text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being unsecure, which could harm our business and reputation, and our proprietary business information could be misappropriated which could have an adverse effect on our business and results of operations."

companyName: Jacksam Corp

ticker: JKSM


text: Cybersecurity holds a significant role within our risk management procedures and remains a focal point for our Board and management. Under the Board's oversight of general risk identification and management activities, the Audit Committee monitors cybersecurity risks. Committee members engage in comprehensive discussions with management regarding these risks, as well as the measures taken to safeguard the company's information systems and security, along with reviewing management's steps towards data privacy protection. Additionally, the Audit Committee receives annual cybersecurity updates from senior management, covering both existing and emerging risks, management's responses and mitigation efforts, any cybersecurity or data privacy incidents, and the status of key information security initiatives. Furthermore, our Board members regularly hold informal discussions with management about cybersecurity news events and any updates to our cybersecurity risk management and strategy programs.

companyName: SPAR Group, Inc.

ticker: SGRP

secItem: Item 1C


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Systems team, including our Director of Information Systems, who has worked in the information systems field for over 15 years and has lead our Information Systems team for over 10 years. Our Director of Information Systems oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Information Systems team is made up of highly experienced professionals with a background in information security, risk management, and incident response. This background includes leading and developing cyber security operations and incident response programs for business organizations, developing comprehensive cyber security strategies, and managing complex cyber security projects across various industries.

companyName: OneWater Marine Inc.

ticker: ONEW


text: Weatherford expects to continually invest in the improvement of cybersecurity infrastructure, as systems and needs evolve and as the threat landscape changes. Because we employ a prevention-based improvement cycle that requires the response team for each threat or incident to consider the root cause of the issue and any lessons learned throughout the response process, we strive to make corrections and improvements in our policies and procedures that are designed to safeguard against future threats.

companyName: Weatherford International plc

ticker: WFRD


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We are dependent on information technology systems, infrastructure and data, which exposes us to data security risks."

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Monitoring and Incident Response Plan Information Security risks are monitored by our security operations center team along with managed services providing 24x7x365 monitoring and response. Ryan Specialty retains third-party resources with a leading cybersecurity company for incident response when needed, including remediation. We apply lessons learned from our defense and monitoring efforts to help manage and prevent future incidents. We have established a comprehensive incident response plan that is regularly tested and evaluated to confirm its effectiveness. In the event our CISO determines a cybersecurity incident needs to be escalated, she engages our critical escalation team who, with the assistance of third-party consultants, will make the determination as to whether the incident is material and whether escalation to senior management, the Audit Committee, and/or the Board is required.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: Spire's cybersecurity program is led by the Chief Information Officer and the Managing Director of Information Security, who together have over 40 years of experience in information technology and cybersecurity, along with a cross-functional team of technology, legal, physical security and risk leaders. Internal Audit provides assurances of risk management activities, including certain third-party cybersecurity activities, such as penetration testing.

companyName: SPIRE INC

ticker: SR


text: Cybersecurity risk is initially overseen by the management Information Technology Steering Committee (the "ITSC"). The members of this committee include the Company's Chief Information Officer, Chief Compliance Officer (who is also the Information Security Officer), Chief Executive Officer, Chief Financial officer and other critical executive management members. The ITSC also includes a non-voting member that is an outsourced cybersecurity expert.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: The cybersecurity risk management program is integrated into our broader enterprise risk management framework, which allows our senior management team, with oversight of our Board, to develop a more holistic view of our risk exposure and prioritize and manage such risks accordingly.

companyName: AUTOZONE INC

ticker: AZO


text: The ongoing improvement of our cybersecurity measures is overseen by our Vice President of Engineering, who is part of our Chief Operating Officer organization and manages the Information Technology team, and the designated Data Security Coordinator, encompassing regular program reviews, risk assessments, and employee training sessions to fortify our proactive security posture. We do not employ or engage any third parties to assist with cybersecurity consulting or monitoring other than technical support teams from our application vendors.

companyName: CuriosityStream Inc.

ticker: CURI


text: Training and Awareness Our employees undertake cybersecurity and data privacy training during onboarding and the majority of our employees complete annual refresher modules. JFrog also maintains a secure-code training program for developers and quarterly phishing simulation to improve our employees' awareness and resilience. Employees who do not meet our performance expectations in such simulations are required to undergo additional training.

companyName: JFrog Ltd

ticker: FROG


text: The Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and information security risks, including oversight of management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management regarding our cybersecurity program. These reports include updates on our cybersecurity program and the status of projects to strengthen our information security systems. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: We have been and may be subject to security breaches, which have resulted in and could result in unauthorized access to our facilities or the information that we are trying to protect. When these incidents occur, we have taken appropriate remediation steps and, through investigation, determined that the events or incidents did not have a material effect on our business, results of operations, or financial results. Although we are not aware of any material cybersecurity incidents, because of the past cybersecurity threats and what we have learned in responding to those threats, we have enhanced our cybersecurity protection efforts.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: Our Information Security function is led by our CISO and is responsible for executing our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: TERADATA CORP /DE/

ticker: TDC


text: As an externally managed company, we rely on TPG's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an enterprise risk committee ("ERC") to manage overall risk, including cybersecurity risks identified by TPG's cybersecurity team. The ERC includes representatives from relevant functions and is led by TPG's chief executive officer. TPG has also established an operational risk committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of TPG's risk management, control and governance processes is assigned to TPG's chief information security officer, who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within TPG, including compliance, human resources, internal audit and legal.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: The Cyber Risk Committee ("CRC"), comprised of a cross-functional group of senior executives including the CIO, CISO, Chief Financial Officer and General Counsel, provides advice and governance regarding the Company's strategic management of cybersecurity across the Company, including cybersecurity risk posture, projects, issues, threat intelligence and escalations. The CRC meets at least quarterly and receives reports and presentations from the CISO or third parties on internal and external cybersecurity matters; and, as appropriate, briefings from the CISO on cybersecurity incidents, the Company's incident response, recovery and remediation, and actual or potential impacts.

