text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: OLENOX INDUSTRIES INC.

ticker: OLOX


text: Third parties with which the Bank does business, that facilitate the Bank's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.

companyName: RBB Bancorp

ticker: RBB

secItem: Item 1C


text: The Company's cybersecurity framework includes an assessment of the Company's hardware, software, and data platforms across its lines of business, as well as the risks associated with the Company's business, identification of areas inside and outside of the Company that expose it to cybersecurity threats, and employing policies, systems and safeguards to manage those cybersecurity risks. The Company's CISO is responsible for identifying systems and security measures that reflect the appropriate safeguards designed to protect the Company's infrastructure and information and has implemented the majority of current cybersecurity controls in place with an emphasis on the confidentiality, integrity and availability (CIA) triad and a defense in depth methodology. The CISO uses a variety of threat intelligence resources, including law enforcement and industry groups such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), to help stay informed about current and emerging risks to the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Incident Management As of the date of this Annual Report on Form 10-K, there are no known security threats or incidents that are likely to materially affect our business strategy, operations, or financial condition. We maintain robust incident management processes to swiftly address any security incidents that may arise, mitigating their impact and preserving the integrity of our operations.

companyName: CONNS INC


text: Our processes also address oversight and identification of cybersecurity threat risks from our use of third-party service providers, including those in our supply chain. This involves, among other things, conducting pre-engagement risk-based diligence and ongoing monitoring as needed. We also engage third-party service providers from time to time to assist in risk assessment and implementation of monitoring tools, and we review our cybersecurity controls with auditors.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: We have implemented policies and practices to manage cybersecurity risks arising from our use of third-party service providers. For example, in general, we contractually require our third-party service providers to maintain cybersecurity controls to protect our confidential information, to share information with our company about their information security programs and to inform us of any security incidents on their systems that could impact our operations or confidential information. Although we rely on our third party service providers to implement security programs commensurate with their risk, we cannot ensure in all circumstances that their efforts will be successful.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: All employees receive cybersecurity training upon hire with at least annual training thereafter with job-specific topic considerations. Our Information Security team, consisting of the VP of Information Technology, Sr. Manager of Network Security and IT Security Manager, among others, engage third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring for cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems through testing and threat intelligence awareness. The employees within our Information Security team and broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Internal Controls, Audit and Testing Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of key controls, systems and procedures. In addition, independent third party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually. Management determines the scope and objectives of the penetration analysis.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: On the management side, our ERM committee oversees the firm's risk management process, which includes oversight of cybersecurity. Our CTO is a member of this committee, along with other of the most senior professionals at the firm, including our chief operating officer who is also our chief risk officer. Our CTO updates the ERM committee on cybersecurity matters on a quarterly and as-needed basis.

companyName: Hamilton Lane INC

ticker: HLNE


text: To date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.

companyName: Hypha Labs, Inc.

ticker: FUNI


text: Dow has processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Corporation. These processes are part of Dow's overall enterprise risk management process and have been embedded in Dow's operating procedures, internal controls and information systems.

companyName: UNION CARBIDE CORP /NEW/


text: Our management, represented by our Director of IT, Marcus O. Pegues, and our Senior Vice President of Finance and Chief Accounting Officer, Robert D. Velasquez, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: TEJON RANCH CO

ticker: TRC


text: The Information Technology Committee of our board of directors has primary responsibility for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Information Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity risks and incidents. The Technology Committee also reviews our cyber security risk profile on a quarterly basis. The Information Technology Committee, as well as the full board of directors, reviews and approves our information security and technology budgets and strategies annually. The Information Technology Committee provides a report of their activities to the full board of directors on a quarterly basis.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: The team is responsible for the following: • Implementing Enterprise-wide cybersecurity strategy • Developing and enforcing Cybersecurity Policy • Developing and enforcing Cybersecurity Standards • Approving and reviewing Cybersecurity Architecture • Developing and enforcing Cybersecurity Processes • Developing and testing Cybersecurity Incident response • Performing other Cybersecurity operational activities including but not limited to: Vulnerability management strategy Network security configurations Risk Management and oversight of third parties

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our CTO Leverages more than 20 years of technology experience in the healthcare and financial services industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing within highly regulated global environments. He has managed technology compliance under the regulatory governance of frameworks such as HIPAA, GDPR, FDA, CCPA and TJC Hospital Accreditation. Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CTO leads management's assessment and management of cybersecurity risk. The CTO reports to the Company's Chief Executive Officer. The CTO regularly reviews cybersecurity matters with management.

companyName: JOINT Corp

ticker: JYNT


text: As part of LivaNova's cyber resiliency strategy and in an effort to mitigate potential cybersecurity risks, the Company employs various measures, including employee training, systems monitoring, testing and maintenance of protective systems, and contingency plans. In addition, the CISO manages a structured cybersecurity incident response program where periodic simulation exercises are performed to prepare and train the Company's cybersecurity incident responders. The Company deploys security tools to help bolster its defense detection capabilities, such as endpoint detection and response tools, security information and event management tools, and 24/7 monitoring. LivaNova regularly evaluates itself for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests.

companyName: LivaNova PLC

ticker: LIVN


text: Our current Chief Information Security Officer has a comprehensive information security background with over 20 years of experience in managing or assisting in managing cybersecurity risks across multiple industries with the majority of that experience at community banking institutions. Our Chief Information Security Officer holds multiple industry certifications from groups such as ISC2 and GIAC.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: Pursuant to the terms of the Fund's LLC Agreement, the Manager renders management, advisory and administrative services to the Fund, which includes the assessing, identifying, and managing of material risks from cybersecurity threats through its Corporate IT Security Governance program. Ridgewood Energy's Corporate IT Security Governance program consists of an information security framework and organizational structure with senior management oversight that are designed to safeguard critical information assets.

