertise is further supported by an array of certifications (C-CISO, CISSP, CISM, CRISC, CISA, and CIPT), as well as academic credentials, including a Master's in Information Systems from Harvard University and a Bachelor's in Business Administration from Florida International University. Our CISO regularly updates executive management and actively engages within the cybersecurity community to stay informed on the latest industry developments.

companyName: CARNIVAL PLC

ticker: CUK


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: The Company's information and data systems have been subject to cybersecurity incidents in the past, including the publicly disclosed September 2023 Cybersecurity Issue. We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, there is no guaranty that the Cybersecurity Issue and any further incidents will not have a material impact in the future. See "Cybersecurity litigation, claims, and investigations" in Part II, Item 8, Note 12 to the accompanying consolidated financial statements. Further, policies and procedures designed to manage cyber risks, including those described herein, may not be effective. To learn more about risks from cybersecurity threats, see "Item 1A. Risk Factors - The failure to maintain the integrity of our information and other systems or customer information can result in damage to our reputation, subject us to fines, payment of damages, lawsuits and restrictions on our use of data, and have a material adverse effect on our business, financial condition, and results of operations." Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect the Company's business, financial condition, or results of operations.

companyName: MGM Resorts International

ticker: MGM


text: We review our cybersecurity risk framework and related policies annually with our senior management to help identify areas for continued focus and improvement. We also engage third parties to review and assess our processes annually.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: Lastly, Lord Abbett maintains cyber insurance coverage to protect against material cybersecurity incidents and liability that arises out of the unauthorized use or access to electronic data or software within the firm's network or business. Types of incidents covered include data leakage, ransomware, computer theft, spreading a virus or malicious code, and electronic crime. The insurance policy and related coverages are reviewed and renewed on an annual basis.

companyName: Lord Abbett Private Credit Fund


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.

companyName: BTC Digital Ltd.

ticker: BTCT


text: The Board of Directors has delegated oversight of the Company's cybersecurity program to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee is responsible for reviewing reports on data management and security initiatives and significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A, Risk Factors, for a discussion of cybersecurity risks.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: There have been no events in at least the last thirty-two years that have been considered material enough to warrant changes to systems, processes or controls.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: Our processes and cybersecurity plans are part of our overall emergency response plans, and we conduct simulated exercise drills, including with multiple U.S. government agencies and peer companies, to enhance our preparedness and provide for continual process improvement.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our cybersecurity team is led by our Director of IT Infrastructure & Chief Information Security Officer (CISO), who has over 20 years of experience and obtained various professional security certifications and advanced training in the field of cybersecurity and technology and reports to our CIO. Our CISO is responsible for managing and supervising our cyber risk management program and informing the CIO and senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: TIDEWATER INC

ticker: TDW


text: Our executive management team is responsible for the development of our policies and procedures relating to our risk management, including cybersecurity risks. Our board of directors has ultimate oversight of our risk management processes, including any cybersecurity-related risk and activities.

