text: Our data breach response designates an incident response team comprised of senior leaders within information technology, finance and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including but not limited to the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: determining relevant stakeholders of the Information Technology function and cybersecurity incident response team, which team is selected by CIRC to serve as the lead function for investigating and coordinating cybersecurity incidents;

companyName: TERADATA CORP /DE/

ticker: TDC

secItem: Item 1C


text: We do not currently engage third parties with respect to our cybersecurity risk management processes due to our limited resources and operations.

companyName: EXICURE, INC.

ticker: XCUR


text: On an ongoing basis we conduct cybersecurity risk assessments, including compiling, reviewing, and acting on information garnered from internal stakeholders, known security vulnerabilities, and data from external sources. The results of these assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: In the past three years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: In the event of a cybersecurity incident, the Company has an incident response plan. This plan outlines the steps we take to detect, respond to and recover from such incidents. Our security operations include monitoring conducted by a third-party provider in collaboration with internal teams. The Company has also invested in modern cybersecurity tools to protect and detect the systems and data from attacks and compromises.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: The Chief Information Officer (CIO), with more than 20 years of experience in information and operational technology, holds primary responsibility for the cybersecurity program. Under the CIO's leadership, the IT team continuously evaluates risk postures and safeguards Alternus' critical cyber assets. Their efforts are designed to provide resilience against both common and sophisticated cyber threats.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including the Vice President of Informatics, who has more than 20 years of experience in information technology and oversees the Informatics department which includes the Company's hardware, software, help desk, and cybersecurity team.

companyName: Personalis, Inc.

ticker: PSNL


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.

companyName: CRYO CELL INTERNATIONAL INC

ticker: CCEL


text: run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies;

companyName: Molecular Templates, Inc.


text: Identifying and assessing cybersecurity risk is part of our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, IT Security Risk reviews, external audits and assessments, penetration tests, vulnerability scans, security monitoring activities and recurring review from our internal cybersecurity working group. We respond to cybersecurity incidents and address identified cybersecurity risks through our internal cybersecurity working group and report any material findings and incidents to the audit committee of our board of directors.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Regarding employee information, our Company generally keeps all employee personally identifiable information with our payroll service provider. Each year the provider furnishes us with their SOC report which includes their cybersecurity policies and procedures.

companyName: GUIDED THERAPEUTICS INC

ticker: GTHP


text: We have established policies and processes designed to assess, identify, and manage material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We monitor our environments to identify cybersecurity threats, as well as assess our environments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: We employ risk management, mitigation and prevention strategies based on frameworks provided by the National Institute of Standards and Technology ("NIST") regulation standards, third party cyber service providers, and common industry practices. These frameworks are applied across all network, hardware, software and communication platforms whether the platform is self-hosted or provided as a service. We leverage a Risk Assessment Score ("RAS") based on these standards against any internal networks, platforms, technologies or initiatives as well as any perimeter or connected partner, vendor or third-party service.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Cybersecurity, data privacy, and data protection are critical to NTIC's business. In the ordinary course of business, NTIC collects and stores certain confidential information, such as information about employees, contractors, vendors, customers, and suppliers. NTIC has processes in place for assessing, identifying, and managing material risks from cybersecurity threats, and NTIC regularly assesses its performance and identifies areas for improvement. NTIC also has implemented measures to safeguard its entire cyber network. Management continually re-assesses NTIC's cybersecurity risk environment based on changing circumstances and new information identified by monitoring, scanning and testing its systems, as well as utilizing third party resources for testing.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: As an externally advised company, our day-to-day operations are managed by our adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior FS Investments professionals and our adviser is an affiliate of FS Investments. As such, we are reliant on FS Investments for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Certain of our information technology applications are externally audited as part of our Sarbanes-Oxley audit program and our controls include information security standards. We design and assess our information security program based on the National Institute of Standards and Technology Cyber Security Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We regularly engage appropriate external resources regarding emerging threats to navigate the diverse cybersecurity landscape. In addition to ensuring adequate safeguards are in place to minimize the chance of a successful cyber-attack, the Company has established well-defined response procedures to effectively address cyber events that may occur despite these robust safeguards. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents to ensure a timely, consistent, and compliant response to actual or attempted data incidents impacting the Company. The Company devotes appropriate resources and enlists partners to adapt to the evolving threat landscape.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our Board of Directors oversees management's processes for identifying and mitigating enterprise-wide risks, including cybersecurity and related information technology risks. Our Audit Committee receives updates from our CIO and CISO on our technology and cybersecurity program and receives independent external expert evaluations of our program using industry frameworks, including the NIST-Cybersecurity Framework.

companyName: Catalent, Inc.


text: The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company's risk management strategy.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes to manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to our company.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: While acknowledging the existence of various cybersecurity risks, to date, they have not materially affected our business strategy, results of operations or financial condition. Although we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: End Point Security: We allow access to all information assets only from authorized and standard devices ("endpoints"). All endpoints have a next-generation anti-virus tool installed that uses a combination of artificial intelligence, behavioral detection, and machine learning algorithms to anticipate and prevent known and unknown threats. All endpoints also have an extended detection and response ("XDR") tool installed that provides a proactive approach to threat detection and response by collecting and correlating data across multiple security layers. Alerts from all these tools are actively monitored and appropriate alerts/escalations are issued.

companyName: International Seaways, Inc.

ticker: INSW


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests look at our customer facing applications, how we respond to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.

companyName: FNB CORP/PA/

ticker: FNB


text: Our cybersecurity team, which assesses and manages our risks from cybersecurity threats, is led by the CISO, who reports to our Chief Financial Officer. Additional oversight for assessing and managing cybersecurity risk include the Security Steering Committee and as part of our ERM program.

