text: We have implemented and maintain various technical, physical and organizational measures, processes, standards and/or policies designed to manage and mitigate material risks from cybersecurity threats. These include data encryption, network security controls, access controls, physical security, asset management, system hardening, vulnerability management and patching and continuous monitoring of information technology systems and network telemetry data using a variety of manual and automated tools and systems designed to detect and respond to suspicious or unusual activity. We maintain systems and plans for business continuity and disaster recovery and have implemented tools and procedures for cybersecurity incident detection and response. We also operate a cybersecurity training program for employees that includes required webinars and deployment of simulated phishing and similar attacks in which threat actors utilize social engineering to gain access to company systems.

companyName: OMEROS CORP

ticker: OMER


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The audit committee receives regular reports and updates on cybersecurity matters from the leaders of our dedicated security team and management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the audit committee reviews and discusses with management our policies and programs with respect to the audit committee's oversight of cybersecurity threats, which enable the audit committee's effective oversight of our overall cybersecurity risk and compliance posture. The audit committee regularly reports to the board of directors on these matters.

companyName: PIXELWORKS, INC

ticker: PXLW

secItem: Item 1C


text: Our information security function, which includes our information technology Managed Service Provider (MSP), helps identify, assess and manage the Company's cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; evaluating threats reported to us; and conducting vulnerability assessments.

companyName: SCYNEXIS INC

ticker: SCYX


text: The following is a discussion of Truist's cybersecurity risk management strategy and governance. Refer to the "Risk Management" section of Part II, Item 7 for additional discussion.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: We are committed to properly addressing the cybersecurity threats we face, and we have processes to assess, identify, and manage material risks from cybersecurity threats. We apply a comprehensive approach to the mitigation of cybersecurity risks. The risk of cybersecurity threats is integrated into our overall risk management program, which includes an annual risk prioritization process to identify key enterprise-level risks. The cybersecurity threat risk action plan is managed by a dedicated information technology ("IT") committee (the "IT Committee"), which oversees our cybersecurity program. The IT Committee comprises senior company leaders as well as our outsourced IT services provider. To oversee and identify cybersecurity threat risks on a day-to-day basis, we maintain a security operations center with round-the-clock monitoring. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of mitigation strategies and techniques to reduce cybersecurity risks, including continuous monitoring, early detection tools, proactive vulnerability management, and remediation. Our information security policies are modeled against the National Institute of Standards and Technology's Cybersecurity Standards and incorporate concepts from the Zero Trust Framework.

companyName: RLJ Lodging Trust

ticker: RLJ


text: We take a defense-in-depth approach, leveraging multiple, layered security measures, to protect our data, our customers' data, our infrastructure, and our employees. We embed data protection throughout our operations and information technology programs, relying on multiple and various controls to prevent and detect threats, with the goal of safeguarding our assets, data and personnel.

companyName: InterDigital, Inc.

ticker: IDCC


text: The Program includes processes to coordinate and facilitate the implementation of information security best practices and services throughout the Company and to comply with applicable cybersecurity requirements under federal and state laws and regulations, including, but not limited to, the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act of 1996, and the New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies, 23 NYCRR 500. The Program is based on the Company's risk assessment and designed to perform in accordance with applicable laws and regulations.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: We work proactively to identify, evaluate, and manage cybersecurity threats to our business. These threats include disruption and denial of critical systems and infrastructure, intellectual property theft, fraud, extortion, harm to customers and employees, legal and litigation risks, reputational risks, and the breach of confidential business data, which could include personally identifiable information. We employ both holistic and focused processes for identifying, assessing, managing, and disclosing material cybersecurity risks to our business. Our holistic review is part of our general risk management process, and involves our executive leadership team, team members from our finance, legal, tech, and operations teams, and external legal, financial, and risk advisors who are subject matter experts in identifying, assessing, mitigating and reporting material risks. Our focused review involves internal assessment by our cybersecurity team, as well as external review by a cybersecurity consulting services firm, to evaluate our cybersecurity program and our capacity to defend against and respond to potential cybersecurity threats.

companyName: COPART INC

ticker: CPRT


text: The Audit Committee. The Audit Committee reviews with our management team, including our Vice President of Information Technology Services, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies, and associated risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks, and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Our CITO, who reports to our Chief Financial Officer, is responsible for leading our information security team and overseeing the Company's cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer.

companyName: UNIFIRST CORP

ticker: UNF


text: Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. To that extent, the Company has not currently engaged with a third-party service provider for the purpose of managing its ongoing cybersecurity risk. Furthermore, the Company is currently putting processes in place in order to oversee and identify risks from cybersecurity threats associated with The Company employs a full time, degreed internet and technologies engineer, Matthew Bellestri, as its Director of Internet and Security Services. The Company entered into a three (3) year employment agreement with Mr. Bellestri as of February 1, 2025. Mr. Bellestri has also been nominated to serve on the Company's Executive Committee that reports to the Company board of directors.

companyName: flooidCX Corp.


text: The Board recognizes that our business depends on the confidentiality, integrity, availability, performance, security, and reliability of our data and technology systems and devotes time and attention to the oversight of cybersecurity and information security risk. In particular, the Board's Risk Committee receives recurring updates and reports on information security-related topics from senior management, including from the Company's Chief Compliance Officer, Chief Risk Officer, and Chief Information Security Officer. More specifically, the Risk Committee receives recurring presentations from senior management on cybersecurity, including architecture and resiliency, incident management, business continuity and disaster recovery, significant information technology changes, data privacy, insider threats, physical security, information related to third-party cyber assessments and risks associated with the use of third party service providers. The Risk Committee also reviews and approves any changes to the related information security and privacy program charter. Further, summaries of the proceedings from prior Risk Committee meetings are provided to the Board on a routine basis.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: With respect to third-party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures through various contractual provisions to the extent possible, and we perform risk assessments of vendors as appropriate from time to time, which includes a vendor's ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, including the loss of customer confidence, reputational harm, our operating results and our financial condition. We have insurance designed to cover certain expenses relating to cybersecurity incidents; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available. While we have experienced cybersecurity incidents, to date, we do not believe that we experienced a material cybersecurity incident during the fiscal year ended December 31, 2024.