companyName: RIDGEWOOD ENERGY S FUND LLC


text: Cybersecurity Incident Response Plan The DPT plays a critical role in the Incident Response Plan ("IRP") adopted by the Company. The IRP sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Under the IRP, any incident that is identified is promptly reviewed by the Incident Response Team ("IRT"), which is a committee of IT members, including the Company's Chief Information Officer. When the IRT determines a cybersecurity is significant, it is escalated to the DPT, who is responsible for overseeing the investigation of and response to such cybersecurity incidents, including ensuring that the Company's senior leadership and Audit Committee are informed and that notification and regulatory filings are made in a timely manner.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risks. Key elements of our cybersecurity risk management program include: • implementation of policies and procedures in the areas of Information Security, Business Continuity, Disaster Recovery, Privacy, Third-Party Service Provider Risk Management, and Incident Response; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • an independent second line function, the Information Security Department, is principally responsible for managing our cybersecurity risk assessment processes, testing and monitoring of our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including but not limited to penetration testing; • training and awareness programs for Information Security Department members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • throughout the year, all employees are trained on cybersecurity awareness, confidential information protection and simulated phishing attacks, and all directors engage in interactive training modules; • membership with the Financial Services Information Sharing and Analysis Center (FS-ISAC) and annual participation in the Cyber Attacks against Payment Systems (CAPS) exercises; • cybersecurity metrics and other risk management matters are reported to both management level committees and the CIT Committee; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors that analyses, monitors, reports, and mitigates cyber risks associated with third-party vendors, suppliers, and service providers.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: Our corporate information security organization is led by our Chief Information Officer ("CIO"), who brings over 30 years of information technology experience across a wide range of industry sectors, including semiconductor and technology. Before joining Xperi, our CIO was the Chief Information Security Officer for a large technology company. Our CIO oversees our cybersecurity strategy and the development of our cybersecurity capabilities, encompassing risk management and mitigation, incident prevention, detection, and remediation. Our CIO and corporate information security organization collaborate with technical and business stakeholders across our businesses to analyze risks and devise detection, mitigation, and remediation strategies. Additionally, they engage outside legal counsel, experts, consultants, and other third parties to conduct regular audits, assist with forensic investigations, and address cybersecurity threats and incidents. When necessary, they seek input from external experts and consultants on security industry and threat trends.

companyName: Xperi Inc.

ticker: XPER


text: Monitoring Cybersecurity Incidents The Information Security Officer is continually informed of and monitors cybersecurity risks and incidents. In the event of a cybersecurity incident, the Company has developed an incident response plan to timely report cybersecurity incidents to the executive management team, the Operational Risk Committee and Board of Directors, as necessary. In addition to facilitating timely evaluation, escalation and reporting of cybersecurity incidents, this plan also sets forth the process for identifying and assessing the severity of cybersecurity incidents, as well as monitoring post-incident mitigation and remediation.

companyName: F&M BANK CORP

ticker: FMBM


text: Our cybersecurity engineering teams have personnel dedicated to detection engineering activities that leverage threat intel gathered to mitigate the impact of security events. Security detection and operations teams are responsible for detection activities including 7x24 staffed Cybersecurity Operations Centers responsible for monitoring our service provider networks and internal corporate and development environments. Various automated tools are used for detection and remediation, with support from experienced detection and response analysts and engineers.

companyName: VIASAT INC

ticker: VSAT


text: The manner in which we store and/or transmit sensitive data in connection with our payment processing solutions is an important part of how we operate and plan to operate. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees and violation of data privacy or security laws.

companyName: Innovative Payment Solutions, Inc.

ticker: IPSI


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. (Amazon Web Services)

companyName: RYTHM, Inc.

ticker: RYM


text: Kellanova has established a cybersecurity program (the "program") that is designed based on reviewing industry common practices and recognized frameworks (i.e., NIST and ISO, among others). The Company works to evolve its program to address material risks from cybersecurity threats. The program is developed from a top-down strategic risk management approach.

companyName: KELLANOVA


text: Our board of directors has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Operations who monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant Cyber incidents are reported to the audit committee and ultimately to the board of directors.

companyName: ThermoGenesis Holdings, Inc.

ticker: THMO


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: NEVRO CORP


text: We have implemented processes designed to help assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a hybrid information technology team consisting of Managed Services and Managed Security Services partners, which is led by our Vice President and Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: Neurogene Inc.

ticker: NGNE


text: All Davey employees are offered multiple security awareness training opportunities throughout the year, including at the time of hire. The training is further supplemented by periodic phishing simulations as an interactive way to engage and train employees to help identify potential cybersecurity risks and further build threat resilience. Additionally, we provide specialized security training for certain employee roles such as application developers. Improper or illegitimate use of Davey's information system resources or violation of our information security policies and procedures may result in disciplinary action, including up to termination.

companyName: DAVEY TREE EXPERT CO


text: In the past two fiscal years, we have not identified any risks from cybersecurity threats that have materially affected (or are reasonably likely to materially affect) our business, results of operations, or financial condition. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: Direct Digital Holdings, Inc.

ticker: DRCT


text: Several experienced information security professionals report to our Chief Information Security Officer and he is supported by a team of trained cybersecurity team members. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: FOOT LOCKER, INC.


text: For the year ended March 31, 2025, the Company was not subject to material fines or penalties in connection with cybersecurity, and there were no material cybersecurity incidents arising from cybersecurity or personal data protection.