companyName: PENTAIR plc

ticker: PNR


text: Our Board of Directors is part of the Company's Cyber Response Task Force and table top simulations. Additionally, the Board of Directors have delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems related to the Company's people, assets and information systems. The Audit Committee receives regular updates from the SVP, IT, about information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least two times a year, with interim updates as needed. Additionally, we have protocols by which certain cybersecurity incidents are reported promptly to the Chief Executive Officer, or the Audit Committee, as appropriate. A Cyber dashboard is also provided to the Board of Directors quarterly.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our CTrO leads our Trust and Security organization, focusing on maintaining customer trust and overseeing the overall security posture of the company. The CTrO's role involves managing cybersecurity risks and reviewing whether the company's security practices align with customer expectations and industry standards. Our CISO leads our Security organization and is responsible for all security-related activities and controls at Atlassian. This includes defining the security strategy, developing, and enforcing security standards, and managing security technologies. The CISO also oversees security operations, incident response, and reviews compliance with legal and regulatory requirements. Our CTrO has served in his role since October 2023 and has extensive experience in the cybersecurity space, including previously serving as Chief Trust Officer of a large publicly-traded enterprise software company. Our CISO has served in his role since December 2024 and also has extensive experience in cybersecurity, including serving as Chief Information Security Officer of a large publicly-traded enterprise software company. Our CTrO and CISO oversee our efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: Atlassian Corp

ticker: TEAM


text: Key elements of our cybersecurity risk management program include but are not limited to: authentication and authorization procedures, employee security awareness training, logging and monitoring procedures, network segmentation requirements, in transit and at rest encryption of certain data we deem sensitive, periodic vulnerability scanning, periodic control validation through penetration testing, periodic phishing attack simulations, production change control requirements, periodic tabletop exercises, and written incident response plans. We also use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We maintain a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: We use processes to oversee and identify material risks from cyber threats associated with our use of third-party technology and systems. We maintain processes to reduce the impact of a cyber attack at a third-party vendor. We maintain a cybersecurity incident response plan, which details the incident response procedures and points of contact related to the response processes. The response plan includes a decision-tree-based playbook, which is a supplement to the plan, and focuses on specific types of incidents and the appropriate response steps.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through regular communication, trainings and mock cybersecurity exercises to increase company awareness.

companyName: Merus N.V.


text: Controls, Procedures and Technical Safeguards The Company has enterprise security policies, controls and procedures designed to protect the confidentiality, integrity, and availability of our information assets. Among other areas, the comprehensive system addresses intrusion detection, encryption, device hardening, and monitoring through various controls, including phishing protection solutions, administrative password management tools, system patching, encryption, and intrusion prevention and detection systems.

companyName: MANITOWOC CO INC

ticker: MTW


text: With respect to internal management, the CISO and CIO meet regularly to discuss the activities and operations of the information security team, and the CIO holds regular meetings with our chief executive officer to discuss cyber related matters, information technology issues, and cybersecurity threats. To enhance awareness, monitoring, and oversight of cybersecurity risks, management also uses the following internal committees (in addition to the enterprise risk management committee discussed above): (1) the IT strategy and investment committee, which is comprised of senior executives and helps provide oversight of the investment and strategic direction for the Company's IT function, (2) the IT steering committee, which is comprised of leaders from various business units and helps provide oversight and direction for inter- and intra-departmental IT related initiatives, and (3) the vulnerability management working group, which is comprised of IT leaders and helps establish appropriate roles, responsibilities, and escalation paths to resolve department and enterprise vulnerabilities within service level agreements.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: Cybersecurity is a key priority at the board level. Our Board of Directors provides governance of cyber-related risk management by establishing management and oversight expectations. The Board approves cybersecurity policies, including the annual cybersecurity insurance policy, and ensures regulatory compliance with the policies.

companyName: Guardion Health Sciences, Inc.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, IRadimed invests significantly in the cybersecurity elements outlined above. In addition, the Company has made investments to fulfill the operational and financial regulatory requirements laid out by the Sarbanes-Oxley Act of 2002.

companyName: IRADIMED CORP

ticker: IRMD


text: The Company recognizes cybersecurity as crucial to protecting its business and employees' sensitive information. The Company has implemented and maintains a Security Incident Response Policy as part of its enterprise-wide risk management system, which is intended to ensure that the Dynex information technology ("IT") systems function properly and successfully assess, identify, contain, investigate, remedy, report, and respond to information security risks, threats or incidents.

companyName: DYNEX CAPITAL INC

ticker: DX


text: Our information security function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO and information security function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Turnstone Biologics Corp.


text: The Corporation uses an integrated cybersecurity incident response plan ICIRP designed to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Corporation and with our Board of Directors, notify law enforcement and other government agencies, and notify customers and employees. The ICIRP provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the CIRST. The CIRST facilitates coordination across key stakeholders of the Corporation. The Corporation's CISO and key members of management are members of the ICIRP. The Corporation provides the CISO and the information security team with a comprehensive suite of security tools and techniques to protect the confidentiality, integrity and availability of the Corporation's data for the benefit of our customers, employees and shareholders. We periodically engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities include internal audits, vulnerability assessments and penetration testing. The Corporation's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: Our Vice President of IT Security has held IT security and leadership roles at the Company for over 23 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.

companyName: SEMTECH CORP

ticker: SMTC


text: The cybersecurity risk assessment process includes three parts: (1) identification of assets such as information, services, software and their dependencies, (2) an assessment of the criticality of the assets based on factors of confidentiality, integrity and availability, and (3) an assessment of other criteria to determine the impact a threat can have on each asset and the likelihood that such a threat occurs. Based on the risk assessment process, risk-based analysis, and using an internationally recognized information security framework as a reference, security controls are chosen.

companyName: GUESS INC

ticker: GES


text: Our and our Manager's cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our and our Manager's enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard, which our Manager uses to assist with our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations. We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Our Risk Factors include further detail about our material cybersecurity risks.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: We take a multifaceted approach to managing risk from cybersecurity threats. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. Our information security program and supporting policies apply to all employees, contractors and certain vendors servicing the firm. The program outlines the development, maintenance, and distribution of information security policies and procedures that detail the implementation and maintenance of the information security program and its safeguards, and cover various areas such as information handling, user access management, encryption, data retention and backups, computer and network security and monitoring, physical security, incident reporting and response, service provider oversight, and employee and contractor use of technology. We also undergo annual SOC 1 Type 2 testing of our financial processes and supporting technical controls. In addition to the foregoing, we conduct regular employee trainings on cybersecurity and perform phishing exercises to test employees' understanding of how to identify social engineering attacks. We perform diligence, including in respect of information security, of vendors and third parties with significant access to confidential information and personal data, and periodically monitor such vendors. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems. We conduct annual penetration testing performed by a rotating group of third-party security firms to test our technical controls and security response. Our internal audit team has also conducted a cybersecurity assessment to test our preparedness. In addition to our internal cybersecurity capabilities and third-party penetration testing, we also, at times, engage consultants or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: StepStone Group Inc.