companyName: Gogo Inc.

ticker: GOGO


text: Cybersecurity threats, such as threats of attacks from computer hackers, cyber criminals, nation-state actors and other malicious internet-based activity, continue to increase. Cybersecurity threats also include threats of attacks involving social engineering and cyber extortion to induce customers, contractors, business partners, third-party service providers, employees and other third parties to disclose information, transfer funds or unwittingly provide access to systems or data.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness. We also have invested in tools and technologies to protect our and our patients', customers' and business partners' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks.

companyName: Renalytix plc

ticker: RNLXY


text: The plans are reviewed annually for enhancements and inter-department alignment. Tabletop exercises are conducted to measure the effectiveness of the plan and any findings are factored in towards further revisions of the plans.

companyName: Crexendo, Inc.

ticker: CXDO


text: Our Chief Financial Officer and the head of our IT department are primarily responsible for managing our cybersecurity risks, mitigation strategies and responses to any such issues that may arise. Our Chief Financial Officer oversees the Company's IT department and has extensive experience in managing IT organizations and securing cybersecurity insurance coverages. The head of our IT department drives our strategic IT initiatives and cybersecurity risks assessments, drawing upon over two decades of enterprise technology management expertise.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Risk Management and Strategy AFG recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats as defined by the Securities and Exchange Commission. Like all businesses, AFG is a target for "cyber-attacks," "ransomware," "phishing," "hacking" and similar illegal or unauthorized intrusions into computer systems and networks. Such events can result in significant disruptions to information technology systems, the theft of information and financial assets and reputational harm. AFG could also incur significant expenses associated with investigating and remediating any such event.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Through the Audit Committee, the Board of Directors is informed of: (i) security initiatives, (ii) existing and emerging cybersecurity risks, including cybersecurity incidents; and (ii) any disclosure obligations arising from any cybersecurity incidents. The Board of Directors oversees our general risk management strategy and the most significant risks facing our business, and is responsible for ensuring that appropriate risk mitigation strategies are implemented.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: We manage data security and privacy at the highest levels. The Company's Board of Directors oversees an enterprise-wide approach to risk management (ERM), designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. Management is responsible for the Company's day-to-day risk management activities and processes, and our Board's role is to engage in informed oversight of, and provide guidance with respect to, such risk management activities and processes. The Company's cybersecurity policies, standards, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, proactive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: We also perform third party risk management assessments to help manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Our risk management team, which includes members of senior management, including our Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and General Counsel, as well as external consultants, works closely with our information technology department ("IT Department") to continuously evaluate and address cybersecurity risks relevant to our business and operations. In addition, we have set company-wide policies and procedures that directly or indirectly relate to cybersecurity matters, such as policies related to encryption standards, antivirus protection, access removal, multifactor authentication, confidential information or use of the internet, social media, email and wireless devices. These policies go through an annual internal management review and approval process.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Our CISO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors periodically. These briefings include a range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from any cybersecurity events • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.

companyName: STRYKER CORP

ticker: SYK


text: We have adopted a Cybersecurity Incident Response Policy which is designed to escalate certain cybersecurity incidents to a Cybersecurity Incident Management Team consisting of our Chief Scientific Officer, President and Chief Operating Officer, General Counsel and our information technology consultant. Depending on the circumstances, cybersecurity incidents are reported to our Chief Executive Officer and Chief Financial Officer. Senior management works to help the Company mitigate and remediate cybersecurity incidents of which they are notified in addition to notifying the Audit Committee of the Board of Directors, as appropriate.

companyName: CalciMedica, Inc.

ticker: CALC


text: Our information security program is guided by the Chief Information Security Officer (CISO) who reports to the Chief Information Officer (CIO), who reports to the Company's Interim CEO. The current CISO has approximately twenty five years of experience serving in information security leadership roles across financial, software, government and life sciences industries, including previously operating in the role of the CISO for several large companies, and possesses the requisite education, skills, experience and industry certifications expected of an individual assigned to these duties. The IT Security Team, which is comprised of certain other cybersecurity focused team members, is responsible for addressing the dynamic threats against our electronic systems and assisting the workforce with handling system incidents, including centralizing the reporting, detection and response to incidents. Incident management and response processes define the recommended teams, actions and procedures needed to recognize and respond to an incident; assess the situation quickly and effectively; notify the appropriate individuals and organizations about the incident; organize the Company's response activities, including activating a command center; escalate the Company's response efforts based on the severity of the incident; and support the business recovery efforts being made in the aftermath of the incident. Additionally, third-party security experts are regularly engaged to monitor, assess, review and analyze the information technology landscape. The Company's incident response framework also defines the roles with respect to cybersecurity risk oversight and assigns responsibility to the IT Security Team. The IT Security Team members have: (i) completed extensive cybersecurity training; (ii) have experience assessing cybersecurity incidents; (iii) actively participate in industry and government forums; and (iv) collaborate with our peers to understand and improve cybersecurity intelligence, vulnerability management and defense strategies.

companyName: Endo LP


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.

companyName: BNB PLUS CORP.

ticker: BNBX


text: Our cybersecurity team, which is led by our Digital Information & Cybersecurity Officer (DISO), implements and maintains our cybersecurity risk management program and is dedicated to mitigating risks and protecting the confidentiality, integrity, and availability of our systems and data. Our cybersecurity team's functions include security operations, vulnerability management, security engineering and architecture, compliance and audit support, threat intelligence, security awareness training, and policy development. Our cybersecurity team is also responsible for developing and executing the incident response plan.

companyName: Waystar Holding Corp.