companyName: Senmiao Technology Ltd

ticker: AIHS


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a disaster recovery plan; conducting risk assessments; maintaining network security controls, encrypting certain of our data; maintaining access and physical security controls; systems monitoring; assessing vendor risk; employee training; and maintaining cybersecurity insurance.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee which reports on its risk management activities, including risks arising from cybersecurity threats, to the full Board of Directors. The Company's Vice President of Information Security and Privacy reports to the Audit Committee on an annual basis. In addition, the Audit Committee receives quarterly updates as part of the disclosure control process and other updates, as needed, for significant issues.

companyName: Graham Holdings Co

ticker: GHC


text: The Company has implemented processes designed to identify, assess, and manage material risks from cybersecurity threats. These include system monitoring, vulnerability assessments, employee training, and incident response planning. The Company currently relies on third-party hosting and software providers for its core platform operations, email communications, and data storage, and these vendors maintain their own cybersecurity programs, including network protection, access controls, and incident response procedures.

companyName: DeltaSoft Corp


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our Information Systems team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.

companyName: OneWater Marine Inc.

ticker: ONEW


text: The cybersecurity team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our broader management team when appropriate.

companyName: CEVA INC

ticker: CEVA


text: The Company operates technologies that are exposed to the internet, and although robust cybersecurity programs, technologies, and safeguards are deployed to help protect the Company's operations and assets, the Company by nature is exposed to material cybersecurity attacks that are either generally targeted at companies that operate on the internet, or the Company by nature remains exposed to attacks that are specifically directed at the Company's technology systems exposed to the internet.

companyName: Vestis Corp

ticker: VSTS


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Seagate Technology Holdings plc

ticker: STX


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2024, our Information Security Management System has been certified to conform to SOC 2 Type 2 and PCI, and are working to conform to ISO 27001.

companyName: Usio, Inc.

ticker: USIO


text: We have leveraged the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. We provide ongoing training to our employees to identify and understand the risks from cybersecurity threats, Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors.

companyName: TREVENA INC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial and other trial participant data ("Information Systems and Data").

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: One of the key responsibilities of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly and through the Audit Committee, which conducts regular risk assessments related to all matters affecting the enterprise, including cybersecurity, and receives periodic reports on the Company's cybersecurity risks and activities.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: The Board 's oversight of cybersecurity risk is supported by our CISO and Cybersecurity Manager. The CISO and the Cybersecurity Manager attend Board Risk Committee meetings, periodically provides cybersecurity and other information security updates to the Board Risk Committee. The CISO also provides an annual information security program summary report to the Board of Directors, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.

companyName: FIRST BANCSHARES INC /MS/


text: The Company implements processes to identify, prioritize, assess, mitigate and remediate risks associated with third-party service providers. It conducts security assessments of critical third-party providers before engagement and maintains ongoing monitoring to ensure compliance with the Company's cybersecurity standards. The monitoring includes ongoing assessments by the IT security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. The Company also contractually requires the key third parties it engages to implement security programs commensurate with their risk.

companyName: Sleep Number Corp

ticker: SNBR


text: Our cybersecurity program includes a threat and vulnerability management program to identify, assess, prevent, detect, monitor and remediate internal and external threats to, and vulnerabilities of, the Company's electronic systems, applications and data. Key components of this security program include a 24/7 Security Operations Center, which is managed internally at Jackson, with staff augmentation from third-party service vendors. The Security Operations Center monitors threats and attacks and initiates the incident response management process and associated notifications, as needed. In addition to monitoring threats and attacks, our internal management team reviews daily external threat intelligence and oversees, at least quarterly, external penetration testing of our Company's electronic systems. We provide training to all associates and regularly audit and assess our program with both internal and external resources, and through benchmarking studies and assessments against our Information Security and Privacy Policies and Standards.

companyName: Jackson Financial Inc.

ticker: JXN


text: Quaker Houghton has a dedicated Global Cyber Security team led by the Senior Director, Cybersecurity and Compliance that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. Collectively this team has decades of dedicated cybersecurity experience with personnel experienced and certified in various disciplines, including data security and privacy, enterprise risk management, cloud security and ethical hacking.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: Our ECVs are fitted with a networking device connecting the vehicle to our proprietary cloud-based software, which enables end-users to collect data about vehicle configuration, vehicle status and user efficiency through a system of digitally enabled components, which we sometimes refer to as "smart components." With the permission of the end-users of the vehicles, we received data collected from approximately 950 Metro units that we put into service through a company affiliated with our former parent company, CAG Cayman, in the Chinese market. This data included vehicle-specific data collected for operational analysis, which we used to make improvements in the quality and durability of such components. We enable end-users to collect, store and analyze data using tools that we have developed but we do not have access to this end-user collected data unless we request and receive access from the end-user. We do not currently collect, use or store any vehicle-specific or driver-specific data in any region and do not intend to do so in the future.

companyName: Cenntro Inc.

ticker: CENN


text: Our cybersecurity program is governed by the Audit Committee of our Board. The Audit Committee of the Board and the full Board each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.

companyName: InterDigital, Inc.

ticker: IDCC


text: Cybersecurity Risk Management and Processes Sensus is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: In addition, the CIO provides updates to the full Board upon request or to update the Board of unique developments, such as regulatory updates or unique vulnerability developments. Our Board is composed of members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Arcosa, Inc.