companyName: Atlas Lithium Corp

ticker: ATLX


text: To protect our data and systems against cybersecurity threats, our cybersecurity risk management program is designed to assess, identify, manage and mitigate cybersecurity threats that could adversely and materially affect our business. Our cybersecurity risk management program is aligned with our business strategy and integrated throughout our operations. Our cybersecurity risk management program is comprised of technical and administrative controls, processes, policies and procedures based on applicable laws and industry standards and guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: The Company has also established a governance structure and organization to manage cybersecurity risk. This includes escalation and reporting of cybersecurity incidents through the Chief Risk Officer's organization to an Executive Response Team and the Board, and periodic reporting on the Information Security Program to the Information Cyber Security Subcommittee of the Enterprise Risk Management Committee, an executive committee that oversees the Information Security Program, and the Enterprise Risk Oversight Committee (the "EROC"), the Board committee that oversees the ERM framework.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually and receive reports on incidents that exceed certain thresholds and updates on responses thereto. The Information Security Committee is directly responsible for oversight of risks related to cybersecurity. The Board receives reports on information security and cybersecurity from the Information Security Committee at least four times a year.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: As a clinical stage biotechnology company, we must also comply with extensive regulations, including requirements imposed by the U.S. Food and Drug Administration related to adequately safeguarding patient information. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet SEC disclosure requirements. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: The Company has in place a cybersecurity incident response plan. Procedures for addressing cybersecurity incidents include reporting incidents up to senior management, including the Company's legal department for analysis. If a cybersecurity incident were determined to be material, the Company's disclosure committee would address appropriate public disclosures. As noted above, management regularly reports to the Audit Committee regarding the current cyber threat environment and the controls and procedures meant to address such risks. If a cybersecurity incident were determined to be material, the Audit Committee would be informed promptly.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: These programs establish policies (including vendor management), procedures, risk assessments, systems, monitoring, reporting, strategies, and training to effectively manage cybersecurity risks. Specifically, the Company deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. The Company also performs simulations and drills to further ensure our readiness and preparedness for potential threats. In addition, the Company employs a nationally recognized firm with information security experts to annually perform audits that extensively test our program and controls, which are reviewed by the Board Audit Committee. These programs and controls align with Federal Financial Institutions Examination Council guidelines and standards.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: Our system of internal controls includes consideration of cybersecurity risks. We use technology and control procedures designed to mitigate cybersecurity risks, with our management team working to monitor, identify, assess, and respond to potential cybersecurity incidents that may threaten the Company. The system of controls also focuses on security awareness and training for employees with access to Company systems. Company management periodically reviews system and organization control reports (SOC 1, Type 2) for key outsourced information systems to ensure that third-party data processing is subject to appropriate controls and security measures. have engaged with a third-party information technology firm to assess our vulnerabilities and help us mitigate cybersecurity-related risks.

companyName: U.S. GOLD CORP.

ticker: USAU


text: Our third party management policy is designed to assess and mitigate potential risk posed by vendors and outside service providers. An initial risk assessment is performed to evaluate multiple aspects of a relationship such as impact to cybersecurity, access to our systems and data, and criticality of the relationship to our day-to-day operations. The program defines oversight requirements based on the results of the risk assessment. Critical vendors and service providers are reviewed annually and as otherwise as may be needed.

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: The Audit Committee receives quarterly or more frequent as appropriate, briefings from the Company's senior management and CISO. The briefings concern, among other topics, the cyber threat landscape and associated risks to the Company, updates to the Company's cybersecurity program and associated policies, its ongoing strategy to prevent, identify and react to security incidents, internal and external vulnerability assessments, penetration testing results, and Internal Audit's periodic reviews of MBIA's security controls, policies, and procedures. The CIRT is comprised of senior leaders from across the company, which include Legal, Compliance, Investor/Media Relations, and Information Technology.

companyName: MBIA INC

ticker: MBI


text: through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; maintain and follow an internal information security and incident response program;

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: As of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: In the event of a material cybersecurity incident, the cybersecurity risk supervisory divisions are to immediately report it to Honda's Risk Management Officer through the Risk Management Committee. Upon receiving the report, a Global Emergency Headquarters will be established, which coordinate with relevant organizations affected by the incident in order to prevent and contain the crisis. Such response status is reported to Honda's Board of Directors and the Executive Council as necessary based on the judgment of the Risk Management Officer.

companyName: AMERICAN HONDA FINANCE CORP


text: The Cyber SteCo oversees activities related to the monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, and periodic assessments of third-party service providers to assess the cyber preparedness of key vendors. To enhance our threat preparedness, we perform monthly vulnerability scans, annual penetration testing with a third party, and annual disaster recovery and cyber response drills, including third-party-facilitated drills. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a third party operated security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. As noted above, our Cyber SteCo also has implemented comprehensive incident response plans that define the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cyber SteCo escalates events, including to the Chief Executive Officer and Board of Directors, as deemed necessary.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: The Board of Directors has been designated to oversee cybersecurity risk management. Its members possess diverse expertise, which enables them to effectively evaluate the adequacy of our cybersecurity measures and challenge management's approach when necessary. The chief technology officer provides regular updates to our chief executive officer and Board of Directors on cybersecurity risks, ongoing initiatives, incidents, response activities and strategies. The Board of Directors acknowledges cybersecurity as a strategic risk and a priority for the Company. The Board of Directors is actively involved in the oversight of our cybersecurity risk management efforts, ensuring alignment with our overall business objectives.