ticker: WAY


text: Our information security management team, including our Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats. Our Interim Chief Information Security Officer, who also serves as Vice President of Security Engineering has more than ten years of experience as a network and security engineer and more than seven years of experience leading information security teams at renowned technology companies.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: The audit committee assists the Board of Directors in overseeing our cybersecurity program. Both the Board of Directors and the audit committee receive regular reports regarding material cybersecurity developments. In the case of a security incident, the ISO will report the incident directly to the Chief Executive Officer, Chief Technology Officer, Chief Financial Officer and Senior Vice President, General Counsel & Compliance Officer. The breach will then be communicated to the audit committee dependent on the materiality of the incident.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: The Audit Committee of our board of directors oversees our cybersecurity policies, procedures, risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Our executive management, including our Vice President and Chief Information Officer, periodically updates and reports to the Audit Committee and the board of directors regarding cybersecurity risk exposure and our cybersecurity risk management strategy (at a minimum, once per quarter). Additionally, all members of the board of directors attend quarterly training sessions through internal and external IT specialists, which include review of IT whitepapers, presentations, and other learning materials. Each of the members of the board of directors has also completed certificated training concerning IT security, IT fraud, and other common enterprise-level IT threats.

companyName: W&T OFFSHORE INC

ticker: WTI


text: If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.

companyName: Mechanics Bancorp

ticker: MCHB


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of confidential business information and sensitive consumer and employee personal information, which if impacted by cyber threats, could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.

companyName: BEST BUY CO INC

ticker: BBY


text: We recognize that third-party service providers may introduce cybersecurity risks to our organization. In an effort to mitigate these risks, we have implemented a process before engaging with third-party service providers which are designed to assess their cybersecurity practices. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers, requiring them to adhere to certain cybersecurity standards and protocols.

companyName: FOOT LOCKER, INC.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: We use third party vendors to perform ongoing security monitoring, reporting and forensic analysis, including annual external penetration testing. Security standards are established and defined with respect to administrator accounts, backups, encryption, passwords, website certifications, antivirus software, endpoint management, firewalls, wi-fi networks, vulnerability scanning, server protection, patching, privacy by design, and data breach reporting. We perform ongoing employee cybersecurity awareness and training activities, which includes frequent phishing testing, and we maintain cyber insurance coverage.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: Our Board retains responsibility for the oversight of management's role in assessing and managing cybersecurity risk. The Board is aware of the threats presented by cybersecurity incidents and is committed to taking measures to help prevent and mitigate the effects of any such incidents. The Company's management team, and either the CTO or the CISO or both, report at least twice annually to the Board on risks and issues including to evaluate the status of our cybersecurity efforts. The Board also discusses cybersecurity issues with external experts.

companyName: PJT Partners Inc.

ticker: PJT


text: The CIO regularly informs the Chief Executive Officer and management regarding cybersecurity risks and incidents, so they are kept abreast of the cybersecurity posture and potential risks. Significant cybersecurity matters and strategic risk management decisions are reported to the Audit Committee.

companyName: HUNTSMAN INTERNATIONAL LLC


text: Genworth's CRO has served in information technology and risk management leadership roles for over twenty years, including oversight of enterprise risk management and operational risk, as well as oversight for financial reporting systems, operational and technology platforms, and testing and quality assurance programs. He received a Bachelor of Science Degree in Decision Support Systems from Virginia Polytechnic Institute (Virginia Tech) and graduated from the Tuck Global Executive Leadership Program through Dartmouth in 2020. For more information about our CRO, see "Part III—Item 10—Directors, Executive Officers and Corporate Governance."

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: We have established an incident response plan and playbooks, which include procedures designed to respond to and recover from cybersecurity incidents. These procedures, which our IT Risk Management function reviews on an ongoing basis both internally and with third-party consultants, provide detailed descriptions of the roles and responsibilities of key stakeholders and the procedures for communication and coordination during an incident. The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated cybersecurity program oversight responsibility, and our full Board and for providing timely public disclosure, when necessary.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Assessment of cybersecurity risks, using the National Institute of Standards and Technology Cybersecurity Framework as a guide, as part of the overall IT risk assessment performed annually; Network operations center monitoring to establish baseline metrics and assist with anomaly detection; Periodic vulnerability scanning; Configuration of firewall, antivirus, and malware protection as well as alert thresholds; Generation of system audit logs and recovery backups; Preparation of an incident response plan and assignment of team members;

companyName: Ramaco Resources, Inc.

ticker: METC


text: During the period covered by this report, the Trust has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its results of operations or financial condition. For further discussion of risks related to cybersecurity, see "Risk Factors —The Custodian or any of its vendors may fail to protect the confidentiality, integrity or availability of systems or data, including Beneficiary confidential information, as a result of a failure in any of their respective cybersecurity or other information security systems, or disaster recovery plans, and any such failure may also adversely affect the Trust's operations."

companyName: METLIFE POLICYHOLDER TRUST


text: Elite has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes service level agreement monitoring and contract negotiations.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: On April 28, 2023, we identified a payment of $54,300 was incorrectly made to an unauthorized payee as a result of a phishing attack. Our management team, at the direction of the board of directors, investigated the matter and concluded that the phishing attack was an isolated incident perpetrated by an external source. With the assistance of our bank, we were ultimately able to recover all of these funds on June 29, 2023. As a result of this phishing attack, we have implemented additional controls related to vendor verification and additional review procedures of each payment made by several authorized individuals.

companyName: Four Leaf Acquisition Corp

ticker: FORL


text: Governance—Board Oversight and Management's Role in Assessing and Managing Cybersecurity Risks Our board of directors and Chief Executive Officer have ultimate accountability for risk and establishing the risk-culture of the Company. This includes oversight of our risk management program, which includes risks from cybersecurity threats. Our board of directors and Chief Executive Officer, including through the risk management committee of our board of directors, provide oversight to ensure the appropriate measures are in place so that management can identify, assess, prioritize, and respond to risk, including cybersecurity risks. We believe our board of directors, the risk management committee of our board of directors, and our Chief Executive Officer collectively have the requisite experience, knowledge, inquisitiveness, and visibility into the design and operation of our information security practices to fulfill this responsibility effectively.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Signet recognizes the importance cybersecurity has to the success of our business. We also recognize the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, including customer records and information, against known and evolving cybersecurity threats.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: scPharmaceuticals Inc.