companyName: Xylem Inc.

ticker: XYL


text: While we have not experienced material cybersecurity threats or incidents, or threats or incidents that are reasonably likely to materially affect us, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Information on cybersecurity risks and threats we face can be found in Part I, Item 1A. Risk Factors—"Cyber-attacks or other disruptions to our information technology systems could lead to reduced revenue, increased costs, liability claims, fine or harm to our competitive position".

companyName: ADAMS RESOURCES & ENERGY, INC.


text: Additionally, we must also comply with extensive regulations, including requirements imposed by the FDA related to adequately safeguarding patient information. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: We implement and maintain technical, physical, and organizational measures, processes, and policies that are designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, an incident response plan and policy, a vulnerability management policy, risk assessment process, processes and policies to address access to systems and networks, physical security protocols, processes for asset management, encryption of certain Company data, systems and networks, penetration testing, IT risk assessments and employee training. We also maintain cybersecurity insurance.

companyName: ENZO BIOCHEM INC


text: To date, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding cybersecurity risks, see " Item 1A. Risk Factors."

companyName: VICI PROPERTIES INC.

ticker: VICI


text: Our cybersecurity program utilizes various risk mitigation techniques to manage cybersecurity risk, including network segmentation, deployment of detection tools, and monitoring compliance with security standards. We conduct cybersecurity risk assessments (including in connection with our annual business risk assessment), penetration tests, purple team exercises, and data restoration testing and reviews through both internal subject matter experts and with the support of third parties to identify threats and vulnerabilities that could adversely impact our business operations. We also attempt to assess the cybersecurity risk profile of, and threats related to, our business partners, vendors and service providers through various methods including the use of attestations and certifications of their security practices. In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. The underlying controls of our cybersecurity program utilize recognized practices and standards for cybersecurity and information technology security, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The risk-based approach of the NIST Framework enables us to design and implement cybersecurity programs that are specific to our network architectures, customer environments, and institutional resources.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company's innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents. Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure obligations under Item 1.05 of Form 8-K. The full Board receives periodic updates on information technology and cybersecurity matters from company management (including the CIO and CISO) and external advisors from time to time and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity landscape and regulatory reporting requirements.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management will report to the Board of Directors and provide updates on the Management's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: CO2 Energy Transition Corp.

ticker: NOEM


text: Triton's Information Security Program includes policies and procedures concerning cybersecurity matters, which include a cybersecurity incident response plan as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to password standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of electronic devices, electronic communications and social media. We perform routine vulnerability scanning of our network, with a focus on timely remediation of vulnerabilities. Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. We periodically perform simulations and tabletop exercises at an information technology department and CIRT level and incorporate external resources and advisors as needed. All employees and certain contractors are required to complete cybersecurity trainings annually. We conduct cybersecurity phishing exercises, and follow-up training as necessary, to ensure employees maintain a high level of vigilance regarding cybersecurity risks. Using external resources, we also conduct periodic cybersecurity risk assessments, penetration tests and internal threat testing to assess our processes and procedures and the threat landscape and help guide and prioritize our cybersecurity investments and solutions. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Triton maintains dedicated backup systems and applications with enhanced ransomware protection features. In the event of an incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying relevant functional areas, as well as senior leadership and the Board, as appropriate. We also maintain incident response service retainers with independent third parties to assist with response and recovery efforts. We continue to expand our cybersecurity investments and defenses and are establishing a cybersecurity operations center to be managed by a third party to provide 24/7 monitoring of our global cybersecurity environment and assist with coordination, investigation and remediation of alerts.

companyName: Triton International Ltd

ticker: TRTN-PA


text: We employ and manage various third party partnerships to help protect us from cybersecurity threats. These organizations provide services such as penetration testing, security assessments, as well as twenty-four hours per day monitoring, alerting and response, including incident responses, all of which adhere to our overall ERM framework. Our partners evaluate and rank our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats. Our digital infrastructure undergoes both internal and external audits as part of our Sarbanes-Oxley audit process and is designed to address the requirements of applicable information security standards and an evolving cyber landscape.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a dedicated cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we operate a CFC to monitor both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.

companyName: Baker Hughes Co

ticker: BKR


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.

companyName: BrightView Holdings, Inc.

ticker: BV


text: As of the date of our filing of this report, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, cybersecurity risks associated with our information technology systems and the systems of our customers and vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See "Item 1A. Risk Factors—Risks related to laws, regulation, and governmental compliance— We are subject to cybersecurity risks and threats as well as increasing regulation of data privacy and security."

companyName: Transocean Ltd.

ticker: RIG


text: Cybersecurity Management Team Our cybersecurity and information security program, which includes data privacy, is the responsibility of our Chief Information Security Officer ("CISO"), who oversees our global information security program. Our current CISO has served in various information technology and information security roles over the past 20 years, having built the Company's information security program over the last 10 years, and serving as CISO since December 2017. We expect our current CISO to transition his responsibilities to our new CISO over the coming quarter. Our new CISO brings diverse perspectives and significant skills and experience leading security organizations across a number of technology companies.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: For a discussion of how any risks from cybersecurity threats could materially affect the Company, including our business strategy and results of operations, see "Risk Factors – A cyber security incident or data privacy issue could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection and privacy laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business," which is incorporated by reference into this Item 1C.