ticker: ACA


text: Our cybersecurity policies, standards, processes, controls, and practices are periodically assessed by third-party consultants. These assessments address a variety of activities including information security maturity assessments, audits, regulatory compliance assessments, and independent reviews of our information security control environment and operating effectiveness. The results of assessments are reported to the Board and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology. The Company has a third party perform an annual assessment of the Company's cybersecurity risk management program. The Company has a Cyber Security Operations Center monitoring our global cybersecurity environment and coordinates investigations and remediation of alerts. We are enhancing our programs for staging incident response drills to prepare support teams for a significant incident. The cybersecurity risk management program includes administrative, physical, and technical controls.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: Engage Third-parties on Risk Management Ongoing business expansions may expose us to potential new threats as well as expanded regulatory scrutiny including the introduction of new cybersecurity requirements. We continue to make significant investments in enhancing our cyber defense-in-depth capabilities and to strengthen our partnerships with the appropriate government and law enforcement agencies and other businesses in order to understand the full spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency against cybersecurity threats. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, compromise PHI or PII regarding customers or employees, delay our ability to provide critical services to our customers, and/or jeopardize the security of our facilities. We continuously seek to maintain a robust program of information security and controls, but the impact of a material information technology event could have a material adverse effect on our competitive position, reputation, results of operations, financial condition and cash flows. Governance.

companyName: ModivCare Inc

ticker: MODVQ


text: Our Information Technology department is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.

companyName: Meridian Holdings Inc./NV

ticker: MRDN


text: Not withstanding our defensive measures and processes, the threats posed by system failures, interruptions, or cybersecurity breaches are severe. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Commencing in 2024, our Nominating / Corporate Governance Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: Company e-mails are protected by a cloud-based email filtering service designed to protect the Company against advanced threats related to email and collaboration tools. all users on the Company's computer network are required to perform multi-factor authentication. Company uses a cloud-based identity and access management service that enables access to external resources. is performed using a secure, automatic cloud-based backup and restore service.

companyName: Awaysis Capital, Inc.

ticker: AWCA


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. Specifically, our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives regular updates from senior management including our Chief Information Officer and Director of Cyber Security, on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our cybersecurity protocol requires that the Chair of the Audit Committee and senior management be immediately notified upon any cybersecurity incident.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Our process for identifying and assessing material risks from cybersecurity threats incorporates a risk matrix for identifying risk levels for interconnected systems. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: DURECT CORP


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, of financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and there can be no assurance that our cybersecurity risk management program and processes, including our IRP, and other preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information, will be fully implemented, complied with or successful in protecting against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors—Risks Related to our Business and Industry—A cybersecurity breach could adversely affect our ability to conduct our business, harm our reputation, expose us to significant liability or otherwise damage our financial results."

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: We are subject to numerous cybersecurity threats and the cybercriminals are becoming more sophisticated and are increasingly targeting electric utilities. A major cyber incident could result in significant business disruption, compromised or improper disclosure of data, and expenses to repair security breaches or system damage and could lead to litigation, regulatory action, including penalties or fines, and an adverse effect on our financial condition, results of operations, and reputation. See "RISK FACTORS – General Risks" for additional information. While there have been immaterial incidents of phishing and attempted financial fraud across our system, there has been no material impact on business or operations from these attacks. However, we cannot guarantee that security efforts will prevent breaches, operational incidents, or other breakdowns of information technology systems and network infrastructure and cannot provide any assurance that such incidents will not have a material adverse effect in the future.

companyName: Tri-State Generation & Transmission Association, Inc.


text: We have implemented and maintain various information security processes designed to mitigate cybersecurity risks, on a case-by-case basis, to our critical computer networks, third party-hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials (IT Assets). The Company's information security program, which is integrated into our overall risk management processes, evaluates threats posed by internal and external factors and supports daily operational functions that prevent unauthorized access or compromise.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: Given the importance of information security to our stakeholders, our Risk Oversight Committee receives regular reports from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks. In addition, our CISO has direct access to the chair of our Risk Oversight Committee and is expected to keep that committee apprised of any significant developments that may emerge between scheduled meetings that may require the attention of our Risk Oversight Committee.

companyName: ETSY INC

ticker: ETSY


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. RetinalGenix acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery;

companyName: RetinalGenix Technologies Inc.

ticker: RTGN


text: Our cybersecurity risk management program is led by our Chief Information Security Officer (CISO), who oversees a dedicated cybersecurity and risk management team, which works in partnership across the Company, under the direction of our Chief Information Officer (CIO). Our CISO has over 20 years of experience working in defense and cybersecurity and has served in various cybersecurity leadership roles within Fortune 500 companies. He and our cybersecurity team have extensive experience in leading and addressing IT risk management, security architecture and engineering, security operations, data security, and identity and access management. Our CISO also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: HOLOGIC INC

ticker: HOLX


text: Weatherford's cybersecurity has been developed by the CIO and the information security team, in coordination with our Board and key members of our finance, assurance and legal teams. The information security team, which has years of experience selecting, deploying, and operating cybersecurity technologies and initiatives around the world, uses a risk-based approach in an effort to facilitate protection, detection and rapid response to threats. We seek to validate our approach through NIST Cyber Security Risk Assessments conducted by third parties and tested through penetration tests and tabletop exercises, as well as internal and external audits.

companyName: Weatherford International plc

ticker: WFRD


text: Key components of the Company's cybersecurity program include: • Risk Assessment & Management: Regular identification and evaluation of cybersecurity threats, vulnerabilities, and exposures informed by threat intelligence, industry trends, and regulatory developments. • Governance & Oversight: Defined cybersecurity policies and procedures overseen by senior management and the Board of Directors. The Director of Technology is responsible for monitoring cybersecurity risks and reporting any material threats or incidents to the IT Committee or Board for oversight, strategic response planning, and mitigation efforts. • Access Controls & Identity Management: Implementation of multi-factor authentication, role-based access controls, and monitoring of user permissions. • Incident Detection & Response: Security monitoring supported by an incident response plan designed for timely identification, containment, and remediation of cybersecurity incidents. • Data Protection & Encryption: Encryption, standards, data loss prevention protocols, and secure data storage measures for sensitive client and corporate information. • Third-Party Risk Management: Security assessments, monitoring, and contractual requirements to manage cybersecurity risks from third-party vendors. • Training & Awareness: Mandatory cybersecurity training for employees to enhance awareness of cybersecurity threats and compliance requirements. • Regulatory Compliance & Audit: Regular internal and external cybersecurity audits to assess compliance with applicable regulations, standards, and Company policies. • Continuous Improvement & Testing: Periodic penetration tests and vulnerability assessments to evaluate cybersecurity risks and enhanced security measures. Program updates are implemented as needed to address emerging threats and align with evolving industry best practices.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: Governance and Risk Management Systems Our risk management system includes several risk management functions that support our processes for identifying, assessing, and controlling risks to our business, including cybersecurity risks.