text: The Company maintains an enterprise monitoring and reporting program, which identifies key risk indicators for tracking and identifying trends. The key risk indicators are presented to the Company's IT Committee and th e Board on a monthly basis.

companyName: Investar Holding Corp

ticker: ISTR


text: While we evaluate all security incidents and consider the materiality of individual or combined incidents, to date, no incidents or combination of incidents have materially affected the Company or our financial position, results of operations, and/or cash flows. We continue to invest in cybersecurity to enhance the design and effectiveness of our internal controls and processes to protect our systems, networks, and integrity of our data.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.

companyName: Phillips 66

ticker: PSX


text: Key components of this include: • Vulnerability assessments - initiating regular evaluations to identify potential weaknesses in our systems. • Security controls and policies - establishing robust security measures and formal company-wide policies. • Employee training - training programs to ensure all employees are equipped to prevent and respond to cyber threats effectively. • Incident response plan - designing and implementing a well-defined plan for addressing cybersecurity incidents. • Continuous monitoring - establishing mechanisms for proactive monitoring of our environment to detect and respond to anomalies.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.

companyName: Solidion Technology Inc.

ticker: STI


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, and Chief Financial Officer. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems. The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: QMIS TBS Capital Group Corp.


text: Notwithstanding the Bank's efforts at cybersecurity, the Bank cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Bank, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A. Risk Factors– Risks Related to Our Business.

companyName: RBB Bancorp

ticker: RBB


text: Our Chief Information Security Officer reports to our Chief Information Officer. Our Chief Information Security Officer has more than 25 years of experience working in information technology-related roles, of which 10 years has been in information security leadership, and holds degrees in bio-medical engineering and computer science. CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: We require Autodesk's third-party service providers and suppliers to implement and maintain appropriate security measures consistent with applicable laws in connection with their work with us and to promptly report any suspected breach of their security measures that may affect our Company.

companyName: Autodesk, Inc.

ticker: ADSK


text: We engage in the periodic assessment and testing of our cybersecurity policies and practices. These efforts include a range of activities focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on various aspects of our cybersecurity measures, including information security maturity assessments, audits, and reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Audit Committee, and we adjust our cybersecurity processes as necessary based on the information provided by these assessments, audits, and reviews.

companyName: GATX CORP

ticker: GATX


text: Berkshire recognizes that maintaining processes for identifying, assessing, and managing cybersecurity threats is important in dealing with its significant business risks. As such, Berkshire has implemented a framework for cybersecurity and cyber-related information management across Berkshire's diverse groups of businesses. The framework permits each Berkshire Business Group ("Business Group") to tailor solutions to identify, manage, and mitigate risks based on their own assessment of their unique cybersecurity risks in conjunction with each Business Group's overall risk management processes. At the same time, the framework helps enable consistent and appropriate compliance in reporting material cyber events and risks across Berkshire.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: Risks from cybersecurity threats, including any previous cybersecurity events, did not materially affect the Company or its business strategy, results of operations or financial condition during the period covered by the report. Notwithstanding the comprehensive approach that the Company takes to address cybersecurity risk, the Company may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, and processes and controls supporting data protection requirements under applicable law. The NIST CSF offers a thorough set of guidelines and best practices to help establish a strong cybersecurity posture. Utilizing NIST CSF enables us to systemically identify, assess, and manage cybersecurity risks most relevant and impactful to our business operations. It is important to note that using the NIST CSF as a guide does not imply our cybersecurity program meets any specific technical standards or requirements.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Given the ever-changing cyber risk landscape the Company continues to evolve its oversight process. During the year ended December 31, 2023, the Company conducted an assessment in accordance with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and is in the process of implementing additional policies and procedures to further enhance the Company's cybersecurity practices.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: Notwithstanding the foregoing, we have not identified and are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. See "Risk Factors – Actual or perceived failures or breaches of our information and security systems, or those of our customers, suppliers or business partners, could expose us to losses."

companyName: Genasys Inc.

ticker: GNSS


text: d. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. Such insurance may be insufficient to cover all losses or all types of claims that may arise.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Our Board of Directors is responsible for overseeing management's overall approach to risk management, including cybersecurity risk. In addition, the Committees of the Board report to the full Board at regularly scheduled Board meetings on any identified material risks within that Committee's area of responsibilities and oversight, as well as when new risks arise. The Audit Committee has responsibility for oversight of the Company's cybersecurity risks.

companyName: RALPH LAUREN CORP

ticker: RL


text: Many of the Company's IT systems operate with a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems could stop functioning for a period of time, which could put our users at risk. Accordingly, our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers, and our vendor management process is an important part of our risk mitigation strategy. In particular, we obtain reports from our vendors handling sensitive data as to their efficacy and efficiency in managing cybersecurity issues and follow-up with them on any potential or actual issues. Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security breach, or other extraordinary event, the Company, and our service providers, may be unable to provide our products or services for the duration of the event and/or a time thereafter.

companyName: Digital Brand Media & Marketing Group, Inc.