companyName: ARBOR REALTY TRUST INC

ticker: ABR


text: Our Chief Information Security Officer ("CISO") is responsible for the development and implementation of our information security program on a Company-wide basis, together with a dedicated team of experienced, Company-wide information security analysts. Our CISO has over twenty-five years of experience leading the development, implementation and oversight of information security programs and members of the information security team have relevant certifications, educational and industry experience.

companyName: IAC Inc.

ticker: IAC


text: The Executive IT Council is comprised of the CEO, CFO, Chief information Officer ("CIO"), CISO, and all heads of business units that serve together to manage and oversee the Company's IT program as a whole. As part of this function and at the direction of the CISO, the Executive IT Council is charged with approving and providing oversight of the IT solutions that enhance the Company's security posture. As more fully described in "Governance" below, the CISO and CIO regularly report the Executive IT Council's findings to the Audit and Risk Committee of the Board, and to the full Board, in an effort to provide a collaborative and multi-point cybersecurity program.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: The Company uses third-party cybersecurity professionals provided in conjunction with its cybersecurity insurance to review and assess the Company's cybersecurity controls and procedures.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: Our board of directors and executive leadership approves cyber security strategies, initiatives, and investments to ensure alignment with business objectives and risk tolerance.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs, including: • Implementing a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner; • Deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • Establishing and maintaining comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis; and • Providing regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: As of the date of this report, we have not experienced any material cyber breaches and are periodically reviewing our policies and procedures to respond to, and mitigate the impact of, emerging trends and technologies affecting our industry.

companyName: Urban Edge Properties

ticker: UE


text: Xcel Energy employs a comprehensive risk based approach to assess the magnitude and significance of a vendor's risk to Xcel Energy. Certain third-party service providers are subject to vendor security risk assessments at the time of integration, contract execution/renewal, and upon detection of any increase in risk profile. Xcel Energy uses a variety of inputs in such risk assessments, including information supplied by providers and third parties (including information analysis centers that share daily threat intelligence and improve organizational agility associated with management of cybersecurity risks). In addition, Xcel Energy requires certain third-party service providers to meet appropriate security requirements, controls and responsibilities. Xcel Energy deploys periodic monitoring activities to assess compliance with our cybersecurity control framework and investigates security incidents that have impacted our third-party service providers as appropriate.

companyName: NORTHERN STATES POWER CO /WI/


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: FARO TECHNOLOGIES INC


text: Our Response Plan sets forth our response protocol for cybersecurity threats and cybersecurity events and incidents and is maintained by our cybersecurity incident response team, or CSIRT, which reviews the Response Plan on at least an annual basis. The CSIRT is comprised of IT department leaders, under the supervision of our Vice President, Chief Accounting Officer, who reports to our Senior Vice President, Chief Operating Officer and Chief Financial Officer, as well as members of our executive team and other senior management. Our Response Plan is designed to provide a framework for how we identify, evaluate, escalate, respond and recover in the event of a data security breach and designates personnel who are responsible for these functions. Our IT team, utilizing the support of external vendors and software products, evaluates security alerts received from various sources, and any alert or threat that the CSIRT identifies as a cybersecurity incident is promptly evaluated and escalated in accordance with the Response Plan for further assessment. Upon confirmation that a cybersecurity incident has occurred, our CSIRT will establish an incident response team, which may include representatives from our internal departments, as well as internal or external legal counsel or other external cybersecurity consultants or service providers. The CSIRT aims to develop a coordinated response strategy, including with respect to risk containment, notification processes, system restoration, incident documentation and assessment, data preservation and forensic analysis.

companyName: Mersana Therapeutics, Inc.


text: To protect this information, our existing cybersecurity policies require continuous monitoring, network security measures, and encryption of data. We maintain various protections designed to safeguard against cyberattacks, including firewalls, key-based authentication, and virtual private networks. We protect against business interruption by backing up our major systems.

companyName: NYIAX, INC.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, of the date of this Report, we do no t believe that any risks from cybersecurity threats, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information technology consultants work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: Our director of information security provides regular reporting (at least quarterly) to the Risk Committee and Technology Committee of our board of directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there is an ongoing cybersecurity incident. Our board of directors oversees our information security program through regular review of policies and principles, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets, including data.