companyName: HERBALIFE LTD.

ticker: HLF


text: Annually, the Company completes incident response, disaster response, and crisis management plan exercises to validate our current readiness. These exercises are intended to test our cybersecurity response plans and resources through simulated cybersecurity incidents, and may include engagement of outside cybersecurity legal counsel, other third-party partners, executive management, and our Board of Directors.

companyName: ONE Gas, Inc.

ticker: OGS


text: Our Information Security Officer and our cybersecurity team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Information Security Officer and our cybersecurity team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include monitoring of network, system and application logs, review of vulnerability scans and penetration test results, review of industry sources for vulnerability and threat indicators, and use of third-party service providers for audit or assessment purposes. In the event of a significant cybersecurity incident that is identified by the Company, Blend leadership and the Audit Committee is informed by the Information Security Officer or our manager of security operations to support swift and informed decision-making.

companyName: Blend Labs, Inc.

ticker: BLND


text: The Company also requires cybersecurity training for relevant employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides annual cybersecurity awareness training that covers a broad range of security topics, including secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through a number of methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: During the fiscal year ended March 31, 2025, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition, as we have described in the Risk Factors section of this Form 10-K.

companyName: CYANOTECH CORP

ticker: CYAN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors in Item 1A."

companyName: Douglas Emmett Inc

ticker: DEI


text: Senior management, including our CIO and CISO, brief the Board on an annual basis on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate or higher business impact, even if it is considered immaterial to us. Annually, the Board and management participate in a comprehensive strategy discussion on cybersecurity.

companyName: KFORCE INC

ticker: KFRC


text: AB's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Fund. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.

companyName: AB Private Credit Investors Corp


text: The Audit Committee regularly receives updates from management with respect to our efforts to manage data protection, cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to our Audit Committee include updates on our data security posture, results from internal audit and third-party assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also regularly engages with Management on technology risk-related topics.

companyName: Expion360 Inc.

ticker: XPON


text: The company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems Cybersecurity threats, including those resulting from any previous cybersecurity incidents, had not materially affected the company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. See Item 1A. Risk Factors "— Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation " for more information regarding cybersecurity risks and the potential impact on the company.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: We have leveraged the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf.

companyName: Eightco Holdings Inc.

ticker: ORBS


text: The Company's cybersecurity program is part of its overall risk management framework. The cybersecurity risk program includes a risk-based approach to identifying, assessing, and addressing cybersecurity threats that could impact our data, our networks, or the information provided to us by consumers and counterparties.

companyName: QUINSTREET, INC

ticker: QNST


text: In addition, the CISO provides updates to the full Board upon request and updates the Board on unique developments, such as regulatory updates or unique vulnerability developments. Our Board is composed of members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Arcosa, Inc.

ticker: ACA


text: While we have not identified any cybersecurity threats that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition, our cybersecurity risk management program cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected material cybersecurity incident or will not experience a material cybersecurity incident in the future. For more information about these risks, please see "Risk Factors - A failure in or breach of our operational or security systems, networks or infrastructure, or those of third parties with which we do business, including as a result of cyber-attacks and other data security incidents, could have a material adverse effect on our business."

companyName: CENTENE CORP

ticker: CNC


text: The Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; and (4) Post-Incident Activity.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Our Board of Directors recognizes the importance of information security and mitigating cybersecurity and other data security threats and risks as part of our efforts to protect and maintain the confidentiality and security of our customers, employee and vendor information, as well as non-public information about our Company. Although our full Board of Directors has ultimate responsibility with respect to risk management oversight, the Risk and Information Security Committee of our Board of Directors is charged with and bears primary responsibility for, among other matters, overseeing risks specific to the identification and mitigation of cybersecurity risks.

companyName: FingerMotion, Inc.

ticker: FNGR


text: The CISO is responsible for the ISMS and reports directly to the CIO. The CIO is the head of the company's global IT team which has an integrated governance structure consisting of a Senior Executive Committee, a Cyber Executive Committee and Cyber Leaders. The Senior Executive Committee meets quarterly, prioritizes the information technology components of strategic business imperatives and oversees IT capability and security programs. The Cyber Executive Committee meets monthly, reviews identified risks, sponsors initiatives to address risk and oversees security and compliance responses. Cyber Leaders are management representatives from all functions and lines of business who are responsible for executing programs and initiatives sponsored by the Senior Executive Committee.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: We also maintain business continuity and disaster recovery plans to prepare for and respond to the potential for any disruption in the technology we rely on. Additionally, we maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.

companyName: NEPHROS INC

ticker: NEPH


text: While the Company has seen attempts to gain access against its systems, and expects such attacks to continue, or possibly intensify in the future, the Company has not experienced any material losses relating to cyber-attacks or other information security breaches as of December 31, 2023. As a protective measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, or by one or more of the Company's third party providers, however such insurance coverage may not be sufficient to cover all losses incurred. As of the date of this Report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion surrounding risks from cybersecurity threats, refer to the section captioned "Risks Related to Information Security and Technology" within Item 1A this Report.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: Risk Management and Strategy have developed and maintained a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: ZEUUS, INC.