ticker: DBMM


text: We work to identify and address our cybersecurity risks through a comprehensive, cross-functional approach. Key security, risk and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to encourage prompt escalation of certain cybersecurity incidents so that decisions regarding customer disclosure, public disclosure and reporting of such incidents can be made by management and the board of directors in a timely manner.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Cybersecurity Governance InfuSystem maintains a dedicated cybersecurity governance framework led by our Chief Information Officer (CIO). The CIO serves as an Executive Officer who reports directly to senior management and makes regular reports to the audit committee. Management reports to the Board of Directors with respect to cybersecurity matters. Given the position cybersecurity has in the Company's strategy to be the most trusted partner for our clients and the potential costs to the business of a major cybersecurity event, Cybersecurity is a standing topic for the audit committee, and Board of Directors. For more information regarding the expertise of management, see "Executive Officers" in our definitive proxy statement relating to the 2023 Annual Meeting of Stockholders filed with the SEC on April 10, 2023.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: The Committee periodically reports to the full Board regarding its activities, including those related to cybersecurity. Committee members receive presentations on cybersecurity topics from our Senior Director, Information Security, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies. Our management team, including Vroom's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief People and Culture Officer, and Head of Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security program and personnel and certain of our retained external cybersecurity consultants. Our Senior Director of Information Security, reports to the VP of Engineering and is the head of the Company's cybersecurity team. The Senior Director of Information Security is responsible for overseeing the Company's security team and related initiatives. He has twenty-five years of experience in the technology industry with over ten years of experience in cybersecurity.

companyName: Vroom, Inc.

ticker: VRM


text: Board Oversight of Cybersecurity Risks The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to the Company's risk management, including risks associated with cybersecurity threats. Certain members of the Company's management will periodically report to the Board, on at least a quarterly basis, on cybersecurity matters, such as the overall state of the Company's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and material cybersecurity incidents.

companyName: FIDUS INVESTMENT Corp

ticker: FDUS


text: Furthermore, through our incident response plan, we believe we have a well-designed plan to manage through any unforeseen breach including the eradication of the infiltrator from our networks. We carry cyber insurance to transfer the residual risk of an incident. We also work with our cyber insurance carrier to regularly refine our response procedures, which include the definition of internal and external communications channels to key stakeholders, as well as the identification of material breaches and the associated incident reporting up to senior management and our Board of Directors.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Our Chief Information Officer (the "CIO") meets at a regular cadence with a member of the board of directors who is the board's cybersecurity designee. The CIO also briefs the audit committee on the effectiveness of Wolfspeed's cyber risk management program quarterly or in accordance with significant events. In addition, the board of directors is advised by our CIO on Wolfspeed's cybersecurity risk exposures and steps taken to monitor and mitigate cybersecurity risks.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Board Oversight and Management's Role Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our management, including the SC (defined below) and our senior IT leadership and third parties on cybersecurity matters. The Audit Committee reports to the Board regarding its activities, including those related to cybersecurity. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed therein, in regular business updates.

companyName: Nine Energy Service, Inc.


text: We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks and is currently being integrated into our overall enterprise risk management process. We regularly assess our cybersecurity vulnerability by utilizing credible, third-party cybersecurity experts to conduct annual internal penetration tests and monthly vulnerability scans. These threat intelligence and monitoring activities, tests, and scans help us identify potential cybersecurity risks.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: The Company's CISO reports to the Vice Chair and Chief Risk Officer, Jodi L. Richard, who has served in that position since October 2018. She served as Executive Vice President and Chief Operational Risk Officer of the Company from January 2018 until October 2018, having served as Senior Vice President and Chief Operational Risk Officer from 2014 until January 2018. Prior to that time, Ms. Richard held various senior leadership roles at HSBC from 2003 until 2014, including Executive Vice President and Head of Operational Risk and Internal Control at HSBC North America from 2008 to 2014.

companyName: US BANCORP \DE\

ticker: USB


text: Independent Assessments. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: To date, we have not experienced any material losses or interruptions relating to cybersecurity incidents; however, there can be no assurance that we will not suffer such losses in the future. For further discussion regarding cybersecurity risks and their impact on our business strategy, results of operations and financial condition, see the risk factor entitled "A cyber incident could result in information theft, data corruption, operational disruption and/or financial loss" under the heading " Risk Factors " in Item 1A of this Annual Report.

companyName: SOUTHWESTERN ENERGY CO


text: We have developed and implemented processes for identifying, assessing, and managing cybersecurity risks as part of our overall enterprise risk management program. These processes are designed to protect our information technology and operational systems against cybersecurity threats. In connection with the operation of our program, we take into consideration guidance from various recognized cybersecurity industry frameworks and standards such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST") and the International Organization for Standardization ("ISO") 27001 standards. We are certified and externally audited to ISO / IEC 27001:2022. We leverage a controls framework, based on these industry frameworks and standards, as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risk is collected as part of our annual cybersecurity risk assessment and overall enterprise risk management program, including as part of the annual enterprise risk assessment survey conducted by our internal audit team, the results of which are summarized and provided to our Audit Committee.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Data Sciences and IT, who has prior work experience in information technology, and our Director of IT, who has experience in network security and systems administration. The Vice President of Data Sciences and IT and Director of IT have a combined 25 years of risk management experience. Our Vice President of Data Sciences and IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: OmniAb, Inc.

ticker: OABIW


text: Under the ultimate direction of our CFO, with oversight from the Board, we maintain a security governance structure to evaluate and address cyber risk.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: We identify and categorize existing third-party service providers based on criticality to our operations and prioritize those that pose the highest risks. We leverage a third-party risk management solution to facilitate our risk assessment process for new third parties which includes interviews and questionnaires with internal business contacts and contacts from the third party to perform an inherent risk assessment. We determine applicable security controls based on the inherent risk level to drive the residual risk score to an acceptable level where possible. The goal of the assessment process is to evaluate the risks associated with each third party, including operational, financial, legal, and reputational risks.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Our Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least quarterly each year, the Board discusses the Company's approach to cybersecurity risk management with our Chief Information Security Officer.

companyName: BOYD GAMING CORP

ticker: BYD


text: The Committee also receives briefings from management on our cyber risk management program. Committee members receive presentations on cybersecurity topics from our finance department, including our Chief Financial Officer and external experts as part of the Board's continuing education on topics that impact public companies.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how cybersecurity incidents, ransomware attacks, and other disruptions to Ford and Ford Credit's operational information systems, security systems, vehicles, and services could reasonably be expected to affect Ford and Ford Credit, including their business strategy, results of operations or financial condition, see our risk factors above in Item 1A. generally and, in particular, "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers" on page 18.

companyName: FORD MOTOR CREDIT CO LLC


text: In the ordinary course of our business, we, and third parties upon which we rely, collect, use, store and transmit confidential, sensitive, proprietary, personal and protected health information. The secure maintenance of this information is important to our operations and business strategy. To this end, we have implemented various cybersecurity plans and processes designed to manage cybersecurity risks relating to our third party hosted services, communications systems, hardware and software, and our critical data, including data related to our clinical trials and investigational products.