companyName: Federal Home Loan Bank of Boston


text: Under the supervision of our chief technology officer, we conduct assessments of our IT systems and networks to identify potential vulnerabilities and threats to our systems and assets. Based on these assessments, we prioritize and allocate resources to mitigate cyber risks and reduce exposure.

companyName: GSE SYSTEMS INC


text: Cybersecurity risk management is an important and rapidly evolving part of our overall risk management efforts. We believe we are a particularly attractive target as a result of the types and volume of personal data and content on our systems and the evolving nature of our products and services. Our products and services reach millions of users and involve the collection, storage, processing, and transmission of large amounts of data. In addition, our business and operations span numerous geographies around the world, involve hundreds of employees, contractors, vendors, developers, partners, and other third parties, and rely on software and hardware that is highly technical and complex. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.

companyName: Bumble Inc.

ticker: BMBL


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from management on our cyber risk management program.

companyName: 2U, LLC


text: The Company and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our systems, train our employees and generally advise on cybersecurity processes. At least annually, our information technology team make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and employees, and the latest threats that have emerged, including a presentation from the third-party security firm.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: The Company takes a risk-based approach to cybersecurity and has implemented policies that are designed to address cybersecurity threats and incidents, including those related to third-party service providers. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity standards, processes and practices, as part of the Company's overall risk management system. The Company also leverages external resources and advisors as needed to reinforce its cybersecurity capacity. External consultants perform testing exercises to further assess the Company's cybersecurity program on an annual basis, or more frequently if circumstances warrant such testing.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: We have engaged in a tabletop exercise with a nationally recognized third party to test our readiness in respect to certain of the preceding events and risks. When risks or threats are identified to the Company by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Our CIO oversees a team of cybersecurity professionals in the cyber security operations center with certifications in cybersecurity engineering and cybersecurity operational areas. We also utilize internal audits to periodically assess the effectiveness of our cybersecurity processes and external parties to periodically conduct threat and vulnerability assessments. We continue to invest in training for all employees, including training for our cybersecurity professionals on the specific technologies utilized within the company and development of these individuals to keep their knowledge current. Additionally, we have a vendor risk management program to review and assess cybersecurity risks related to utilizing information technology vendor products and services for new and existing vendors that is subject to ongoing monitoring.

companyName: ITC Holdings Corp.


text: Our VP of InfoSec and CTO regularly report directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues. In addition, we have an escalation process in place to inform senior management and the Board of material issues.

companyName: Groupon, Inc.

ticker: GRPN


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Technology and Information Security Officer ensures the coordinated and consistent implementation of risk management initiatives and strategies on a frequent basis with our Chief Operating Officer and Chief Financial Officer. Results of the information and cybersecurity efforts and recommendations are reported by the Chief Technology and Information Security Officer to the IT Steering Committee, Risk Management Committee and Board of Directors no less than quarterly. The Audit Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. Our management is directly involved in assessing and managing cybersecurity risks.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Board of Directors Oversight responsibilities for our cybersecurity and digital trust compliance programs and risks lie with the Audit Committee of our board of directors. Our board of directors have the ultimate oversight responsibilities of our cybersecurity program and all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, privacy, and technology.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Our board of directors has responsibility for the direction and oversight of our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: We describe the risks that cybersecurity threats, including as a result of any previous cybersecurity incidents, pose to us that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We may experience delays or outages in our information technology systems and computer networks. We may be subject to breaches of our information technology systems or other cybersecurity incidents, which could damage our reputation and consumer relationships. Failures in our information technology systems and the costs of increasing information security regulation could also subject us to significant financial, legal and operational consequences" included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. However, to our knowledge, we have not had any cybersecurity incidents in the past three years that have had a material adverse effect on our business, financial condition, results of operations, or cash flows.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: We have several physical, automated, and administrative controls in place to mitigate the success and extent of any cyber breaches. Our controls are designed to require review of tasks which may occur in the normal course of business but are also common vectors of attack. Automated controls are implemented in all cases where one is feasible, and in other cases standard procedures or documented instructions are in place to ensure that actions are proper and approved before they occur.

companyName: Mistras Group, Inc.