ticker: STEP


text: We rely extensively on information technology ("IT") systems, including Internet sites, data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. These systems, like those used by most companies, may be vulnerable to a variety of disruptions, including, but not limited to, those caused by natural disasters, telecommunications failures, hackers, and other security issues. Moreover, these IT systems, like those used by most companies, are subject to the possibility of computer viruses or other malicious codes, and to security breaches, cyber incidents, ransomware attack or phishing-attacks. Cybersecurity is an integral part of risk management at our Company, and we maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, which is part of our overall risk management system and processes.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: Identifying, assessing, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process, which is our approach to identifying, assessing, and mitigating major risks. Cybersecurity threats are evaluated based on our perceived vulnerability to a particular threat and the potential impact such a threat could have, with mitigation efforts focused on the highest risks. This risk assessment is updated no less than annually and reviewed by the Board of Directors.

companyName: MAXIMUS, INC.

ticker: MMS


text: Cybersecurity is a critical component of our overall risk management process. Our Board of Directors oversees our cybersecurity efforts as delegated to and performed by senior management which is responsible for the identification and assessment of material risks from cybersecurity incidents. The members of management responsible for managing cybersecurity threats are HCI Group's Director of Information Technology (IT) and its Network Security Manager, and the Chief Operating Officer of Exzeo USA, Inc., TTIG's software development and IT company. Both the Director of IT and the Chief Operating Officer have extensive experience in managing information systems including the defense of computer networks against cyber intrusions. The Network Security Manager is dedicated to overseeing our multi-layered cybersecurity defenses and leads monthly security meetings attended by IT managers.

companyName: HCI Group, Inc.

ticker: HCI


text: Caterpillar Cybersecurity Governance Caterpillar's board has oversight for risk management with a focus on the most significant risks facing Caterpillar (including its wholly-owned subsidiary, Cat Financial), including strategic, operational, financial and legal compliance risks. The Caterpillar board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which Caterpillar's cybersecurity processes are an integral component.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: We have established procedures for evaluating, recognizing, and handling significant risks stemming from potential unauthorized events occurring on or through our electronic information systems, which could negatively impact the confidentiality, integrity, or accessibility of our information systems or the data stored within them. These procedures encompass a diverse range of mechanisms, controls, technologies, systems, and other processes aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. This data comprises confidential, business, and personal information that we gather, process, store, and transmit as part of our operations, including on behalf of third parties. Furthermore, we utilize systems and procedures intended to minimize the repercussions of a security incident involving a third-party vendor or customer. Additionally, we employ procedures to supervise and identify significant risks arising from cybersecurity threats linked to our utilization of third-party technology and systems, such as encryption and authentication systems, employee email services, back-office support systems, and other operational functions.

companyName: Intellicheck, Inc.

ticker: IDN


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Our VP of IT has approximately five years of experience in cybersecurity and oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our VP of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats, including monitoring and assessing strategic risk exposure.

companyName: Arq, Inc.

ticker: ARQ


text: As part of our overall risk management system, we monitor and test our safeguards. We train our workforce on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required trainings. Cybersecurity tabletop exercises are regularly conducted for our executives and for incident response professionals. Improvements identified at these tabletop exercises are implemented into our processes.

companyName: Autodesk, Inc.

ticker: ADSK


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Vice President and General Counsel, Chief Financial Officer and Chief Executive Officer. The Cybersecurity Risk Management Team and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Regulus Therapeutics Inc.


text: We maintain a cybersecurity risk management program and related policies and processes to identify, assess and manage material risks from cybersecurity threats.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: Our Board of Directors has ultimate oversight for risks relating to our cybersecurity program and practices and receives regular updates from our internal cybersecurity team on cybersecurity risks and threats. In addition, our Audit Committee provides Board-level oversight for management's actions with respect to practices, procedures and controls used to identify, assess and manage our key cybersecurity programs and risks. We also maintain an Enterprise Risk Intelligence Committee (ERIC), a management-level cross-functional group designed to monitor and mitigate risks, including cybersecurity risks, that pose a threat to our strategic objectives. The ERIC is charged with providing guidance and direction for integrating enterprise risk intelligence with important business processes, such as strategic planning, business forecasting, operational management, and investment allocation to ensure consistent consideration of risks in decision making. Finally, we maintain an Enterprise Cybersecurity Governance Committee that presents updates on cybersecurity initiatives, known and emerging issues and risks, and program updates to a cross-section of our senior management.

companyName: Trane Technologies plc

ticker: TT


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). The Company's Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The Adviser's CISO has 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Adviser's CISO works closely with Company management to administrator, assess, discuss, and prioritize the Company's cybersecurity efforts. The Company's CCO has been responsible for this monitoring and reporting as CCO to the Company for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: HPS Corporate Lending Fund


text: Our Response Plan sets forth our response protocol for cybersecurity threats and cybersecurity events and incidents and is maintained by our cybersecurity incident response team, or CSIRT, which reviews the Response Plan on at least an annual basis. The CSIRT is comprised of IT department leaders, including our Vice President, Information and Technology, who reports to our Senior Vice President, Chief Operating Officer and Chief Financial Officer, as well as members of our executive team and other senior management. Our Response Plan is designed to provide a framework for how we identify, evaluate, escalate, respond and recover in the event of a data security breach and designates personnel who are responsible for these functions. Our IT team, utilizing the support of external vendors and software products, evaluates security alerts received from various sources, and any alert or threat that the CSIRT identifies as a cybersecurity incident is promptly evaluated and escalated in accordance with the Response Plan for further assessment. Upon confirmation that a cybersecurity incident has occurred, our CSIRT will establish an incident response team, which may include representatives from our internal departments, as well as internal or external legal counsel or other external cybersecurity consultants or service providers. The CSIRT aims to develop a coordinated response strategy, including with respect to risk containment, notification processes, system restoration, incident documentation and assessment, data preservation and forensic analysis.