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: Our enterprise risk management program is overseen by a risk management committee comprised of senior managers across key functional areas that cover cybersecurity and information technology matters. This committee provides periodic reports and updates, as needed, to the board of directors or one of its designated committees. In collecting information on enterprise risk, cybersecurity is included as a designated risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: META MATERIALS INC.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function. These processes are designed to help protect our information assets and operations from internal and external cyber threats, protect employee, vendor, and collaborator information from unauthorized access or attack, and secure our networks and systems. They include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our cybersecurity risk management practices. We engage certain external parties, including consultants with expertise in information security, cybersecurity incident response, and governance, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party information technology service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Within management, our Chief Information Security Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Our Chief Information Security Officer is supported by the Chief Information Officer or Information Technology Director, as applicable, of our business units with respect to the assessment and management of our material risks from cybersecurity risks on a day-to-day basis. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.

companyName: Cryoport, Inc.

ticker: CYRX


text: An external vendor risk management platform is utilized to evaluate, rate, monitor, and track vendor risk pertaining to our critical vendors. The security practices and processes of the service providers are monitored regularly, and periodic assessments may be performed on the service providers'compliance with cybersecurity terms, based on the service providers' risk. For any of our hosted applications we by default require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third party providers is part of our overall cybersecurity risk management framework.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: We did not experience any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: All of our employees are trained at least annually on cybersecurity threats and our information security procedures, which reinforces our information security policies, standards and practices.

companyName: CEVA INC

ticker: CEVA


text: • The Executive Risk Committee: This committee provides a forum for our top management to have integrated discussions of risk management across the enterprise, including cybersecurity and technology risk, with the purpose of ensuring prioritization and awareness, encouraging alignment, and coordinating risk management activities among key executives. Primary responsibility for specialized risk categories, such as cybersecurity and technology, can also be delegated to other senior management sub-committees, as appropriate.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Once a risk is identified, we analyze the risk and assign a risk classification based upon a combination of factors, including data volume, legal and regulatory requirements, privacy considerations, and intellectual property considerations. Risks are classified as (i) Low Risk, where unauthorized disclosure could be expected to have a limited adverse effect on operations, assets, or individuals; ( 2) Medium Risk, where unauthorized disclosure could be expected to have a serious adverse effect on operations, assets, or individuals; or ( 3) High Risk, where unauthorized disclosure could be expected to have a severe or catastrophic adverse effect on operations, assets, or individuals. Before granting access to Information Assets, we assess the relationship of the user and associated risks of the Information Assets to determine if access is appropriate, and we periodically review access rights to ensure compliance and prevent unauthorized access.

companyName: Clene Inc.

ticker: CLNN


text: To our knowledge cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: Liberty Global and its subsidiaries are subject to risks from cyber-attacks that have the potential to cause significant interruptions to the operation of their businesses. The frequency of these attempted intrusions has increased in recent years and the sources, motivations and techniques of attack continue to evolve and change rapidly. Liberty Global has developed a cybersecurity program that is designed to scan for, monitor and identify risks to company confidential or non-public information, protect such information, detect threats and events and maintain an appropriate response and recovery capability to help ensure resilience against cyber-attacks and other information security incidents. We have adopted a variety of measures to monitor and address cyber-related risks and continue to implement and explore additional cybersecurity measures.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: The Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Please see Item 1A—Risk Factors—Magnolia's business could be adversely affected by security threats, including cybersecurity threats, and related disruptions in this Annual Report on Form 10-K for further discussion regarding the Company's cybersecurity risks.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: We have implemented and maintain various measures to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program, a business continuity program and cyber insurance coverage, as well as regularly testing our systems to discover and address any potential vulnerabilities. The Company also conducts periodic cybersecurity awareness training for employees and provides cybersecurity updates, where appropriate, to its employees during regularly scheduled meetings. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks.

companyName: Greenbacker Renewable Energy Co LLC


text: Management's Role in Assessing and Managing Cybersecurity Risk ExchangeRight's Senior Information Technology and Enterprise Applications Manager leads our information security team, which is responsible for developing and executing our enterprise-wide cybersecurity strategy. With over 13 years of experience in information technology, security strategy, program management, and internal controls, our information security team brings extensive expertise in evaluating, implementing, and overseeing security initiatives that protect our organization from cyber threats.

companyName: ExchangeRight Income Fund


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third-party risk management and business resilience as it relates to the cybersecurity program.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on BIOLASE's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: BIOLASE, INC


text: The Company has a documented information security program (the "Program"), which is integrated into its overall risk management processes, to identify, assess, monitor and manage potential cybersecurity threats and incidents. The Program is designed to protect the confidentiality, integrity and availability of our information systems and assets that store, process, or transmit information. The Program is modeled on the global standard for risk assessment, International Organization for Standardization 27001, and is guided by the six domains of cybersecurity established by the National Institute of Standards and Technology Cybersecurity Framework (i.e., govern, identify, protect, detect, respond, and recovery). The Program seeks to adhere to applicable U.S. and international laws and regulations, including New York State's cybersecurity regulation applicable to financial services institutions authorized by the New York State Department of Financial Services.