companyName: Vericel Corp

ticker: VCEL


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team with substantial relevant experience in designing and managing our information technology infrastructure and system, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity to assess and enhance the effectiveness of our security programs. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support and audit our cybersecurity preparedness. We have also adopted cybersecurity incident response guidelines. As required by these guidelines, teams and plans are in place to respond to any cybersecurity incident, including internal and external communication responsibilities.

companyName: OGLETHORPE POWER CORP


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services. The results of those assessments and reviews are reported to senior management and the board of directors, including the Audit Committee, by the Head of IT, as appropriate.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: The board of directors maintains primary oversight of the company's strategic, operational and financial risks, including cybersecurity risks. The risk committee of the board of directors assists the board in its oversight of such risks and is primarily responsible for oversight of cybersecurity risks. The risk committee regularly reviews and discusses with management the current cybersecurity threat landscape, emerging trends and developments, and the company's guidelines, policies and processes for monitoring, managing, and mitigating cybersecurity risks.

companyName: FISERV INC

ticker: FISV


text: We use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from industry vendors and government agencies. Evolving threats and risks we are also monitoring and working to protect against include artificial intelligence, ransomware and nation-state attacks.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: In addition, the Company's information security/cybersecurity program is managed by the Director of Infrastructure and Security, who is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Infrastructure and Security and Chief Information Officer provide periodic reports to our Board and Audit Committee as well as our Chief Executive Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Incident Response Team, which includes the Chief Information Officer, Director of Infrastructure and Security, Chief Finance Officer and key operational leaders, is regularly engaged to discuss cybersecurity risks and to review the Company's preparations for any security events. The Incident Response Team will notify the Board of Directors of any critical events as defined in the Incident Response Plan. Additionally, the Chief Information Officer regularly engages the Board representative with cybersecurity experience to identify Board-level needs for education and communication.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: The Company's information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data on our systems as well as securing our interfaces with our critical third-party service providers. Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees, management, management's committees, as well as each individual Company employee.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Amedisys deploys a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments and penetration testing, to inform our leadership team of cybersecurity-based risks. In addition, we schedule tabletop exercises with management and other employees to test our cyber incident response plans. Amedisys has also received HITRUST certification for our internally developed applications which allows us to baseline our program to industry standards and best practices.

companyName: AMEDISYS INC


text: We continuously monitor our information systems to assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. We monitor risks through routine security assessments and implementation of enhancements to security measures used to protect our systems and data. We address system alerts on an ongoing basis. We maintain an Incident Response Plan Policy ("IRP") that sets forth processes we will follow to address incidents defined therein to include actual or reasonably suspected cyber incidents. Our information technology team promptly responds to system alerts and reported incidents that indicate the suspected presence of an incident and escalates in accordance with the IRP. The IRP, among other things, provides for a cross-functional team consisting of representatives from informational technology, risk management, legal, and communications, an Incident Response Team ("IRT"), that collaborates to quickly assess the impact, mitigate risks to information systems, and resolve incidents while improving information systems. Depending on the incident, we may utilize third-parties for assistance in investigating and addressing cybersecurity incidents.

companyName: Nkarta, Inc.

ticker: NKTX


text: PNC actively monitors and responds to the overall cybersecurity threat landscape via active capabilities to share information and leverage intelligence, monitoring, and response capabilities across the security industry, which include cybersecurity threats, physical threats and fraud. PNC's intelligence and analysis capabilities collaborate to analyze events and trends for possible response.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of the Information Security team, LNC operates a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third-party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with the procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of the operational risk management team's broader periodic review of third parties.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: With over two decades of cybersecurity and information security experience, our CISO leads our cybersecurity risk management team and holds certifications including CISSP, CISA, CISM, and CRISC. Leveraging their cybersecurity experience, knowledge of our company and leadership, our CISO plays an important role in both the strategic development and tactical execution of our cybersecurity risk management program. Our CISO reports to the Chief Information Officer ("CIO") and regularly consults with our Chief Legal Officer ("CLO") and other members of the legal team, as well as outside cybersecurity counsel, for strategic and operational input on risk management and compliance with applicable cybersecurity laws and regulations.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: The CIST, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes that protect, detect and respond in the defense of our data and enterprise computing systems and networks.

companyName: MOOG INC.

ticker: MOG-A


text: Our incident response plan documents the procedures for assessing and managing cybersecurity events. This plan includes protocols for identifying the nature and scope of a cybersecurity threat, including whether it originates from a third -party provider, and assessing its potential impact. Our incident response team includes senior personnel, including the general counsel, and the heads of human resources and information technology, as well as our cybersecurity senior manager. Any material cybersecurity events are reported to our Board. In addition, employees are provided with online training courses to build awareness around potential cybersecurity threats and are tested periodically to maintain their focus in this important area.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: As part of this process, we use the following tools and procedures: • utilizing "SecurityScorecard" (a third-party information security company that rates cybersecurity postures of corporate entities for the purposes of third-party management and information technology risk management), which provides an independent external enterprise view of our security posture with a focus on public-facing systems; • assessing, regularly developing, and executing on our preventative and detective controls, which we seek to align with current standards and best practices, including the incorporation of recommendations published by the National Institute of Standards and Technology in its cybersecurity framework, such as an annual audit of these internal controls; • performing attack and breach simulations; and • working with our cybersecurity vendors to adopt tooling and processes to provide high levels of protection.