companyName: Mersana Therapeutics, Inc.


text: analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition. We do not believe risks from cybersecurity threats are reasonably likely to materially affect us, but no assurances can be provided that, despite the implementation of security measures, our information systems and data, or those of our current and any future third parties on which we rely, will not be vulnerable to cybersecurity risks. Refer to Item 1A. Risk Factors – "If our security measures are breached or unauthorized access to customer data or our data is otherwise obtained, our solutions may be perceived as not being secure, customers may reduce the use or stop using our solutions and we may incur significant liabilities".

companyName: MARIN SOFTWARE INC


text: The company has not experienced a cyber security incident or a cyber security threat during 2024 nor in any prior years. The company's overall risk management systems and processes have followed the recommended guidelines of our cyber security insurance company. The Audit Committee has the board's oversight of risk from cyber security threats and the responsibility for reviewing the management processes. Management's role in assessing and managing material risks from cyber security threats is the responsibility of the Chief Financial Officer, who reports and coordinates any potential material risk to the Audit Committee.

companyName: ZION OIL & GAS INC

ticker: ZNOG


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition.

companyName: CervoMed Inc.

ticker: CRVO


text: We have a Written Information Security Program ("WISP") to protect personal and proprietary information in compliance with applicable federal and state requirements. WISP is designed to: • Ensure the security and confidentiality of personal information; • Protect against any anticipated threats or hazards to the security or integrity of personal information; and • Protect against unauthorized access to or use of such personal information in a manner that creates a substantial risk of identity theft or fraud. For more information about these risks, see the risk factor titled "Our business is subject to the risk of terrorism, cyberattacks, or failure of key information technology systems," "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of revenue," and "If our efforts to protect the security of personal information related to any of our customers, consumers, vendors, or employees are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cyber security breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation, and our reputation could suffer" under Item 1A.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: Additionally, as a public company, we are subject to the Sarbanes-Oxley Act requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting. These audits, which are conducted by our independent public accounting firm, assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of systems and data. Any control deficiencies that represent cybersecurity risks, as well as any recommended changes to our processes, if appropriate, would be reported to senior management and the Board of Trustees.

companyName: Urban Edge Properties

ticker: UE


text: Our current cybersecurity risk assessment program consists of not only real-time monitoring of things from patching policies to mandatory multi-factor authentication, but also policies in place for encryption of data both in transmission and at rest. The program outlines governance, policies and procedures, and technology we use to oversee and identify risks from cybersecurity threats and is informed by previous cybersecurity incidents we have observed in our company, in our industry, and as reported by our cybersecurity partner CCS Business Solutions, Inc.

companyName: PIONEER POWER SOLUTIONS, INC.

ticker: PPSI


text: Technical Safeguards: Our Adviser deploys technical safeguards that are designed to protect the Company's and our Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: The IT Director reports directly to the Chief Financial Officer, ensuring timely notification of significant cybersecurity incidents to the senior management team. The management team and the enterprise risk committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. The enterprise risk committee, which includes the Chief Financial Officer, IT Director as well as other members of senior management, review cybersecurity risk management as a component of our overall enterprise risk management.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: We rely on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors, to evaluate its cybersecurity measures and risk management processes, including those applicable to us. We rely on the Adviser's risk management program and processes, which include cyber risk assessments.

companyName: Muzinich BDC, Inc.


text: Management engages third parties with relevant expertise in assessing and managing cybersecurity threats. As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization. Annually we hire a third party to test for and resolve weaknesses and vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing.

companyName: US Alliance Corp


text: For additional information on our cybersecurity risks, see " Data loss or other breaches or disruptions of our information systems and information system security could materially harm our business and results of operations." in Part I, Item 1A – "Risk Factors" of this Annual Report on Form 10-K.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Our board of directors has oversight of our ERM Program, the Enterprise Security Program, and Information Security areas which include risks from cybersecurity threats and has approved specific controls for the mitigation, monitoring and reporting associated with those risks. The Risk Oversight Committee and Operations Committee of the board of directors receive regular reporting (at least quarterly) on the risks and are responsible for overseeing cybersecurity and information risks, including receiving Enterprise Security Program updates from the information security officer (ISO), Information Technology status updates, and reviewing enterprise risk analysis and status information, and annually reviews the Business Resiliency Management Policy and Program.

companyName: Federal Home Loan Bank of Topeka


text: The Company measures its security posture through several third-party score-based cybersecurity tools. Scores from these tools are reviewed weekly and measure the Company's posture regarding securing applications, infrastructure, data and other assets from theft or loss, both internally and externally. Thresholds are in place for escalation to management.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Like all companies that utilize electronic technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we will take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We intend to have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We intend to have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. We intend to establish and maintain a Cybersecurity Maturity Model Certification compliance program and work to meet all applicable deadlines. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in people and technologies will have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions. Refer to the risk factor captioned, "Security breaches through cyber attacks or intrusions, or other significant disruptions of the Company's IT networks, communications, and related systems could impair our ability to operate, adversely affect our financial condition, and damage our reputation," in Part I, Item IA. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: The Board of Directors oversees the risks to the Company from cybersecurity threats by periodically reviewing information technology security reports from management, including our Chief Information Security Officer ("CISO"), as well as reports from the Audit Committee of the Board of Directors. These reports also include, as applicable, an overview of any cybersecurity incidents. The Audit Committee provides assistance to the Board of Directors with respect to its oversight of the Company's technology security and data privacy programs. The Audit Committee is responsible for reviewing the Company's information technology security controls with the CISO and evaluating the adequacy of the Company's information technology security program, compliance and controls with the CISO, which evaluation would include a consideration of any applicable cybersecurity incidents.