companyName: BERKLEY W R CORP

ticker: WRB


text: The Audit Committee. The Audit Committee reviews with our management team, including our vice president of information technology services, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies, and risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks, and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: While we plan to dedicate significant efforts and resources to our cybersecurity program, we may be unable to successfully identify threats, prevent attacks, satisfactorily resolve cybersecurity incidents, or implement adequate mitigating controls. Any breach of our network security and information systems or other cybersecurity-related incidents that results in, or may result in, the loss, theft or unauthorized disclosure of data, or any delay in determining the full extent of a potential breach, could have a material adverse impact on our business, results of operations, and financial condition, including harm to our reputation and brand, reduced demand for our solutions, time-consuming and expensive litigation, fines, penalties, and other damages. To date and except as otherwise may be noted in this Annual Report, we are not aware of any cybersecurity threats, nor have we had any cybersecurity incidents.

companyName: Trio Petroleum Corp

ticker: TPET


text: Technology is a key component of our business operations, and cybersecurity is a significant consideration for the firm. T. Rowe Price has a holistic firm-wide approach to risk management including material risks from cybersecurity threats. The firm's overall risk management activities are designed to identify, assess, report, and manage risks that could affect the firm in achieving its objectives and goals. This risk management framework operates across our business lines and integrates business operational resiliency and technology related risks such as cybersecurity threats. As part of the firm's risk identification and assessment framework, key risks from cybersecurity threats specific to our environment are identified and assessed for adequacy of controls. Management identifies risk inherent to cybersecurity threats, estimates the significance of the risks, assesses the likelihood of their occurrence, establishes acceptable risk tolerance levels, and implements appropriate measures to monitor those risks. Action plans may be developed for identified control issues and management is responsible for addressing these issues.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: As part of our ERM, our Board of Directors reviews and approves the Program on an annual basis. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management's reporting on Program effectiveness. In addition to a Privacy and Security Governance Committee, we also have Governance, Risk, Information Technology and Compliance functions that monitor and address enterprise risks, including cybersecurity risks.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: The identification, assessment and management of cybersecurity risks are integrated into our existing enterprise risk management ("ERM") framework. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis, which are presented to and reviewed by the Audit Committee.

companyName: CROWN CASTLE INC.

ticker: CCI


text: To date, Seadrill's business strategy, operations, and financial condition have not been materially affected by large-scale cybersecurity threats or incidents. For more information on the risks related to Cybersecurity, please refer to Part I, Item 1A, "Risk Factors - Risks Relating to Our Business and Industry - Failure to adequately protect our sensitive information, operational technology systems and critical data, or our service providers' failure to protect their systems and data could have a material adverse effect on us."

companyName: Seadrill Ltd

ticker: SDRL


text: Our Board has established a Technology and Information Security Oversight Committee ("TISOC") to assist the Board in providing oversight of matters pertaining to technology, information security, and privacy, including risks from cybersecurity threats; management's efforts to monitor and mitigate those risks; and significant cybersecurity incidents. The TISOC meets at least four times per year and typically receives reports from our Chief Information Security Officer ("CISO") and other members of management about these matters. The Board's Audit Committee receives reports regarding information security and technology-related audits conducted by our internal audit department. Risks from cybersecurity threats are also discussed with the full Board as part of regular legal updates and management presentations, the Board's oversight of enterprise risk management, and periodic education sessions.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Information technology and data security, particularly cybersecurity, are areas of focus for our board of directors and its audit committee. We employ a multi-layered security model that leverages risk-based controls with a focus on protecting our residents' and associates' data. We follow a cloud-first approach to enable efficient scaling, robust business continuity, and access to the latest technology innovations.

companyName: Invitation Homes Inc.

ticker: INVH


text: During the fiscal year ended December 31, 2023, we did not experience any cybersecurity incidents that materially impacted, or are reasonably likely to materially impact, our business strategy, results of operations or financial condition. Please refer to the risk factors described in this report under Item 1A, "Risk Factors," for a discussion of the potential impacts of future cybersecurity events.

companyName: WEYCO GROUP INC

ticker: WEYS


text: It is the policy of the Company and its technology service providers they can identify, attacks such attacks, etc. This commitment aligns with the Company's risk appetite, Incident Response Policy, and Business Continuity Plan, which incorporates business continuity planning and testing activities to enhance response and recovery capabilities.

companyName: USCB FINANCIAL HOLDINGS, INC.

ticker: USCB


text: Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and operations information and the steps management is taking to monitor and control these risks. In the future, our Information Security Team will conduct regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues.

companyName: Crucial Innovations, Corp.


text: We recognize the critical importance of maintaining the trust and confidence of investors, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO). In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Governance; Company's sole director and officer provides direct oversight over cybersecurity risk.

companyName: Regen BioPharma Inc

ticker: RGBP


text: Key components of our cybersecurity risk management program include: risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment;

companyName: Plymouth Industrial REIT, Inc.


text: Risks from Material Cybersecurity Threats Cybersecurity risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, consolidated financial condition, results of operations, or cash flows. Refer to Part I, Item 1A, "Risk Factors," for more information on SEE's risks relating to our technologies, systems, and networks.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: Our Cybersecurity Program and team of cybersecurity professionals and resources are led and supervised by our Vice President of Information Technology, who has over 25 years of experience in information technology. To execute the Cybersecurity Program and promote compliance with applicable cybersecurity laws, regulations, and reporting requirements, we utilize internal and external technical experts in cybersecurity risk management, data and network security structures, and incident response and security operations. Our cybersecurity team monitors the prevention, detection, mitigation, management, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. As part of the Cybersecurity Program, our executive management team is regularly informed about the monitoring, prevention, detection, mitigation, management, and remediation efforts.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: Our Chief Information Officer and Chief Technology Officer of Software are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Information Officer and Chief Technology Officer of Software are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: NETGEAR, INC.

ticker: NTGR


text: Overseeing Third-party Risk We rely on third parties for various business functions. In certain circumstances, our third-party services providers have access to some of our information systems and data, depending on the nature of their engagements with us, and we rely on such third parties for the continuous operation of our business operations. Because of the risks associated with third-party service providers, we conduct vendor diligence and security assessments of certain third-party providers before engagement and maintain ongoing monitoring to oversee compliance with our cybersecurity standards.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, consultants, and auditors in evaluating and supporting our risk management systems. Our collaboration with these third parties includes regular independent audits, threat assessments, and consultation on security enhancements.