ticker: ZUUS


text: We maintain a threat intelligence program that drives informed decision making and strategy development within our organization's Information Security Program. The threat intelligence program includes the review of cybersecurity incidents including root-causes-analysis and the deployment of tools and technologies to help prevent future incidents from occurring. Risks associated with cybersecurity threats are evaluated as part of our Risk Management process to determine, among other things, if the risks will materially affect our ability to adequately secure client data throughout the engagement. When deemed appropriate, business strategies are re-evaluated with risk from cybersecurity threats taken into consideration.

companyName: KLDiscovery Inc.


text: We annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Verve Therapeutics, Inc.


text: We assess, identify and manage material risks from cybersecurity threats through various protective policies, procedures and processes. These are embedded into our overall risk management system and extend to risks related to systems hosted by third parties.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: There is strong engagement in risk management from company leadership, including the CEO, executives and senior leaders. This ERM program is driven by Vontier's Executive Risk Committee, which is led by the SVP, Chief Administrative Officer and comprised of business and functional leaders. Our Audit Committee oversees the ERM program and the Board of Directors have regular updates on topics that are identified through the RAP and overall risk management process.

companyName: Vontier Corp

ticker: VNT


text: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Chief Executive Officer, Vice President Quality Assurance, and Director GxP Systems, and, where appropriate, to the board of directors. To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: The Board and Audit Committee are supported in their oversight capacity by the Partnership's ERM Committee, and internal audit and information technology functions. On a quarterly basis, the ERM Committee evaluates past, existing, and future risks to the Partnership; the likelihood, severity, and velocity of such risks; and the controls and mitigation tools implemented to address such risk. Several members of the ERM Committee have functional responsibility for the Partnership's information technology and cybersecurity risk monitoring activities and provide expertise to the ERM Committee in those areas.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Chief Executive Officer works with our information technology consultants (IT) to assess any reasonably foreseeable internal and external risks to our information systems, including the likelihood of malware, ransomware, cyber espionage, and any other cybersecurity threats.

companyName: APPLIED ENERGETICS, INC.

ticker: AERG


text: The rapidly evolving nature of cybersecurity threats requires ongoing vigilance, and there can be no assurance that our efforts will prevent all incidents.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: While we have not experienced any cybersecurity threats in the past in the normal course of business, in the future, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: Propanc Biopharma, Inc.

ticker: PPCB


text: Board of Directors Involvement • The Board is actively engaged in overseeing the cybersecurity program, receiving regular updates and assessments concerning governance and compliance. Quarterly updates from the IT Director cover the status of cybersecurity controls, exposures, and overall program results. The Board insists on being informed about any material cybersecurity incidents.

companyName: i-80 Gold Corp.

ticker: IAUX


text: The Fund, under the supervision and with the participation of the Principal Executive Officer and Principal Accounting and Financial Officer, is responsible for directing and overseeing our risk management. The Principal Executive Officer and Principal Accounting and Financial Officer administers this oversight function directly. In particular, the Principal Executive Officer and Principal Accounting and Financial Officer has the responsibility to consider and discuss our major financial risk exposures and the steps BFIM takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Principal Executive Officer and Principal Accounting and Financial Officer also monitors compliance with legal and regulatory requirements.

companyName: BF Garden Tax Credit Fund IV L.P.


text: In addition, we evaluate critical systems and applications hosted by third parties for cybersecurity risks and we also assess the security posture and features of those services. This includes review and monitoring of the third party, and inclusion of cybersecurity requirements in contractual agreements to help ensure third party services meet our standards for such providers and that the cybersecurity risks associated with the use of these services are appropriate.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: The Audit Committee is composed of members with diverse expertise including risk management, technology, and finance. Although none of the members of the Audit Committee have any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee relies on the CIO and independent feedback from outside advisors, such as our CISO-level advisor, on the current and future cybersecurity program to assist the Audit Committee in its cybersecurity oversight responsibilities. Because the method and sources of cyberattacks change frequently, our outside advisors, including our CISO-level advisor, provide invaluable, ongoing updates to inform and educate our Board of Directors on current trends of cybersecurity threats, emerging trends, and best practices.

companyName: Century Communities, Inc.

ticker: CCS


text: Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity / information security program. The Information Security Officer reports directly to the Chief Operating Officer, and periodically reports to the Audit and Examination Committee of our board of directors.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: Management is responsible for day-to-day risk management activities, including identifying, assessing and managing our exposure to cybersecurity risks, establishing processes and procedures to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures as needed, and maintaining cybersecurity risk management programs. Our chief information security officer is responsible for defining, overseeing, managing, implementing, and reviewing compliance with the information security programs described above under the heading "Cybersecurity Risk Management and Strategy." Our chief information security officer receives regular reports from our information security team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks. In addition, as described in further detail above under the heading "Cybersecurity Risk Management and Strategy," a cross functional team is involved in assessing and managing the risks from cybersecurity threats and incidents, and reporting information about risks to the Security Committee.

companyName: Palo Alto Networks Inc

ticker: PANW


text: Our cybersecurity risk management and strategy processes are overseen by management. Management is informed about, and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above and report to the Audit Committee on any appropriate items.

companyName: Collective Audience, Inc.


text: As of the date of this Annual Report on Form 10-K, risks from cybersecurity threats, including from any previous incidents, have not materially affected our business, including our business strategy, results of operations, or financial condition. See Item 1A - "Risk Factors" for additional information regarding cyber threats and related risks to our business.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: While cybersecurity threats remain a risk to the Company's business operations (see discussion in Item 1A. Risk Factors.), our robust risk mitigation strategies have been effective. Accordingly, no such threats have materially affected or are reasonably likely to materially affect the company, our business strategy, results of operations or our financial condition. Governance.