companyName: ADT Inc.

ticker: ADT


text: Our Board has delegated oversight of our program for assessing, monitoring and mitigating cybersecurity risks to our Audit Committee. Our Audit Committee receives periodic reports on our program for assessing, monitoring and mitigating cybersecurity risks. In addition, as part of its overall responsibility for overseeing the adequacy of the Company's internal control over financial reporting, our Audit Committee receives periodic reports about our financial reporting information system controls and security.

companyName: Cronos Group Inc.

ticker: CRON


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes, but is not limited to, risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Chief Information Officer, Chief Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: 4.Aggregation, Reporting and Escalation: Management collects and aggregates risks across the Company in order to support strategic decision-making and to measure overall risk performance against risk appetite metrics. Management also establishes processes designed to escalate, report, and address risks and deficiencies within different business lines, according to the requirements of our policies. For additional information regarding the escalation of these risks to the Board of Directors, see "Governance" below.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We leverage the support of third-party information technology and security providers, including to perform penetration testing, threat intelligence analysis and remediation, when necessary. We have previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we have endeavored to adapt our cyber risk strategy to mitigate emerging cybersecurity risks. We implement a multi-layered approach to cybersecurity that includes, for example, employee security awareness training, various security tools and technologies, and incident response planning and remediation.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Our Board of Directors includes cybersecurity risk as part of its overall risk oversight function, and has delegated to our Audit Committee responsibility for overseeing, reviewing and discussing with management: (i) our cybersecurity, information technology and data security risks and threats; (ii) the potential impact of those risks and threats on our business, operations, and reputation; and (iii) management's processes, procedures and actions to identify, assess, monitor, mitigate, and remediate such risks and threats. Our Chief Information Officer, who reports to our Chief Executive Officer, provides the Board and the Audit Committee regular reports and assessments on our cybersecurity program and material cybersecurity risks. In addition, our Chief Information Officer updates the Board and the Audit Committee, as appropriate, regarding significant cybersecurity incidents should they occur.

companyName: Clearfield, Inc.

ticker: CLFD


text: Our management team, including our CIO, CISO and CIRO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity advisors. Our Information Technology (IT) management team collectively hold over 50 years of strategic IT and global transformational experience, including having held IT advisory roles with top-tier organizations. Each member of the team has experience operating in complex, international business environments. The IT management team has demonstrated achievement in Information Security strategy development, risk management and implementation of security and risk management programs that drive awareness, decrease exposure and strengthen organizational IT controls.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, auditors, and other third parties, to among other things: monitor Company networks, servers and endpoints to identify vulnerabilities;

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Prevention, Identification, Detection and Mitigation Activities We routinely undertake activities to prevent, identify, detect and mitigate risks from cybersecurity threats, including but not limited to the following: • Procedures and guidelines designed to ensure that information security is a key consideration in the requirements for both new information systems and enhancements to existing systems and assets; • IT environment risk assessments conducted at regular intervals and in connection with certain events, such as implementation of a new system, service or vendor; • Tabletop and simulation exercises to discuss roles and responsibilities of team members in the event of a cybersecurity incident and to test and modify the plan as needed; • Ongoing security penetration testing and threat modeling of our network and web application; • Automated tools and manual review processes to ensure ongoing compliance with technical standards and identify configuration issues and technical vulnerabilities; • Encryption of all communications with our servers, which are configured to utilize only high-grade encryption algorithms; and • Ongoing employee training related to information security and data privacy policies and standards, including periodic phishing, vishing, and social engineering exercises.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Our multi-level cybersecurity governance and risk management structure begins with our Operational Risk Compliance and Security ("ORCAS") Committee consisting of cross-functional management representatives throughout our Company. The ORCAS Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Chief Privacy Officer and Chief Information Security Officer ("CISO"), who has extensive information technology and program management experience. Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles within public and private companies. He holds two undergraduate degrees—one in business administration and the other in computer information systems, a graduate degree in information systems and maintains two cybersecurity industry recognized certifications: Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both from the International Information System Security Certification Consortium. Cybersecurity leaders reporting to our CISO also have significant information technology and information security experience and industry recognized certifications.

companyName: BLACKBAUD INC

ticker: BLKB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management processes and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management processes to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Rallybio Corp

ticker: RLYB


text: Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders. We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:

companyName: GT Biopharma, Inc.

ticker: GTBP


text: To mitigate cybersecurity risk introduced from our supply chain, we have a dedicated Cybersecurity - Supply Chain Risk Management team. This team assesses new suppliers against best cybersecurity practices, ensures cybersecurity regulations are contractually obligated and coordinates mitigation actions across the company if a supplier is impacted by a cybersecurity incident. They utilize industry monitoring services to identify potential supply chain incidents and work closely with our Cybersecurity team to understand the latest threats affecting our industry.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Cybersecurity risk management and strategy is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats. We also engage external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include risk assessments using applicable industry specific cybersecurity frameworks, control gap analyses, penetration testing, vulnerability scanning, cyber insurance that aligns with our subsidiaries' risk profiles and internal or third-party assessments.

companyName: Compass Group Diversified Holdings LLC


text: In the first quarter of 2024, we created two new corporate roles, the Chief Digital and Technology Officer and the Chief Information Security Officer. The Chief Information Security Officer will report directly to the Chief Digital and Technology Officer and be primarily responsible for assessing and managing our material risks from cybersecurity threats within management.

companyName: Cryoport, Inc.