companyName: Rapid7, Inc.

ticker: RPD


text: The Cybersecurity Program is managed by the CIO, and the Company's IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices. The current CIO has over two decades of experience in various roles in information technology and information security. The CIO and the IT team work with the business to implement the Cybersecurity Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Response Plan. The CIO and the IT team use detection tools to monitor for cybersecurity threats and incidents in real time, apply mitigation and remediation steps and then report such threats to the Audit Committee and the Board, as appropriate.

companyName: BORGWARNER INC

ticker: BWA


text: This dependence exposes us, along with others who use these service providers, of a cyber breach on their service providers.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: The Company's Information Technology ("IT") Director is responsible for developing and implementing our cybersecurity program and has over 20 years of cybersecurity experience in various roles involving information security, developing cybersecurity strategies, and implementing cybersecurity programs. Our program includes that all employees complete annual cybersecurity awareness training. The IT Director is responsible for reporting audit findings and risk information to the Company's Chief Financial Officer ("CFO").

companyName: FutureFuel Corp.

ticker: FF


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls utilizing guidelines from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) for our protection and prevention of cybersecurity, risk management, data backup, and disaster recovery.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: Our cybersecurity team performs tests, encompassing vulnerability assessments, penetration testing, and threat simulations. The results derived from these assessments are prioritized and integrated into the workflow of our development and operations teams to ensure that identified vulnerabilities and insights gleaned from the tests are promptly addressed. We also have an established process led by our Senior Vice President governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our Chief Executive Officer and the Board of Directors.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: The Audit Committee of the Company's Board is responsible for overseeing the Company's policies and practices related to cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including: • current cybersecurity threat landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learning from unique cybersecurity events, including those of other companies; and • compliance status and efforts with regulatory requirements and industry standards.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: The Company engages reputable third-party assessors to conduct various independent risk assessments on a regular basis, including but not limited to maturity assessments and various other tests. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: of the likelihood of the risks manifesting, the severity of the potential consequences and prioritization of different risk items based on, among other things, importance to the business and cost/benefit analysis to fully address; and execution - establishment of a program to address.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversight of cybersecurity and other information technology risks.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: We act as a trusted business partner in providing both front-office and back-office platforms. As part of our business process outsourcing solutions, we develop system software platforms necessary to support our customers' needs, with significant ongoing investment in developing and operating customer-appropriate operating systems, databases, and system software solutions. We also receive, process, transmit, and store substantial volumes of personal information relating to identifiable individuals. Additionally, we receive, process, and implement financial transactions and disburse funds on behalf of both commercial and government customers.

companyName: CONDUENT Inc

ticker: CNDT


text: Our Information Security department, which is our first line of defense, operates under our Chief Information Security Officer, who manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches At least annually, the first line conducts mandatory teammate training on information security and provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials. O ur cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, and escalate cyber threats. We also have a business risk manager within our first line of defense whose role is to focus on evaluating, managing, and escalating technology risks. The escalation process includes a weekly escalation report of problem incidents, including cybersecurity threats, which allows for collaborative threat management by the first and second lines of defense.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Third-party service provider risk is evaluated prior to and throughout the relationship. Third-party service providers must meet a minimum set of baseline security standards prior to being onboarded. During onboarding, the third party and the services they provide are added to the Information Security Risk Assessment, including consideration of inherent risk factors and mitigating controls. Alternative vendors and the effort to transition between vendors are identified during onboarding as well as in the event that the selected provider may fail in providing contracted services at any time. After a third party is onboarded, they are subject to the annual third-party risk management program, specific to their assigned risk criticality. This effort includes the review of service organization controls reports, business continuity and disaster recovery efforts, insurance certificates, and other compliance related concerns when applicable.

companyName: Investar Holding Corp

ticker: ISTR


text: Our CCO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, in close coordination with the senior executive leaders of our corporate information technology function and Video and Broadband business segments. The processes by which our CCO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: regular reports from the Company's 24/7 cybersecurity operations center monitoring systems and established incident reporting and escalation from the executive leaders of our corporate information technology function and Video and Broadband business segments.

companyName: HARMONIC INC.

ticker: HLIT


text: Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends. Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy. Our Director maintains the following internationally recognized certifications: Global Information Assurance Certification ("GIAC"), GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification. Our Director reports to our Vice President of Information Technology, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Vice President of Information Technology has over 20 years of experience in developing and executing strategic initiatives to drive organizational growth and innovation, with responsibilities for IT governance, technology strategy development, and cybersecurity. In additional to a Masters of Business Administration, our Vice President of Information Technology holds a Certified Information Systems Security Professional certification.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, our incident response policy, incident detection and response procedures, encryption of certain data, network security controls, and data segregation across certain of our environments, access controls, physical security, systems monitoring, employee cybersecurity training, penetration testing conducted by third-parties, and maintaining cybersecurity insurance.

companyName: CHIMERIX INC


text: Our cybersecurity risk management program includes: • dedicated cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents, • cybersecurity regulatory based risk assessments for the Company's systems and applications (where required), • a formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident, • annual information security training program for all employees, including phishing awareness training, • cybersecurity works closely with application development and infrastructure & operation teams to embed security considerations into the foundation of technology, • engagement of third-party service providers to conduct assessment of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing, • a third-party risk assessment process for service providers, suppliers, and vendors.

companyName: Medtronic plc

ticker: MDT


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee ("the Audit Committee"). The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Cybersecurity risks and activities are reported quarterly to the Information Technology Steering Committee and the Enterprise Risk Management Committee. The Bank's chief risk officer and interim chief information officer are part of the Information Technology Steering and Enterprise Risk Management Committees. The Bank's interim chief information officer has over 30 years of experience managing technology.

companyName: Sterling Bancorp, Inc.