companyName: Eaton Corp plc

ticker: ETN


text: Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a security incident response plan, disaster recovery and business continuity plans, encryption of data, access controls, asset management, and penetration testing.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Our management team, including the Director of Enterprise Security & Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team's collective experience includes a diverse background in fintech and other industries, with decades of experience in various aspects of cybersecurity.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: The Evergy Companies' risk mitigation function utilizes the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), the United States Department of Energy Cyber Capability Maturity Model (C2M2) standard and components of National Institute of Standards and Technology Risk Management Framework (NIST RMF) for a comprehensive, flexible and risk-based approach to managing risk from cybersecurity threats that integrates, security, privacy and cyber supply chain risk management activities. The NIST RMF considers effectiveness, efficiency and constraints due to applicable laws and regulations.

companyName: Evergy, Inc.

ticker: EVRG


text: The Company maintains a Cybersecurity incident response team and a Business Continuity Plan and has a well-established incident reporting protocol to inform management, the Board of Directors or third parties.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Quaker Houghton has a dedicated Global Cyber Security team led by the Director, Global Security that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. Collectively this team has decades of dedicated cybersecurity experience with personnel experienced and certified in various disciplines, including data privacy, enterprise risk management, cloud security and ethical hacking.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering, Dave Halliday. Mr. Halliday has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Compliance Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program, maintains a strategic role in coordinating cyber risk initiatives and policies, and confirming their efficacy.

companyName: ARDELYX, INC.

ticker: ARDX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, disaster recovery/business continuity policies, risk assessments, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: The Company's information security team helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." To date, we have not experienced any material cybersecurity incidents or threats.

companyName: EyePoint, Inc.

ticker: EYPT


text: The Board maintains oversight responsibility for cybersecurity risks and has delegated to the Audit Committee oversight of such risks, including oversight of management's implementation of our cybersecurity risk management program. Management regularly reports to the Audit Committee of the Board regarding the status and outcomes of regular internal audits of cybersecurity systems, controls, and processes. As needed, management also briefs the Board on our cybersecurity environment and information security philosophy. We also review and advise our Board of cybersecurity threats to us, including emerging cybersecurity threats, as well as our plans and strategies to address them.

companyName: Oklo Inc.

ticker: OKLO


text: Global cybersecurity threats and targeted attacks are an evolving risk to data, infrastructure, and overall operations. These risks were addressed through a comprehensive, cross-functional approach that reduced security risks, helped ensure business and stakeholder information is handled securely, and effectively responded to cybersecurity incidents when they occur.

companyName: Treasure Holdco, Inc.


text: The full Board of Directors has overall responsibility for overseeing the cybersecurity processes of identifying and mitigating cybersecurity risks. The Board of Directors has not delegated this responsibility to any one Committee, as its structure and size allows for the entire Board of Directors to oversee this responsibility. Periodically, our management provides updates to the Board of Directors regarding our internal control program, including any significant changes to its IT infrastructure and/or cybersecurity program. Management also communicates directly with the Board of Directors to report any material risks from cybersecurity threats.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: • detection of a security incident, • identification and containment, • response, eradication and recovery, and • post-incident analysis. Incident responses are overseen by leaders from our Software and Infrastructure Engineering, Compliance and Legal teams.

companyName: TrueCar, Inc.


text: Securing Kroger's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our stakeholders. We have adopted enterprise cybersecurity risk mitigation and governance processes, which are set forth in the Kroger Cybersecurity Risk Management program ("CRM"), the Kroger Third-Party Cybersecurity Risk Management ("TPCRM") program and the Kroger Cyber Incident Response Plan ("IR Plan"). Our approach is guided by the principles of the CRM, which includes monitoring threats and vulnerabilities and assessing and monitoring related controls, supporting the Corporate Information Security function, the Chief Information Security Officer ("CISO") and Chief Digital Officer ("CDO"). Kroger's cybersecurity policies, standards, processes, and practices are integrated into our overarching risk management system in an effort to enhance our ability to safeguard our operations and information, which includes quarterly cybersecurity reporting to the Board, delivered by senior leadership.

companyName: KROGER CO

ticker: KR


text: The CISO leads the Company's Cybersecurity and Digital Risk ("CDR") organization, which oversees the Company's approach to identifying and managing cybersecurity and digital risk. The Company's current CISO has extensive technology and risk management experience in critical infrastructure sectors and is qualified as a boardroom certified technology expert by the Digital Directors Network. She has served on the U.S. President's National Infrastructure Advisory Council, examining and providing recommendations related to cross-sector critical infrastructure security and resilience. She serves on the board of directors of the Internet Security Alliance, is currently a member of the Cybersecurity Council at Airlines for America (and has served as Chair) and is currently a member of the board of directors of the Aviation Information Sharing and Analysis Center (A-ISAC). The CDR organization includes teams focusing on cyber defense, identity & digital trust, secure product solutions & aircraft cybersecurity operations. The teams include individuals with a variety of cybersecurity expertise, including expertise in penetration testing; application cybersecurity; product cybersecurity; cloud cybersecurity; infrastructure cybersecurity; cybersecurity engineering and architecture; identity and access management; vulnerability and asset management; cybersecurity threat intelligence; cybersecurity regulatory compliance; digital fraud; digital trust; incident response; insider threat assessment; and aircraft cybersecurity.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Our Senior Director of IT and Director of Security and Compliance have primary responsibility for assessing and managing cybersecurity risks. An internal team of cybersecurity professionals execute our cybersecurity program while our VP of Information Services provides executive oversight. Combined, our experts bring multiple decades of cybersecurity experience and have earned cybersecurity-related certifications. Our internal team is bolstered by strategic third-party security partners leveraged to provide 24x7 monitoring and response. Third parties routinely assess our security practices providing tactical assistance or strategic guidance through audits and penetration tests. All members of the team routinely discuss emerging security threats and ways to mitigate risk.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any cybersecurity threats, that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the "Risk Factors" disclosures in Item 1A of this Annual Report on Form 10-K.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see "Risk Factors" included elsewhere in this annual report on Form 10-K.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Access to systems is granted on an as needed basis as it relates to the job functions of an individual. All access changes must be requested based on job function and approved by the appropriate departments. Changes are reviewed monthly, and all access rights to all significant systems are reviewed and verified annually.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: We also hold quarterly Audit and Risk Committee meetings, during which our Board of Directors receives briefings on information security matters. Risks that are identified during these processes are reviewed by executive leadership and corrective action plans are established to address and manage the issues, as applicable and appropriate.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: To date, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Refer to the risk factors captioned "Security or data privacy breaches, or disruptions of our information technology systems, and an increasingly complex regulatory landscape could adversely affect our business" and "Our software products are highly sophisticated and specialized, and a major product failure or similar event caused by defects, cybersecurity incidents or other failures, could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on us.