ticker: CYRX


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the information technology department, security and compliance team and product development department work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and our senior management, such as our chief executive officer, evaluates material risks from cybersecurity threats against our overall business objectives and reports to our board of directors, which evaluates our overall enterprise risk.

companyName: Moatable, Inc.

ticker: MTBLY


text: To date we have not experienced any cybersecurity threats and any risks from cybersecurity threats have no t materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: Blue Line Protection Group, Inc.

ticker: BLPG


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the board, in conjunction with the Mortgage and Regulatory Compliance Committee (the "MRC Committee"), which focuses on the risk structure and governance related to the Mortgage Company's mortgage servicing and origination business, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings and MRC Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed.

companyName: Rithm Capital Corp.

ticker: RITM


text: To date, Commvault is not aware of any cybersecurity incidents that have materially affected Commvault's financial condition or business operations. Given the increasingly complex and sophisticated cyber threat landscape, we try to be vigilant to predict and prevent attacks. Commvault has prioritized cyber resilience measures and leverages governance processes and procedures to mitigate potential business impacts if and when an adverse event occurs. Although no material impacts have been recorded to date, IT system failures, network disruptions, cybersecurity incidents, and data breaches could adversely impact our business, internal controls, results of operations, and financial condition.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: Members of our audit committee and board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: DermTech, Inc.


text: Risks from Cybersecurity Threats Like all financial institutions, we, as well as our third-party service providers, are the target of various evolving and adaptive security threats, including malware, ransomware, phishing, credential validation and distributed denial-of-service attacks. Cyber-attacks have also focused on targeting online applications and services, such as online banking, as well as cloud-based and other products and services provided by third parties. Operational failures and breaches of security from such attempts could lead to the loss or disclosure of confidential information or personal data belonging to the Company or our employees and customers. These failures and breaches could result in business interruption or malfunction and lead to legal or regulatory actions that could result in a material adverse impact on the Company's operations, reputation and financial results.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technology initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: We have also developed a data breach response plan that includes policies and procedures to assess the nature and scope of an incident that has been determined to be a data breach, identify the information systems and types of information that may have been accessed or misused, contain and control the incident, maintain or restore business continuity, and communicate the incident to the necessary parties, dependent upon the nature and severity of the incident. In addition, we have formed a data breach response team that is comprised of individuals across the organization, including our IT Director, executive management, information technology and security, risk management, audit, legal, privacy and compliance, finance, communications, and business and IT operations. The data breach response plan outlines the roles and responsibilities of each team member, including monitoring of new data breach reporting regulations and communication protocols for incident reporting. In the event of a verified data breach, the data breach response team communicates the data breach to internal and external stakeholders, including employees, vendors, customers, law enforcement, and other federal or state agencies. The data breach response team also works with the necessary individuals to determine whether a verified data breach has a material impact to the company. If determined to be material, the data breach response team provides our CEO with documentation to communicate the incident to our board of directors.

companyName: BOISE CASCADE Co

ticker: BCC


text: The Company's board of directors is responsible for oversight of management, who is responsible for overseeing the Company's risk management processes, including cybersecurity risks. The Company's board of directors recognizes the critical importance of maintaining effective cybersecurity measures and management's role in assessing and managing material risks from cybersecurity threats. The Company's managements provides the board of directors with timely updates both on a periodic basis and as new cybersecurity risks arise.

companyName: 4Front Ventures Corp.


text: Cybersecurity Risk As a financial institution, we may be the target of a security breach due to a cybersecurity attack. While we have not encountered a cybersecurity incident that has materially impacted our operations or financial results, a security breach due to a cyber-attack in the future could result in a material impact to us, our customers, and our third-party vendors. The risk of such event could increase in the future due to the expansion of mobile banking and other internet-based product offerings, our use of internet-based services for internal and external purposes, acquisition and integration of new products and other offerings, increased use of third-party software solutions, and the growing customer reliance on mobile devices.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Our Director of Internal Control and Chief Financial Officer oversee our cybersecurity risk management program described in "Risk Management and Strategy" below. While the Board of Directors has overall responsibility for risk oversight, it is supported in this regard by the Audit Committee. The Audit Committee assists the Board of Directors in monitoring cybersecurity risk by receiving updates from and engaging in discussions as needed with the Director of Internal Control and the Chief Financial Officer, that cover, among other things, our cybersecurity risk management program, response readiness and training efforts. The Audit Committee updates the full Board of Directors on cybersecurity matters as appropriate.

companyName: Kandi Technologies Group, Inc.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: Determine, Analyze, and Prioritize Gaps. Compare the Current Profile and the Target Profile to determine gaps and create a prioritized action plan to address those gaps. Implement Action Plan. Determine actions to take and monitor against the Target Profile.

companyName: ATEL 14, LLC


text: At the management-level, the company's IT systems are overseen by our chief information officer, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who has responsibility for information security strategy and operation. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Generally, the implementation, management and oversight of our cyber risk strategy involves participation and input from Company personnel across a range of functional areas, including our IT, Security, Privacy, Risk Management and Legal departments/functions. Our strategy is designed to incorporate awareness of cyber risk into our day-to-day operations and functions, including the maintenance and establishment of client relationships, operating expectations, contract negotiations, the obtainment of insurance coverage and evaluations of third-party service providers.

companyName: Rimini Street, Inc.

ticker: RMNI


text: carrying cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident;

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: Apollo's CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to Apollo's audit committee or Apollo's Board of Directors, as appropriate.

companyName: Apollo Debt Solutions BDC


text: We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches.

companyName: GIVBUX, INC.