companyName: Finance of America Companies Inc.

ticker: FOA


text: Through our cybersecurity training program, employees and contractors are provided with cybersecurity training upon hire and thereafter on an annual basis. In addition, training and awareness campaigns continue throughout the year, where we employ various methods such as conducting mock phishing tests, live training sessions and informational articles.

companyName: WORLD KINECT CORP

ticker: WKC


text: Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.

companyName: Greenwich LifeSciences, Inc.

ticker: GLSI


text: Cybersecurity Personnel Resources The Company's cybersecurity program is managed by our IT department, which is led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University along with more than 25 years of experience. Our IT department has experience with network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also include IT audits and anti-phishing training, as well as server installation, configuration and administration.

companyName: EQC Liquidating Trust


text: Management and Strategy part of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:

companyName: Marpai, Inc.

ticker: MRAI


text: Containment, Eradication, Recovery, and Reporting With every cybersecurity incident, the highest priority for the IRT is to contain the cybersecurity incident as quickly as possible. A cybersecurity incident is considered contained when the attacker's ability to affect the network resources has been effectively controlled or stopped, the affected system(s) have been identified, and compromised data, memory image, and disks have been collected for analysis. The IRT is responsible for deciding on a containment strategy to respond to the cybersecurity incident, coordinating resources, and communicating to management with subsequent notification to the Audit Committee, if warranted.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Our cybersecurity risk management processes are led by our VP, IT Business Solutions who has over 22 years of experience in various roles involving managing information systems and cybersecurity functions and developing cybersecurity strategies. Through these roles the VP, IT Business Solutions has implemented information technology security and privacy policies across multiple infrastructure and application platforms and led identity and access management. In order to enable the Company to prevent, detect, mitigate and remediate cybersecurity incidents, our security monitoring and protection systems are continuously monitored. The VP, IT Business Solutions is kept informed in accordance with our Incident Response Plan and reports matters to the Audit Review Committee as necessary. Additionally, we have a Cyber Security Task Force in place that is comprised of individuals across our various departments within our organization including information systems, legal, finance, internal audit, sales and marketing, engineering and supply chain teams which meets regularly to further advance our cybersecurity strategy.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: • Training and Awareness. We hold regular employee trainings on privacy, cybersecurity, AI and records and information management, conduct simulated phishing tests, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage, and transmission of confidential, sensitive, and other information within our computer systems and networks. Computer viruses, threat actors, employee or vendor incidents, and other external hazards could expose our information systems, and those of third parties who process our data, provide access to systems, or that have access to our systems, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, reputation, results of operations and financial condition, and subject us to possible legal claims and liability. While we have experienced cybersecurity incidents in the past, as of the date of the filing of this Form 10-K, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on us, including our business strategy, results of operations, or financial condition.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: We describe whether and how cybersecurity-related risks could materially affect our business under the heading "Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted computer crimes pose a risk to our systems, networks, products, solutions, services, and data, as well as our reputation, which could adversely affect our business" under Item 1A. "Risk Factors." CYBERSECURITY GOVERNANCE.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: We also implemented additional security measures following the previously disclosed cybersecurity incident of July 2023, such as stronger privileged access policies and enhanced and expanded multi-factor authentication to help prevent unauthorized access to our systems. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. See "Risk Factors" in ITEM 1A of this Annual Report on Form 10-K for more information on our cybersecurity related risks.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: We also maintain an Enterprise Cyber Response Plan ("ECRP") designed to handle potential or actual cybersecurity events that could impact us and our personnel, data, systems and customers. The ECRP defines the roles and responsibilities of various teams, individuals, and stakeholders in performing this enterprise response, guides decision making for taking actions and escalations to our executive management and the Board of Directors, as appropriate, and helps to plan follow-on actions that seek to reduce the likelihood of similar events' recurrence in the future. The ECRP is reviewed and refined periodically and refinement is informed in part by a series of table-top exercises that we conduct over the course of the year.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: The detection and analysis phase addresses the responsibility of Company personnel to notify our IRT Leader and IT provider upon noticing, suspecting, or being notified of any actual or suspected security incident which will prompt our IT provider to perform an initial investigation of the issue and determine whether the event is a security incident and whether the Cybersecurity Response Leader needs to be notified.

companyName: ContextLogic Inc.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at QVC. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: QVC INC

ticker: QVCD


text: Our cybersecurity risk management program is i ntegrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Hudson Pacific Properties, Inc.

ticker: HPP


text: Our comprehensive Incident Response Plan outlines processes to identify, detect, assess, respond to and recover from threats, including cybersecurity threats. We follow those processes to manage material risks from cybersecurity threats, including risks relating to disruption of business operations or financial reporting systems, intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation/legal risk; and reputational risk, as part of our overall risk management system and processes.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology personnel who in turn manage our retained external cybersecurity consultants. Our management team's experience includes significant responsibility for developing and maintaining cybersecurity risk management programs and for managing cybersecurity risks prior to joining us.

companyName: NEVRO CORP


text: We rely on information systems and the data stored on them to conduct our operations. As such, we have implemented processes designed to mitigate risks posed by cybersecurity threats.

companyName: Societal CDMO, Inc.


text: We place the utmost importance on the security of our systems and the data we will handle once BDTP TM is operational. We plan to implement a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: BLACKSTAR ENTERPRISE GROUP, INC.