ticker: MG


text: Our team of IT professionals, which continuously monitors our IT environment for cybersecurity threats and incidents, routinely reports on cybersecurity incident prevention, detection, mitigation, and remediation efforts to our senior vice president, finance and accounting and chief compliance officer. Additionally, we have established policies addressing processes for responding to potential cybersecurity incidents, including assessment, communication, and remediation protocols. Our incident response processes further provide for the escalation of cybersecurity incidents to our executive management team and board of directors, as appropriate.

companyName: LeonaBio, Inc.

ticker: LONA


text: We design and assess our program based on industry standards to align closely with information security frameworks and guidelines. This does not imply that we meet or are in compliance with any particular technical standards, specifications, or requirements, only that we use the frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: Cybersecurity Program: CMS Energy's and Consumers' security function, led by the Executive Director of Security, is an integrated organization accountable for cyber and physical security and is subject to various state, federal, and industry cybersecurity, physical security, and privacy regulations. Their cybersecurity program is responsible for assessing, identifying, and managing risks from cybersecurity threats using industry frameworks, as well as best practices developed by government and industry partners. All employees and contractors are required to complete annual trainings on a variety of security-related topics. Additionally, the companies continuously upgrade technological investments designed to prevent, detect, and respond to attacks. The companies' electric, natural gas, and corporate systems each follow standards, controls, and requirements designed to maintain compliance with applicable regulations and standards, such as MPSC, NERC critical infrastructure protection, and payment card industry regulations. Technology projects and third-party service providers are reviewed for adherence to cybersecurity requirements.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: The cybersecurity program is overseen by the IT Senior Director and utilizes a risk-based methodology to support the confidentiality, integrity and availability of our digital assets. The cybersecurity program is supported at the highest level within the Company, formally reporting to the Audit Committee, a subcommittee of the Board of Directors, at least once every two quarters and more often if required.

companyName: Third Harmonic Bio, Inc.


text: Our customers' and partners' trust is crucial to our business; as such, a cybersecurity incident impacting the confidentiality, integrity, or availability of LiveRamp's systems or the data we process may have a significant impact on our strategy, operations, and financials. Direct impacts may include fees, penalties, or loss of customer revenue. While we do not believe our strategy, operations, and financials have been materially affected by risks from cybersecurity threats, we cannot provide assurances that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare, to respond and to recover from cybersecurity incidents. We have processes designed to triage, assess severity, investigate, escalate, contain and remediate an incident. We also have processes to comply with potentially applicable legal obligations and mitigate brand and reputational damage. As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: To manage the risk of a material impact on CRH's operations or financial performance due to a cybersecurity incident, CRH has implemented a mandatory Cybersecurity Incident Escalation Standard as part of its Company-wide Information Security Policy. This Standard, which is supported by relevant guidelines and procedural documentation, provides a structured approach adapted to the systems of each CRH operating subsidiary and business unit to manage the incident response process through a series of pre-defined phases, including triage, containment, eradication, recovery, and post-incident analysis.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Managing Material Risks and Integrated Overall Risk Management A focused team of technology professionals works throughout the year to assess and monitor all matters of risk related to cybersecurity. This team is managed by our Chief Information Security Officer ("CISO"), who oversees cybersecurity processes and controls. We deploy a robust combination of security technologies as technical safeguards throughout our network and utilize a defense-in-depth security methodology to protect, detect and react to threats to our systems and data. We conduct cybersecurity maturity and posture assessments twice annually and adjust our efforts to adapt to the evolving industry and threat landscape. Cybersecurity risks are also assessed as part of our Annual Enterprise Risk Assessment. Our risk management strategy includes multiple programs that manage cybersecurity risk, including the following: • Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to prevent, detect and respond to cyberattacks • Our Incident Response Program outlines how we process incidents and events from identification to completion with clear definitions on roles, classifications, materiality guidelines and additional processes to support response efforts according to the NIST CSF. • An information security training program that requires all company employees and contractors with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with year-round awareness testing and re-training as necessary • Regular and robust testing of our systems and processes to assess our cybersecurity posture and resilience, which includes internal and external penetration testing performed by third-party vendors and tabletop incident response exercises • Coordinated engagements with the Department of Homeland Security and Cyber & Infrastructure Security Agency to ensure alignment with industry and government standards and leverage access to agency resources • Cybersecurity insurance coverage to mitigate the risk of cybersecurity incidents and review of this coverage annually Results of all assessments, events and test results inform cybersecurity program direction and activities taken throughout the year.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: The Audit Committee of the Board of Directors has oversight of management's efforts with respect to IT systems and cybersecurity. As part of this oversight, the company's IT leadership meets on a quarterly basis with the Audit Committee and on an annual basis with the company's Board of Directors. During these update meetings, IT leadership provides the Audit Committee and Board of Directors updates regarding any changes around our cyber defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively encounter these threats.