ticker: GBUX


text: The Company's CEO, CFO and GC each hold undergraduate and/or graduate degrees in their respective fields, and each have significant experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The members of the Boards of Directors of the Company and the Bank have hundreds of combined years of experience running successful companies and managing enterprise risk. Specific cybersecurity expertise is brought to the Board from independent directors who lead or have led technology firms and, as such, have direct managerial oversight of cybersecurity risks.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: As of the date of this Annual Report on Form 10 -K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risks titled " We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third -party vendors. " No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against cybersecurity threats. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: Risks from cybersecurity threats are among those that we review and address in our general risk management program. We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments to identify vulnerabilities.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Our Cybersecurity Risk Management Strategy includes a myriad of tools and resources that are designed to ensure the integrity of our information systems. We place a particular emphasis on protecting the privacy of our patient data pursuant to the HIPAA Security Rule. Our cybersecurity risk management process is integrated with our larger risk management system and is considered a core function of our overall risk management strategy.

companyName: FONAR CORP

ticker: FONR


text: As part of our overall risk management approach, we prioritize the management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised fully of independent directors from our Board, oversees the Board's responsibilities relating to cybersecurity risks. Each of our Audit Committee and Board is informed of such risks through reports from our Chief Information Officer ("CIO") at least twice per year.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: The information security program, policies, and standards are managed by the Vice President of Information Security Systems ("VP, ISS"), who leads the enterprise wide technology risk management function. The VP, ISS acts as the second line of defense and provides risk oversight for the Bank's technology operating infrastructure and operations. The VP, ISS function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Bank's internal auditors and Board of Directors act as the third line of defense, providing the independent assurance function. In addition to the above risk management framework, we engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Additionally, we actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections for any portion of our workforce that has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to opine on their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: Bogota Financial Corp.

ticker: BSBK


text: The Company's Director of Information Security reports to our Chief Information Officer. Our Director of Information Security is responsible for our cybersecurity program, develops and publishes security policies and procedures, and reports to the Audit Committee on the effectiveness of our security program. Our Director of Information Security has 24 years of technology leadership experience, including 18 years directly overseeing cybersecurity programs in the healthcare device manufacturing industry, and holds the Certified Information Systems Security Professional (CISSP) certification. Our Director of Information Security is responsible for the Company's Information Security Awareness Program, which includes security training for new hires and ongoing education for all staff, including annual refresher training and periodic bulletins regarding security risks. Security awareness email testing is performed on a monthly basis, with employee performance reported to management for inclusion in performance evaluations. Our Director of Information Security also performs risk assessments of third-party partners, including reviews of SOC 2 reports.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, however, there can be no assurance in that regard. (table of contents)

companyName: KAANAPALI LAND LLC

ticker: KANP


text: Our security program accounts for our significant interactions with relevant external third-parties and analyzes the potential risks introduced from doing business with them. These risks are continually assessed throughout the vendor lifecycle from onboarding to offboarding. We also engage in continuous monitoring of our cyber security risks and perform security assurance activities via independent, external third parties such as consultants, auditors, and assessors during our robust security certification audits, penetration tests, and bug bounty programs.

companyName: Gitlab Inc.

ticker: GTLB


text: Our cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Our Chief Legal Officer and our security governance steering committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Legal Officer and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their work overseeing, working with, and delegating daily operations to the IT/IS team, as well as their work developing and implementing information security policies, consistent with the IT/IS processes. These policies are reviewed at least annually with updates authorized and approved by the security governance steering committee.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Accordingly, we have devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • Implementing an Information Security Program that establishes policies and procedures for security operations and governance; • Establishing an Information Security Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • Implementing layers of controls and not allowing excessive reliance on any single control; • Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; • Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; • Leveraging people, processes and technology to manage and maintain cybersecurity controls; • Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; • Performing due diligence with respect to our third-party service providers, including their cybersecurity practices; • Engaging third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • Conducting periodic cybersecurity training for our employees and the Company's Board.

companyName: WEST BANCORPORATION INC

ticker: WTBA


text: The Vice President and Chief Information Security Officer (CISO) leads the global information security organization responsible for overseeing our information security program. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies, and is a Certified Information Security Professional and Information Systems Security Architecture Professional. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. Given the nature of our business, management is highly focused on identifying and managing cybersecurity risks, and our CISO and information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.

companyName: AGILYSYS INC

ticker: AGYS


text: In the event of a cybersecurity incident, we intend to follow the steps outlined in our Advisor's incident response plan, including notifying our Audit Committee and Board, as appropriate.

companyName: Net Lease Office Properties

ticker: NLOP


text: Our Board of Directors, as a whole and at a committee level, maintains oversight of cybersecurity risk management, with primary responsibility assigned to our Audit & Risk Committee. Comprising solely independent directors, our Audit & Risk Committee receives regular updates from our Chief Information Security Officer ("CISO") and is responsible for ensuring that management has processes in place to identify, assess, and mitigate cybersecurity risks. The Audit & Risk Committee collaborates with management to oversee the implementation of security measures, incident response plans, and ongoing risk management strategies.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: Our management team will also provide periodic briefings to the audit committee regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee will then provide updates to the Board on such reports.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Information Security Officer, Chief Information Officer, Chief Privacy Officer, Chief Financial Officer, Chief Compliance Officer and General Counsel. Such individuals have collectively over approximately 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Privacy Manager, and Certified Information Systems Security Professional. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis and annually.

companyName: DermTech, Inc.


text: Following the conclusion of an incident, the Company, with the assistance of the incident response team, will generally reassess the effectiveness of the cybersecurity program and IRP, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.