text: Access Control: Financial data is stored on a dedicated SharePoint site, with access restricted to relevant personnel only, ensuring tight control over sensitive information.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: Similarly, the Partnership's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Partnership and its Board with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Partnership assets and information.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Processes for identifying and assessing cybersecurity risks The CISO, with the support of the cybersecurity team and the owners of information technology across the business, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. There are several processes in place to monitor and review our systems, including third-party solutions, to identify potential risks. Third-party service providers are required to notify us in the event of a cybersecurity incident within their systems, and annual reviews are conducted on the Company's critical third-party vendors. Cybersecurity risks, threats, and incidents, including those from third-party service providers, are tracked and regularly provided to the CISO. Beginning in 2024, the Cybersecurity Leadership Team, which includes the CISO and executives from all business functions across the organization, meet at least quarterly to review and discuss cybersecurity risks facing the Company.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of IT and the Director of IT Infrastructure and Security. Our IT Leadership team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: At the management level, the Chief Information Officer and Information Security Officer receive regular reports from the Company's systems department, both historical and real-time, about the Company's cybersecurity status. The Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). If management determines a material cybersecurity incident has occurred, the Company's policies require management to promptly inform the Audit Committee with follow-up information to the full Board of Directors.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: In addition, our Risk and Compliance Committee (RCC) is responsible for oversight and support of the Company's Enterprise Risk Management and Compliance and Ethics programs and is comprised of the Executive Leadership Team and the Senior Vice President and Chief Accounting, Risk, and Compliance Officer (Compliance Officer). The RCC also created a subcommittee, the Enterprise Risk Management Committee (ERMC), who is charged with continually monitoring, evaluating, and managing enterprise risks. The ERMC includes the Compliance Officer, General Auditor, Vice President Law - Finance and Compliance, Vice President and Chief Safety Officer, CISO, and Assistant Vice President - Corporate Strategy. The RCC and ERMC both meet throughout the year and receive periodic updates on cybersecurity from the CISO and Deputy CISO.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Our cybersecurity risk management processes are implemented, assessed, and managed by certain members of Olo management, including our CISO and CLO. Our CISO has 25 years of experience in information technology and risk management at various companies, such as Yum Brands, Inc. and Domino's Pizza, Inc. He is also an ISC2 Certified Information Systems Security Professional. Our CLO has 16 years of experience and received a cybersecurity oversight certification from the National Cybersecurity Center. Both act as chairs of our GRC Committee. The GRC Committee provides direction, oversight, and management of our cybersecurity and privacy programs with a focus on business objectives, the protection of customer and employee data, safeguarding our systems, and complying with applicable laws, regulations, and contractual obligations. Cross-functional leaders within Olo, including members from our information technology, data science, finance, legal, and people & culture teams, are part of the committee. Our GRC Committee meets periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.

companyName: Olo Inc.


text: The Company has adopted Incident response plan policy, including Roles and Responsibilities, Incident Categories, Categories of Event, Incident Severity, Escalation Levels, and Incident Response Life Cycle, so that the weakness, events, alerts and incidents can be appropriately managed and escalated from IT personnel, IT consultant, Chief Executive Officer to independent director and the Board.

companyName: XMax Inc.

ticker: XWIN


text: Our information security program is managed by a dedicated Chief Information Security Officer (CISO), who has over 25 years of relevant experience. Our CISO is charged with the maintenance and execution of our security program and reports to our Chief Information Officer, who leads the management of our information systems. The CISO manages a team that assesses, evaluates, and responds to cybersecurity threats. Our CISO, and other senior leaders in our IT, law, and internal audit departments, provide periodic reports to our Chief Executive Officer and other members of our senior management team and the Board, as appropriate, on cybersecurity risks and program updates.

companyName: NMI Holdings, Inc.

ticker: NMIH


text: The Audit Committee is responsible for oversight of our information security program and receives reports at least quarterly from executive management, including the CSO, CTO, and CIO, concerning cybersecurity matters. The Audit Committee's charter directs that the committee oversee and periodically review the Company's risks related to privacy, cybersecurity, and information and technology security, including: • discussing with management the Company's plans to mitigate cybersecurity risks and response to data breaches; • reviewing any reports from management on data breaches, and • overseeing the disclosure of any significant risks and incidents to the extent required by applicable law, including SEC rules and regulations.

companyName: JFrog Ltd

ticker: FROG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. The Committee is comprised of senior executives with risk management and information security expertise. The Information Technology Steering Committee ("ITSC") is a sub-committee of ERMC and is also comprised of senior executives and staff with risk management and information security expertise. ITSC governs the first line of defense cybersecurity risk management activities and furnishes approval items, status reports, and approved Committee minutes to ERMC following a meeting. ERMC governs the second line of defense cybersecurity risk management activities and furnishes key risk indicators, risk assessments, reports, issues and committee minutes to the Board Risk Committee. The CRO/CISO assigns quarterly cyber security training to all Company employees and ERMC reviews and approves the training curriculum on an annual basis. Additionally, the CRO/CISO ensures the Board receives annual cyber security training.

companyName: Capital Bancorp Inc

ticker: CBNK


text: NEE, including FPL, uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE, including FPL, are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards, as well as the NRC cybersecurity protection standards. Further, NEE, including FPL, has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE, including FPL, continues to take steps to defend against cybersecurity threats to its critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.

companyName: FLORIDA POWER & LIGHT CO


text: below, we also regularly report to the Board and the Risk Policy and Capital Committee of the Board on cybersecurity risk matters. We have implemented controls and procedures for the escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such incidents can be made in a timely manner.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: The Company has established and maintains comprehensive incident response and recovery plans, in coordination with the Company's MSP, that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Cybersecurity risk management processes are integrated into the Board's ongoing evaluation and management of risks that are essential to our success, including as it relates to its oversight of the Advisor. At least annually, our Audit Committee reviews the cybersecurity program of the Advisor. Further, cybersecurity risk management is integrated into the Cohen & Steers' overall enterprise risk management process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by Cohen & Steers' information technology security team; (ii) internal and external penetration tests are performed to identify any vulnerabilities and findings are risk ranked based on potential likelihood and impact and (iii) the CTO reports on cybersecurity risk management and related matters annually to the Audit Committee, as part of its ongoing evaluation and oversight of the Advisor's cybersecurity program.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our business and operations could suffer in the event of a security breach, cybersecurity incident or disruption of our information technology systems" under Item 1A. Risk Factors. Governance.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: The processes described above have not indicated, as of the date of this Annual Report on Form 10-K, any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us in the year ended December 31, 2024 or are reasonably likely to materially affect our company, including its business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see the section of this Annual Report on Form 10-K entitled "Risk Factors—We rely on our IT systems to manage numerous aspects of our business. A cyber-based attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales and harm to our reputation."