companyName: Green Plains Inc.

ticker: GPRE


text: Our Cybersecurity Risk Committee, led by our Chief Financial Officer, receives input from third party cybersecurity risk advisors that bring decades of experience in designing, implementing, and managing cyber security risk programs. They are experts in the assessment, identification, and management of cybersecurity risk. Our Cybersecurity Risk Committee members meet and collaborate regularly with our information technology and operations teams, stay abreast of industry trends and relevant regulations, and regularly inform management of various cybersecurity risks, trends, threats, and countermeasure techniques.

companyName: Urgent.ly Inc.

ticker: ULY


text: We maintain an insider threat program designed to identify, assess, and address potential internal risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. As a government contractor, we must comply with extensive cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. Our policies and implemented controls reflect our adherence to these requirements.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: The Technology Committee of the Board of Directors oversees our use of technology in business strategy as well as the major risks arising from our technology, digital and data strategies, legacy information systems, technology investments, data privacy, operational performance, cybersecurity programs, and technology-related business continuity and disaster recovery programs. The Technology Committee, which includes directors with technology and cybersecurity experience, also oversees management's effort to mitigate these risks. Technology Committee meetings typically occur five times a year. Generally, at these meetings, our CSO briefs the committee on cybersecurity-related matters.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: We utilize a comprehensive, defense in depth approach to cybersecurity risk, which helps us to continually assess, identify and manage enterprise-wide material cybersecurity risks. Our cybersecurity risk management is integrated into our overall Enterprise Risk Management (ERM) process and is reviewed at least quarterly. Our cybersecurity strategy focuses on maintaining the confidentiality, integrity and availability of data. We leverage frameworks established by the National Institute of Standards and Technology and the Center for Information Security for our information and cybersecurity governance program. We have a comprehensive cybersecurity threat detection and monitoring program for our technology and network infrastructure, which leverages various systems, processes, and operational measures to monitor, detect, and respond to cyber incidents. Our cybersecurity processes, including our threat detection, monitoring, and response protocols are subject to ongoing vulnerability testing, and comparison to industry practices. An Incident Response and Disaster Recovery Plan is maintained and exercised. The plan includes a process to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. Resiliency and recoverability are paramount in the plan. This includes a clearly defined escalation process within the plan to ensure management and the Board of Directors are notified if an incident or series of events warrant escalation.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: The Board has delegated primary responsibility for oversight of our cybersecurity risk exposures to the Audit Committee of the Board, and the Audit Committee of the Board receives routine updates on cybersecurity matters from our Director of Information Technology and other members of management. Our Director of Information Technology leads our cybersecurity efforts and has 15 years of information technology experience. There are no management positions directly responsible for overseeing our cybersecurity risk. Rather, our Director of Information Technology and our broader information technology department work closely with members of management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Solid Power, Inc.

ticker: SLDP


text: Wintrust also recognizes that individual employees are frequent targets of threat actors. We regularly engage with employees on the importance of protecting the information and data of Wintrust, our customers and employees through monthly newsletters, posters and ad-hoc communications. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in monthly mock phishing campaigns. We also communicate with our customers about their role in enhancing cybersecurity.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • Conduct on boarding and cyber security training for all employees on an ongoing basis; • Conduct regular phishing email simulations for all employees; and • Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: We operate in the biopharmaceutical industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect information and prevent data loss and other security breaches, including a cybersecurity risk assessment program. Both management and the board of directors are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Pulmatrix, Inc.

ticker: PULM


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions, the responses to which are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.

companyName: FNB CORP/PA/

ticker: FNB


text: To manage third-party risks, the Company has a Third-Party Risk Management Policy and procedures in place. The process involves performing reviews of the cybersecurity controls of third-party vendors that have access to the Company's confidential or sensitive information, or those who may have access to the Company's systems. Since the process was established, key critical vendors who may have material impact on the Company's confidentiality, integrity or availability of data were prioritized and reviews were completed. The review of other relevant third-party vendors upon onboarding began in January 2024.

companyName: Drilling Tools International Corp

ticker: DTI


text: We have developed and implemented cybersecurity processes to assess, identify and manage material risks from cybersecurity threats. These processes are based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and are designed to protect the integrity and security of our information systems. Our cybersecurity processes are a part of our risk management system, sharing governance processes and reporting structures with other components of our enterprise- wide system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, we activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we have, and may in the future, engage third-party cybersecurity consultants to assist with our cyber incident procedure.

companyName: KEY TRONIC CORP

ticker: KTCC


text: Our use of information systems for collecting, using, transmitting and storing data is a vital aspect of our business operations. Information systems are inherently vulnerable to a range of cybersecurity threats that could potentially have a material impact on our strategy, financial condition, liquidity or results of operations.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: The Company engages third-party service providers to aid in monitoring and safeguarding critical assets from cybersecurity attacks. Through these partnerships, the Company leverages specialized knowledge, insights, and practices to enhance the effectiveness of its cybersecurity strategies. Key third-party services include 24/7 active and passive monitoring and mitigation of the Company's network, endpoints, and data. Additionally, the Company has contractual obligations in place with third-party service providers to adhere to specific information security standards and to promptly notify and collaborate with management in the event of qualifying cybersecurity incidents.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: We are a pre-clinical-stage biopharmaceutical company, focused on developing novel and proprietary drug delivery systems across various pain indications and treatments for CNS disorders.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: Our cybersecurity risk management and strategy processes are jointly led by our embedded software engineer and Chief Executive Officer, in conjunction with a third-party consultant we have engaged to assist with cybersecurity risks assessment and monitoring. Our embedded software engineer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan. Together with the General Counsel, Chief Executive Officer and outside consultant that comprise our cybersecurity management team, we collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks. Our embedded software engineer possesses significant information systems experience.

companyName: TECOGEN INC.

ticker: TGEN


text: The Information Technology ("IT") Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (the "CIO") who reports directly to the Company's Chief Operating Officer and Chief Financial Officer. The CIO has more than 37 years of relevant experience both with the Company and with other organizations in the IT field. The CIO also oversees the Company's Information Security Program and manages a third-party consultant that is an expert in the Information Security field and acts as our Information Security Officer ("ISO"). The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology and Information Security Committee ("IT/IS Committee"), and presents information security and cybersecurity updates on a monthly basis to the IT/IS Committee and periodically to the Board of Directors.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: The DISH TV, SLING TV and Retail Wireless services, along with our wireless and data networks remained operational at all times during the incident. As of March 31, 2023, all significant systems had been restored. We have no reason to believe that this cybersecurity incident has not been concluded.

companyName: EchoStar CORP

ticker: SATS


text: Our Board of Directors, in coordination with each of our Board Committees, is responsible for oversight of our enterprise risk management activities. The Nominating and Governance committee receives an update on the Company's risk management process at least annually, including interaction of cybersecurity with our overall risks. The Board of Directors oversees risks from cybersecurity threats through report out from the Audit Committee, which monitors cybersecurity incidents and management's response to such incidents.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Our board of directors holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity. The board's oversight of cybersecurity risk management is supported by the Audit Committee, which has responsibility for discussing with management significant cybersecurity risks and the measures we have implemented to monitor and control such cyber risk exposures. The Audit Committee receives quarterly updates from our Vice President, Information Technology ("IT Officer") relating to IT and cybersecurity matters, including cybersecurity risks and threats. The Audit Committee provides periodic updates to our board of directors on cybersecurity matters discussed at such meetings. Our IT Officer also provides these and similar reports to the full board of directors on a biannual basis.

companyName: TELA Bio, Inc.

ticker: TELA


text: Our board of directors is ultimately responsible for the oversight of risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. J.P. Morgan's Cybersecurity Team provides our audit committee with updates, at least semi-annually, concerning cybersecurity risk matters. These updates generally include information regarding cybersecurity and technology developments, J.P. Morgan's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Adviser's and J.P. Morgan's efforts to address those incidents.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: There are regular tests to ensure readiness. Since security is an ever-changing and evolving platform, we aim to continuously grow our methods to ensure we continue to excel in securing our systems.

companyName: Crown Equity Holdings, Inc.

ticker: CRWE


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee’s cyber risk management program.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: Management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including reporting to the audit committee for certain cybersecurity incidents. Our management team also evaluates the potential impact of cybersecurity incidents to determine materiality. This evaluation considers factors such as the nature and scope of the incident, and its effects on operations, assets, or reputation. The audit committee holds quarterly meetings and receives periodic reports from management, including our Chief Operating Officer and third-party information technology expert, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: VP of Information Security is responsible for hiring appropriate personnel, performing vendor risk assessments, and communicating information security priorities to relevant personnel, so that we can build cybersecurity risk considerations into our business practices. The VP of Information Security also plans related budgets, designs cybersecurity processes, and reviews security assessments and related reports.

companyName: OptimizeRx Corp

ticker: OPRX


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Chief Financial Officer. This team is at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach includes regular updates from our external security expert, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International's Professional Practices. Our program includes multiple components that act as an additional line of defense—among them are regular functional recovery and tabletop exercises; cybersecurity exercises; protected backups for critical data; recovery time objectives; and recovery point objectives including achievability metrics, application criticality tiering, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: The Company regularly assesses industry best practices, frameworks, and standards, and leverages them to advance its cybersecurity risk management maturity. These frameworks include the International Society of Automation and the International Electrotechnical Commission standards for industrial automation, as well as the National Institute of Standards and Technology.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Any potential cybersecurity incident discovered is promptly reported to the Chief Executive Officer and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.

companyName: CRAWFORD UNITED Corp


text: The Company has also adopted a cyber-incident response plan which provides for controls and procedures in connection with cybersecurity events, including escalation procedures summarized below. The cyber-incident response plan is designed to address non-operational and operational cybersecurity events. Evaluation and response to cybersecurity events is led by our Cybersecurity Incident Response Team ("CIRT"), under the direction of our CISO. The CIRT is comprised of subject matter experts representing Information Security, Information Technology, Operational Technology, and Legal. The CIRT performs an impact assessment with respect to cybersecurity incidents, gathers facts and provides a chronology of events in connection therewith, and leads remediation and recovery activities. Our General Counsel, Senior Vice President of Human Resources, Chief Ethics and Compliance Officer (or their respective designees), and CISO review and assess significant non-operational data breaches. Cybersecurity events that meet specified criteria for operational impact are escalated for further review to our Business Continuity Incident Command Team ("Incident Command Team"). The Incident Command Team performs an initial assessment that includes evaluation of the cybersecurity event's severity, response required, and estimated business cost, and leads the execution of business continuity plans to maintain Company operations. Cybersecurity events meeting certain criteria are escalated to our Disclosure Committee, General Counsel and Chief Financial Officer for further review. The Disclosure Committee, General Counsel and Chief Financial Officer assess and determine materiality using the facts and chronology of events provided by the Incident Command Team.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Our Information Security Incident Response Plan (Response Plan) sets forth our response protocol for cybersecurity threats and cybersecurity incidents and is maintained by the Information Security Governance Committee (InfoSec Committee), which reviews the Response Plan on an annual basis. The InfoSec Committee is comprised of IT department leaders and members of our senior management team and is a subcommittee of our Ethics Committee, which provides reports to the Risk Committee of our Board of Directors. Our Response Plan is designed to provide a framework for how we identify, escalate and respond in the event of a data security breach and designates personnel who are responsible for these functions. Our Security Ops Team evaluates security alerts received from various sources, and any alert or threat that the Security Ops Team identifies as a cybersecurity incident (such as a data security breach) is promptly escalated to the InfoSec Committee for further assessment. Upon confirmation that a cybersecurity incident has occurred, our InfoSec Committee will establish an incident response team, which may include representatives from our internal departments, as well as outside legal counsel or other external cybersecurity consultants or service providers. The Incident Response Team aims to develop a coordinated response strategy, entailing risk containment, notification processes, system restoration, incident documentation and assessment, data preservation and forensic analysis.

companyName: EXELIXIS, INC.

ticker: EXEL


text: Executive Management is responsible for the sponsorship and support of the risk management plan and processes, participating in the risk management meetings, and reviewing and approving risk assessments and risk mitigation plans.

companyName: CXApp Inc.

ticker: CXAI