companyName: Playa Hotels & Resorts N.V.


text: Board Oversight of Risks from Cybersecurity Threats The Board of Directors ("Board") oversees risk management related to the operation of the business and corporate functions as well as the implementation of business strategy. Our Board has delegated to the Audit Committee oversight of risk management, which includes risks from cybersecurity threats. We routinely review critical elements of our cybersecurity policies and program with the Audit Committee.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Because of the industry in which we operate, we are subject to extensive regulatory requirements connected to cybersecurity, including but not limited to those overseen by the FAA, TSA, and DOT. As a result, it is imperative our cybersecurity risk management is well-planned and sufficiently robust to maintain compliance with these regulations.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: Our cybersecurity and information security program is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. The program includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect and respond to cybersecurity threats and incidents, we undertake the below listed activities: closely monitor emerging data protection laws and implement changes to our processes designed to comply; undertake regular reviews (at least annually) of our consumer facing and internal policies and statements related to cybersecurity; proactively inform our customers of substantive changes related to customer data handling; conduct annual information security training for all our employees;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: The first line of defense is operational management, which is responsible for implementing and maintaining the IS program, as well as identifying and mitigating cybersecurity risks on a day-to-day basis.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Intellicheck, Inc.

ticker: IDN


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages as part of our risk management processes. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. Although the board members are former executives of publicly traded companies, none of them have specific cybersecurity experience.

companyName: Nuwellis, Inc.

ticker: NUWE


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Evergreen Corp


text: In the ordinary course of our business, we may use, store and process confidential information and data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of data segregation, physical, procedural, and technical safeguards along with some documented policies and procedures. By fully outsourcing our IT environment and placing it within expert third party software-as-a-service, human resource, and clinical providers, our primary means of minimizing cybersecurity risk is limiting the amount of sensitive data within our enterprise.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: Third parties who provide services and solutions to our organization are also a source of cyber risk. Through a third-party risk management program, we review risks associated with these third parties through contractual reviews, vendor risk assessments, and continual risk reviews by monitoring the cybersecurity risk exposure these third parties pose and implementing remediation where necessary.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: Because cybersecurity and data privacy can affect all facets of the Company's business, the Company employs governance structures that facilitate cross-functional, proactive risk management. The Board is responsible for oversight of the Company's risks from cybersecurity threats and incidents and the Audit Committee maintains primary responsibility related to monitoring this oversight. As noted above, the Company has in place the following teams who are responsible for maintaining various phases of the Cybersecurity Risk Management Program: • Cybersecurity and Risk Management Team which is led by the VP, IT Security and Risk Management, who reports directly to the Chief Information Officer ("CIO"). The Cybersecurity and Risk Management Team is overseen by:

companyName: Bausch & Lomb Corp

ticker: BLCO


text: The Bank leverages in-house resources and third-party service providers to implement and maintain processes and controls to manage identified risks.

companyName: GUARANTY BANCSHARES INC /TX/


text: At Vaxxinity, cybersecurity risk management is an integral part of our IT strategy. Our cybersecurity risk management program is based on standard industry practices and follows the National Institute of Standards and Technology (NIST) framework, which provides steps for identifying system and operational vulnerabilities, protecting systems, detecting intrusions and malicious behavior, as well as for planning a strong response and recovery. This methodology and our smaller functional scope allow us to effectively address cybersecurity threats and incidents.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected AIR and we believe are not reasonably likely to have a material adverse effect on AIR, including its business strategy, results of operations, or financial condition. For additional information on cybersecurity risks and potential related impacts on AIR, refer to "Our business and operations would suffer in the event of significant disruptions or cyberattacks of our information technology systems or our failure to comply with laws, rules and regulations related to privacy and data protection." in Part I, Item 1A. Risk Factors.

companyName: Apartment Income REIT Corp.


text: Except for the above incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Operations."

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: To identify and assess material risks from cybersecurity threats, using our enterprise risk management framework, we consider cybersecurity risks as part of our overall risk assessment and risk management process. Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management program serves as a second line of defense, bringing holistic risk oversight and serving as a partner to the business to help first line teams strategically manage risk. Our enterprise risk management function also establishes a risk and governance framework to help identify, prioritize and optimize risk-reward decisions. Certain risks identified by our enterprise risk management function, including cybersecurity risks, are monitored by our Risk Steering Committee, a senior management level committee that includes our Executive Team. The Risk Steering Committee's review of these risks in turn informs the risk management updates provided to the committee of our Board of Directors responsible for assisting the Board of Directors with its oversight of cybersecurity risks. Additionally, Internal Audit will from time to time review certain aspects of our cybersecurity program and the related Internal Controls, and our external auditor will test relevant controls around our cybersecurity program and incident reporting.

companyName: ETSY INC

ticker: ETSY


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant, as well as any incidents with lesser impact potential.

companyName: HilleVax, Inc.


text: From a governance perspective, senior members of our Enterprise Risk Management, Information Protection and Internal Audit functions provide detailed, regular reports on cybersecurity matters to the Board, primarily through the Audit Committee, which oversees controls for the Company's major risk exposures and has principal responsibility for oversight of cybersecurity risk, and the Finance, Investment and Risk Management Committee ("FIRMCo"), which oversees business risk related to cyber insurance products. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Business interruptions could adversely affect future operations, revenues, and financial conditions, and may increase our costs and expenses."