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: We have implemented advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate threats. We provide at least quarterly company-wide cybersecurity information training and routinely communicate with employees about the potential for cybersecurity threats. We additionally deploy technical safeguards that are designed to protect our information systems from cybersecurity threats including firewalls, intrusion penetration and detection systems, anti-malware functionality and access controls, vulnerability assessments and cybersecurity threat intelligence. We continuously monitor and assess our information technology and data assets to detect anomalies and to respond quickly to threats that may arise. In certain instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments, information security program assessments and external threat environment reviews.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have implemented a process to review risks to our Company in connection with certain third-party providers and vendors, which involves assessments through vendor questionnaires, as appropriate.

companyName: enGene Holdings Inc.

ticker: ENGN


text: Finally, we conduct cybersecurity training and awareness programs for relevant employees, periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: We maintain strong cybersecurity systems to guard against unauthorized access, malicious software, corruption of data, disruption of our networks and systems and unauthorized release of confidential information. We employ an experienced and dedicated information security team, strive to follow industry best practices, and work with our employees globally to create awareness and mitigate cyber risk. On an ongoing basis, we assess risks (including our exposure from significant information technology suppliers, significant software as a service providers and major vendors with access to our information technology systems) and implement procedures and practices designed to improve the security, confidentiality, integrity and availability of our systems. We voluntarily engage third-party security auditors to test our systems and controls at least annually against the most widely recognized security standards and regulations. We have developed and continue to implement a continuing cyber awareness training program which is designed to increase awareness of cybersecurity threats throughout our company and reduce the risk of human error. We conduct periodic phishing testing on all our employees with e-mail access and emphasize information security in training events and programs we host throughout the year.

companyName: MERIT MEDICAL SYSTEMS INC

ticker: MMSI


text: All employees with a company-provided email receive annual cyber awareness training. In addition, we perform monthly phishing simulations, with remediation training required as necessary.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: On a quarterly basis, our employees, contractors and other users of the Company's systems and networks are required to take cybersecurity training. The training is designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. These trainings are administered through a collaboration with third-party services and systems and address various topics, including how to handle sensitive and personal information, physical security of intellectual property, how to identify phishing attempts, reducing our risk to being phished and how to improve cybersecurity intelligence while working from home.

companyName: Ecovyst Inc.

ticker: ECVT


text: Cybersecurity risk is a direct responsibility of management and the Company's information technology ("IT") team, including our Director, IT who has over 15 years of experience building, implementing, and managing information systems, developing cybersecurity programs, and deploying risk mitigation strategies for such systems. Working cross-functionally with our Legal team, our SVP, Operations oversees the IT team that regularly monitors and assesses cybersecurity risks, implements measures designed to mitigate such risks and their associated effects on the Company and personal data collected, stored, and processed in our systems, and manages our information security training and cybersecurity awareness program. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.

companyName: Zevia PBC

ticker: ZVIA


text: We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented certain measures designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers, such as assessing the security protocols of certain service providers and obtaining security reports from certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: NETSTREIT Corp.

ticker: NTST


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee has primary responsibility for oversight of information security risks, including fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks, and provides regular updates to the Board of Directors on such matters. The Audit Committee receives regular reports from our Chief Operating Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Information security risk is a significant oversight focus area for the Audit Committee, as well as the entire Board of Directors. Over the course of fiscal year 2024, the Audit Committee received four separate cybersecurity briefings from our Chief Operating Officer.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: Our management, led by our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer, is responsible for assessing cybersecurity risks and for confirming we have an appropriate cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer each have experience in senior leadership roles in which they have been responsible for the entity's enterprise risk management, including management of cybersecurity risks. The Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer meet regularly with the individuals charged with the day-to-day IT operations and infrastructure, and at least quarterly to review and assess potential cybersecurity threats to determine whether any changes need to be made to our cybersecurity strategy. The Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer sponsor periodic cybersecurity awareness training for all employees.

companyName: XOMA Royalty Corp

ticker: XOMA


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding cybersecurity incidents.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: Collaboration. We take a cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and implement controls and procedures designed to promptly escalate certain Cybersecurity Events to help ensure timely review, disclosure and reporting of such incidents.

companyName: PROS Holdings, Inc.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including third-party annual penetration testing, internally managed weekly vulnerability testing, third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of these assessments are reported at least annually to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.

companyName: VINEBROOK HOMES TRUST, INC.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In past years, our Information Security Management System has continued to work a Plan of Action and Milestones (POAM) tied to the United States Cybersecurity Maturity Model Certification (CMMC) program, formerly the National Institute of Standards and Technology (NIST) Cybersecurity Framework, while looking for synergies across other standards, such as the Information Assurance Technical Framework (IATF), or as required for specific product lines or customers. Furthermore, we benchmark externally against other industrial manufacturers within the B2B (Business to Business) manufacturing industry, and even to a vertical level to determine Chart's risk profile through cybersecurity insurance tools that rank companies and bring them together within forums for cyber intelligence sharing and best practices.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Our cybersecurity risk management program is integrated into our overall risk management system. To help identify, assess and manage material risks from cybersecurity threats, we include cyber risk in our enterprise risk management, or ERM, evaluation and strategy process. Our ERM process takes a top-down, enterprise view of risks; it is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Our Vice President Cyber Security has a dotted line reporting relationship to our Chief Administrative Officer and General Counsel to help ensure that risks from cybersecurity threats are considered as part of the broader ERM process. At a management level, our Chief Administrative Officer and General Counsel leads our ERM process.

companyName: Mid-America Apartments, L.P.