companyName: Aspen Technology, Inc.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Depending on their nature, cybersecurity threats in the future may materially affect our business strategy, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this report.

companyName: Nerdy Inc.

ticker: NRDY


text: The Company's IT manager is engaging an independent service with its expertise specifically in cybersecurity and risk mitigation to review our IT as a risk service consultant. To date, no cybersecurity threats have materially affected our business strategy, operations, or financial condition.

companyName: REGENEREX PHARMA, INC.

ticker: RGPX


text: In addition, we have an IT Security Committee comprised of our top executives from across the Company, including our Chief Executive Officer, Chief Financial Officer, General Counsel, and our VP of Information Technology and Security. The IT Security Committee meets quarterly to discuss and address management of the risks facing our business. Technological risk is a regular component analyzed by our IT Security Committee to identify and assess potential cybersecurity risks across our business operations.

companyName: INSEEGO CORP.

ticker: INSG


text: Our Board is periodically informed of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: IMMERSION CORP

ticker: IMMR


text: Cyber Risk Management Strategy Adtalem recognizes the importance of safeguarding sensitive information pertaining to our students, employees, institutions, and operations. Our Cyber Risk Management Framework ("CRMF") is designed to fortify our defenses against potential cyber threats and to protect the integrity, confidentiality, and availability of critical data. Our CRMF includes continuous risk assessments, threat modeling, vulnerability scans, and monitoring for indicators of compromise. These assessments inform control implementations based on likelihood and impact to operational, financial, and reputational harm.

companyName: Covista Inc.

ticker: CVSA


text: Management, including our President and Chief Financial Officer, reports to the Audit Committee on our major cybersecurity risk exposures, their potential impact on us, and the steps we take to manage them. The Audit Committee considers the Company's cybersecurity risk exposures and the steps that the Company's management has taken to monitor and control such exposures in connection with the Audit Committee's discussion of the Company's risk assessment and management guidelines.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: The foregoing responsibilities are covered on a day-to-day basis by the SVP/IT Manager and ISO. The ISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 22 years of cybersecurity experience, 18 of which was spent at a CPA firm specializing in banking industry financial and information technology audits.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Management's Expertise The Company's CIO has over two decades of experience in technology development, management, and security, including responsibility for global portfolios of digital assets, intellectual property, and proprietary data. The CIO holds a technical undergraduate degree and a graduate business degree with a strong technical focus. Additionally, the Company's CEO, CFO, and GC each have over 15 years of experience managing enterprise risks, including cybersecurity threats, either at the Company or in similar organizations. Each executive holds undergraduate and graduate degrees in their respective fields, further reinforcing the Company's commitment to cybersecurity governance at the highest levels.

companyName: TIC Solutions, Inc.

ticker: TIC


text: Our Vice President and Director of Information Technology, who has over 20 years of industry experience and is a technology subject matter expert responsible for enterprise program management and information technology service management. Our Chief Risk Officer, who oversees entity-side risk management, including cybersecurity related risk.

companyName: William Penn Bancorporation


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: Our management team and IT Information Security Group supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: The Audit and Finance Committee has oversight over and regularly reviews our cybersecurity, including information technology ("IT") risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis from the Chief Information Officer and the Vice President, Information Security, on, among other issues, our cyber risks and threats, the status of projects, management's strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board of Directors also receives updates on cybersecurity matters from management at least annually.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for essential third-party service providers, suppliers, and vendors, as identified by management.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission, to ensure the confidentiality, integrity, and availability of Company information.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: In connection with the operation of the Company's business, we identify, assess and manage key risks that may affect the Company, including material risks from cybersecurity threats through our system security plan. Our system security plan is aligned with the 110 controls detailed in the NIST (SP) 800-171 and Department of Defense CMMC Level 2 guidelines for Cybersecurity. We have company-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures covering our information technology systems, including with respect to the protection of customer data, vendor data and employee information. We have also implemented specialized training and education programs to seek to guard against cybersecurity incidents, including company-wide communications and presentations, phishing simulations, focused training for specific roles and a general cybersecurity training program required for all employees.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats is aligned with Vornado's strategy as the Company's manager, which involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: ALEXANDERS INC

ticker: ALX


text: Vulnerability Assessments The Company uses a layered security structure of processes and technologies to detect, prevent, mitigate, monitor and respond to cybersecurity threats.

companyName: Embassy Bancorp, Inc.

ticker: EMYB