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") has been delegated with the oversight of the Company's risk management program, which includes the identification, assessment and management of material cybersecurity risks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TIC Solutions, Inc.

ticker: TIC


text: We also maintain a privacy and cybersecurity incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct periodic tabletop exercises to test and fortify the controls of our cybersecurity incident response program. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of higher severity cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.

companyName: Workday, Inc.

ticker: WDAY


text: Michelle R. Stewart, age 53, is Vice President, Chief Accounting Officer and Corporate Controller. Since joining Eastman in 1995, Ms. Stewart has served in a number of positions with increasing responsibility in the finance organization. Prior to joining Eastman, Ms. Stewart worked for the public accounting firm KPMG Peat Marwick. Ms. Stewart was appointed to her current position effective October 2021.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: We use a multi-layered defensive cybersecurity strategy based on best practices to identify risks, protect technology assets, detect anomalies, respond to, and recover from cybersecurity incidents. Our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: • Identify - We identify risks from cybersecurity threats by first developing and maintaining an understanding of assets and systems essential to our operations and reputation, as well as assets and systems that could provide value to threat actors. Any attempt by a threat actor is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or system which would result in decreased information security or a disruption in our operations. • Assess - We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or system, or a threat actor's ability to gain access to an asset or system. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation. • Manage - We mitigate risks from cybersecurity threats by applying multiple layers of defense to maximize our continued ability to access or utilize an asset or system and minimize threat actors' ability to gain or increase their access to an asset or system. We prioritize defensive mechanisms, including administrative, physical, and technical controls, according to their relative cost and reduction in risk.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: The Internal Audit function assesses cyber security risks and audits components of cyber security on an annual basis. At least every three years, we use an external party to evaluate the maturity of our program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: We aim to monitor these risks in connection with third parties in addition to our own operations. We collaborate with external cybersecurity consultants and auditors for independent audits and vulnerability assessments of our existing processes and systems. Our third-party cyber risk assessment program is designed to oversee certain third parties and have those third parties adhere to cybersecurity standards. This program has measures to help further manage and attempt to mitigate potential cybersecurity risks arising from third-party engagements, including security audits, compliance checks for cybersecurity standards, risk evaluation procedures for certain third parties, contractual security requirements in certain third party agreements and monitoring tools. We conduct cybersecurity training with our employees as appropriate based on their roles within the Company.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, for example: professional service firms including legal counsel, threat intelligence service providers, cybersecurity consultants, 24/7 cybersecurity monitoring software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services and forensic investigators, managed detection and response providers, and external threat hunting partners.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: BancPlus' cybersecurity program seeks to address cybersecurity risks through a cross-functional approach that is focused on confidentiality, security, and availability of the information that the Company collects and stores by identifying and mitigating cybersecurity threats and effectively responding to cyber threats when they occur. BancPlus' cybersecurity program is primarily administered at the management level by the Cybersecurity Committee, which is led by Bancplus' Chief Information Security Officer ("CISO") with other members of executive management serving as members. The Cybersecurity Committee is a cross-functional governing body that drives alignment on security decisions across the Company. The Cybersecurity Committee meets regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. The cybersecurity program includes controls and procedures that are designed to ensure prompt escalation of appropriate cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the BancPlus board of directors in a timely manner.

companyName: BANCPLUS CORP


text: The IS team is staffed primarily with internal associates, and we utilize third party service providers for extended coverage. We hire IS team members that have relevant information security experience or technology certifications and knowledge to implement and oversee the procedures and processes of our IS Program and to adequately manage and enforce our policies and procedures. Further, management involved in the cybersecurity process, possess the necessary skills and expertise to adequately manage and enforce our policies and procedures.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Apollo ' s cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Manager, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Manager and Apollo), including risk mitigation, compliance and controls.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Cybersecurity Risk Management and Strategy Entero Therapeutics, Inc. has established a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information. Central to our cybersecurity efforts is a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: 3.Security Engineering: We leverage a combination of the International Organization for Standardization (the "ISO") best practice standards and other global standards, including Control Objectives for Information and Relevant Technology and GDPR, to measure our security posture and manage risk. In addition, we completed several cybersecurity-related initiatives such as multifactor authentication and the ISO 27001 certification, which is globally recognized as one of the highest standards of compliance and control for information security management systems. We have also implemented critical preventive measures, such as monthly phishing simulations, email and endpoint security and monitoring, database encryption, continuous patching, and network firewall security using both internal resources and independent third-party service providers. 4.IT Resiliency: Our IT Team has formalized disaster recovery processes, business continuity procedures and an incident response plan.

companyName: Bristow Group Inc.

ticker: VTOL


text: Our overall information security program applies an enterprise-wide, risk-based approach to information security that enables us to assess, identify and manage risk exposures, including material risks from cybersecurity threats, in a timely manner. Our information security operations and procedures provide a comprehensive Information Security Management System (''ISMS'') that enable us to maintain the confidentiality, integrity, and availability of information and systems in our environment. Our information security policies are based on National Institute of Standards and Technology ("NIST") Special Publication ("SP") 800-171 framework and apply to the entire enterprise.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: The CISO has more than thirteen years of previous professional experience across diverse roles, including managing information security, establishing robust information and cybersecurity programs, crafting business continuity and disaster recovery strategies, and managing complex IT environments as an IT Director, IT Manager, and Senior IT Systems Administrator. He attended the University of Wisconsin Milwaukee for his undergraduate in Management & Information Systems. He has worked in industries such as banking and investments, health care, real estate, private equity, and property management. He is an active member of the Midwest Cybersecurity Alliance and regularly participates in industry cybersecurity meetings and conferences to stay abreast of trends and collaborate with cybersecurity professionals.

companyName: DOC DR Holdco, LLC