text: Identification—monitor IT systems and detect deviations from normal operations and see if they represent actual security incidents. When an incident is discovered, collect additional evidence, establish its type and severity, and document everything.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The Cybersecurity Committee receives periodic reports from members of our cybersecurity team regarding such threats, risks, and processes. The Audit Committee and the Cybersecurity Committee also receive various reports, summaries, and presentations related to cybersecurity threats, risk, and mitigation.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Management's role and expertise in assessing and managing material cybersecurity risks Our Information Security team, led by our CISO, is responsible for assessing and managing material cybersecurity risks. Certifications held by the Information Security team include CompTIA A+, Network+, Security+, CyberSecurity Analyst+ ("CYSA+"), Pentest+, Advanced Security Practitioner ("CASP"), EC-Council Certified Ethical Hacker ("CEH"), Certified Security Analyst ("ECSA"), Computer Hacking Forensic Investigator ("CHFI"), Associate Chief Information Security Officer ("ACCISO"), CMMC-AB Registered Practitioner ("RP"), ISC2 Certified Information Systems Security Professional ("CISSP"), Systems Security Certified Practitioner ("SSCP"), ISACA Certified Information Security Manager ("CISM"), PCAP – Certified Associate Python Programmer, & eLearnSecurity Junior Penetration Tester ("eJPT"). Our CISO's background includes over 18 years of experience in IT and Information Security. His formal education includes a Master's degree in Cybersecurity and Information Assurance and a Bachelor's degree in Computer Forensics. Certifications held by the CISO include CompTIA A+, Network+, & Security+, Microsoft Technology Associate ("MTA"), CMMC-AB RP, ISO 27001 Certified Lead Implementer Professional, EC-Council CEH & CHFI, ISACA Certified Data Privacy Solutions Engineer ("CDPSE") & Certified Information Security Manager ("CISM"), ISC2 CISSP, and Offensive Security Certified Professional ("OSCP"). Our CISO reports to our Chief Information Technology Officer ("CITO"), who in turn reports to our Chief Executive Officer ("CEO"). Each of our CITO and our CEO have extensive experience in cybersecurity matters.

companyName: TELOS CORP

ticker: TLS


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and asset use, and educates employees on the importance of reporting all incidents immediately. We conduct frequent phishing simulations requiring employees to identify and report simulated phishing emails. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Trevi Therapeutics, Inc.

ticker: TRVI


text: We undertake a bi-annual NIST CSF and CIS 18 Critical Security Controls assessment, conducted by a third-party, to measure our program maturity. We have implemented a variety of technologies, leveraging third-party security providers for some, and engage in multiple activities to seek to identify and mitigate vulnerabilities and risks in systems. These include, among other activities, scanning for common vulnerabilities and exposures, penetration tests on internal and external networks, code scans on applications, allowed application listing, configuration management tools, employee awareness and training, and internal and external audits. We also review, with various frequencies, on a risk-based priority select third parties with whom we do business, in an effort to reduce the likelihood of security incidents or business interruptions. We maintain cybersecurity insurance that would apply to certain losses arising from significant security incidents.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: In the last three fiscal years, we have not experienced a cybersecurity incident which has been determined to be material, and the expenses we have incurred from cybersecurity incidents and threats were immaterial, including penalties and settlements, of which there were none.

companyName: SYNAPTICS Inc

ticker: SYNA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data ("Information Systems and Data").

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how cybersecurity incidents, ransomware attacks, and other disruptions to our operational information systems, security systems, vehicles, and services could reasonably be expected to affect the Company, including its business strategy, results of operations or financial condition, see our risk factors above in Item 1A. generally and, in particular, "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers" on page 22.

companyName: FORD MOTOR CO

ticker: F


text: The CISO has served in various roles in Information Technology and Information Security for over 35 years, including serving in a Chief Information Security Officer role of two large public companies, including Associated Bank for 17 years. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional Information Systems Audit and Control Association certification of Certified Information Security Manager in 2005. The CIO holds an undergraduate degree in business management, with a minor in international business, and is currently pursuing a master's degree in cybersecurity and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The CRO has over 30 years of banking experience, holds a degree in computer science, and earned the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The Corporation's CEO and General Counsel each hold degrees in their respective fields, and each has extensive experience managing risks at the Corporation and similar financial institutions, including risks arising from cybersecurity threats.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: The audit committee receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. As we become more dependent on information technologies to conduct our operations, cyber incidents, including deliberate attacks and attempts to gain unauthorized access to computer systems and networks, may increase in frequency and sophistication. These threats pose a risk to the security of our systems and networks, the confidentiality and the availability and integrity of our data and these risks apply both to us, and to third parties on whose systems we rely for the conduct of our business. Because the techniques used to obtain unauthorized access, disable, or degrade service or sabotage systems change frequently and often are not recognized until launched against a target, we and our partners may be unable to anticipate these techniques or to implement adequate preventative measures. Further, we do not have any control over the operations of the facilities or technology of our cloud and service providers, including any third-party vendors that collect, process and store personal data on our behalf. Our systems, servers, and platforms and those of our service providers may be vulnerable to computer viruses or physical or electronic break-ins that our or their security measures may not detect. Individuals able to circumvent such security measures may misappropriate our confidential or proprietary information, disrupt our operations, damage our computers, or otherwise impair our reputation and business. We may need to expend significant resources and make significant investment to protect against security breaches or to mitigate the impact of any such breaches. There can be no assurance that we or our third-party providers will be successful in preventing cyber attacks or successfully mitigating their effects. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, and the further development and commercialization of our future product candidates could be delayed.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: We have established a cross-functional Cybersecurity Steering Committee, comprised of our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other senior management. The Cybersecurity Steering Committee is charged with overseeing the management of our enterprise security program, including reviewing and prioritizing cybersecurity risks, monitoring potential incidents, establishing key mitigation initiatives, overseeing cybersecurity governance and promoting and supporting cybersecurity best practices. The Cybersecurity Steering Committee is chaired by our CISO. Both our CISO and our CIO have extensive experience in assessing and managing cybersecurity programs and risk management through serving in various senior roles in information technology and cybersecurity and holding multiple industry-recognized certifications.

companyName: ANALOG DEVICES INC

ticker: ADI


text: The Audit and Finance Committee is responsible for reviewing our policies with respect to risk assessment and risk management, as well as our insurance programs, including regarding cybersecurity. Our internal audit team reports to the Audit and Finance Committee on summaries of findings from completed internal audits of, among other matters, our IT security systems and processes, including network security and data protection. The Audit and Finance Committee regularly reports to the Board on its activities.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX