text: We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including "Cybersecurity incidents, including cyber-attacks, unauthorized access to, or accidental disclosure of, personal information including payment card information, that we or our vendors collect or store on our behalf may result in significant expense and negatively impact our reputation and business," for additional discussion about our cybersecurity risks.

companyName: Callaway Golf Co

ticker: CALY


text: The ISO and SO report to the COO and monthly written Cybersecurity reports are presented to the Board of Directors. At least annually the IT Team leadership and members of the Audit Committee and Board meet strategically to review, and as appropriate, adapt our cybersecurity program to an evolving landscape of emerging threats, evaluate effectiveness of key security controls, assess cybersecurity best practices, and to adopt the annual cybersecurity strategy. A written cybersecurity report and briefing to the full Board is conducted on an annual basis. These reports cover, but are not limited to, the Company's cybersecurity environment, threats, material cybersecurity risks and events, improvements and effectiveness, the results of periodic testing (both internal and external), and other material matters related to the cybersecurity program. Embassy Bancorp, Inc.

companyName: Embassy Bancorp, Inc.

ticker: EMYB

secItem: Item 1C


text: The CIO and CISO regularly update the Board and/or the Audit Committee on cybersecurity matters and the effectiveness of the cybersecurity program. The Board and Audit Committee also engage directly with senior leaders from the Information Technology department.

companyName: MOSAIC CO

ticker: MOS


text: We conduct regular risk assessments to identify cybersecurity threats. We also conduct assessments as part of our regular process in the event of a material change in our business practices or established procedures that may affect information systems, which are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, attack surface state and threat modeling, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We regularly perform internal audits of our cybersecurity procedures, review role-based data access rights, conduct system vulnerability scans and prepare incident logs, alerts and threat reviews. We have maintained our ISO 27001 certification since 2014 and are subject to annual ISO 27001 standard compliance monitoring audits and periodic customer security audits. During the year ended December 31, 2024, we completed the transition to the latest version of the standard and added two additional locations to the certification scope.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: The Bank has an incident response program designed to enable the Bank to respond to cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Bank actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding the full spectrum of cybersecurity risks and enhancing defenses and improving resiliency in the Bank's operating environment.

companyName: RBB Bancorp

ticker: RBB


text: The Audit Committee oversees our cybersecurity strategy and risks. The Audit Committee is provided with cybersecurity strategy and risk updates on a quarterly, or as needed, basis. In addition, the Board is provided with an annual cybersecurity update that addresses similar topics to those discussed with the Audit Committee on a quarterly basis.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: Our cybersecurity program and function is overseen by the Director of Information Technology ("Director of IT"), who has over 15 years of experience leading information technology divisions in various industries. The Director of IT collaborates with all business units to identify and assess cybersecurity risks and compliance with company policy. The Director of IT stays aware of emerging threats and trends in cybersecurity through attendance at cyber security conferences, subscription to the CISA.gov mailing list, various tech focused news outlets, and other sources.

companyName: Biofrontera Inc.

ticker: BFRI


text: We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise. The plan ensures stakeholders across the organization are identified who have the appropriate experience, training and expertise in incident management, and that the organization is well positioned to address incidents. For example, we carry out cybersecurity incident response exercises to develop widespread familiarity and experience in responding to cybersecurity incidents.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Company has established a risk committee (the "Risk Committee") consisting of executive officers, including the Company's Chief Information Security Officer ("CISO"), that is directly responsible for the Company's risk management process. The Company's cybersecurity policies, standards, and practices are integrated into the Company's risk management process. The Board oversees information technology, data security, and cybersecurity risk management through regular reports and presentations from the CISO and other management members. Vance Tang, Chair of the Nominating, Governance, and Sustainability Committee, serves as the Board Liaison for Cybersecurity. Mr. Tang has completed extensive training on cybersecurity risk mitigation, including certification related to completion of the NACD Cyber Risk Oversight Program. The Risk Committee meets at least annually to define and improve the risk-mapping process and considers any updates at least quarterly. In addition, the Risk Committee presents comprehensive reports directly to the Board at least annually through the enterprise risk management matrix, which, as described below, is reviewed by the Audit Committee.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Serious cyber-attacks or other security incidents that disrupt our operations or compromise proprietary or confidential information could expose us to significant liability, reputational harm, loss of revenue, increased costs and material risks to our business and results."

companyName: ARCH RESOURCES, INC.


text: Management of the identified risks is embedded into business processes and key decision making at every level of the Company. Our enterprise risk management team works closely with our Chief Security Officer ("CSO") and IT risk management team to evaluate and address material cybersecurity risks in alignment with our business strategy and operational needs.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of our Manager, a subsidiary of ACRES Capital Corp. ("ACRES"). As such, our Manager participates in ACRES' processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: During the period covered by this report, risks from cybersecurity threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced minor cybersecurity incidents in the past, though none that have had a material effect on the Bank's financial condition or results of operations.

companyName: Federal Home Loan Bank of New York


text: regular phishing email simulations for all employees; and cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: Material risks from cybersecurity threats are managed across GM, GM Financial, Cruise and third-party suppliers and vendors, and monitoring such risks and threats is integrated into the Company's overall risk management program.

companyName: General Motors Co

ticker: GM


text: To operate our business, we rely upon certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We are developing certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement. For our largest third-party provider, our Contract Research Organization ("CRO") which is helping us manage our potentially pivotal global trial of Berubicin, we are currently conducting a comprehensive security assessment and review including their cybersecurity practices, protocols and protections, handling of information protected by HIPAA, and physical security.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor and its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: The Corporation's cybersecurity risk management program is designed to assess, identify, and manage material risks from cybersecurity threats and is an integral part of the overall risk management program. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. The Corporation assesses its cyber security procedures and controls on an on-going basis as safeguarding its systems and data is critical to its operations and business strategy.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, and we recently established a Cybersecurity Committee of the Board of Directors (the "Cybersecurity Committee") to further enhance our cybersecurity oversight. Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Committee consists of two Board members, both of whom are independent.

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: Management's Role Managing Cybersecurity Risk and Board of Director Oversight The IS Director and the Information Security Team communicate guidance to all divisional information security personnel to ensure consistent execution of cybersecurity risk management activities. Updates on divisional cybersecurity risks, compliance and roadmap status are provided on at a least a quarterly basis to Seaboard's CEO and CFO for purposes of risk monitoring, updates to policies, allocation of resources, feedback on roadmap progress and discussions on threat remediation, among other topics.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: We engage third parties like a penetration testing firm and our managed service provider (MSP) in connection with our risk assessment processes. These service providers assist us in identifying vulnerabilities to design and implement, suggesting remediation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: The Audit Committee of the Company's Board of Directors, which is wholly comprised of independent directors, is tasked with oversight of the Company's enterprise risk assessment and risk management policies and guidelines, including cybersecurity. The Audit Committee receives quarterly cybersecurity updates from the Chief Information Officer and/or the CISO. Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries. The Audit Committee also receives updates from Internal Audit, which report on cybersecurity in the context of enterprise risk management. The Audit Committee updates the Board of Directors as appropriate.

companyName: Strategic Education, Inc.

ticker: STRA


text: During the fiscal year ended February 28, 2025, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.

companyName: ENNIS, INC.

ticker: EBF


text: Our cybersecurity functions include representatives from information technology, engineering, information security, legal, impacted business units or products and other departments as applicable (together, the "Cybersecurity Team") helps identify, assess and manage the Company's cybersecurity threats and risks. The Cybersecurity Team is responsible for identifying, assessing and managing cybersecurity risks by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools such as vulnerability scans, penetration tests and a public bug bounty program; subscribing to reports and services that identify cybersecurity threats; conducting risk assessments and internal and external audits; using external intelligence feeds; and conducting tabletop incident response exercises.

companyName: NETGEAR, INC.

ticker: NTGR


text: An incident response plan outlines the Company's response to a cybersecurity incident. Periodic testing of the plan ensures readiness and identifies refinements. Reputable third-party assessors are engaged to conduct various assessments on a regular basis.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Reporting Cybersecurity Risk The AVP, IT Security is responsible for informing executive management of cybersecurity risks and incidents. The AVP, IT Security presents quarterly briefings to the Cyber Security and Data Governance Executive Steering Committee on all issues related to cybersecurity risks and incidents. The Cyber Security and Data Governance Executive Steering Committee includes members from the senior leadership team, such as the Chief Operating Officer, the Senior Vice President of Operations Services and the General Counsel. Our highest levels of management are actively aware and involved in shaping the company's cybersecurity position and analyzing potential risks. Any cybersecurity incident or data breach that is determined to be material will be reported to the Audit Committee and the Board of Directors.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: We implement layered security controls, including firewalls, encryption, multi-factor authentication, and network segmentation. Patch management, access controls, and a robust incident response plan ensure proactive risk reduction and rapid recovery from incidents.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: The Brighthouse Financial cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, the Brighthouse Financial cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team. Brighthouse Financial also engages the services of third-party consultants to assess and evaluate the effectiveness of our controls (in alignment with the NIST Framework), to improve our security measures and strategy, and to review the Brighthouse Financial cybersecurity risk management program against the NIST Framework. The results of the most recent assessment of Brighthouse Financial cybersecurity risk management program confirmed the rigor of our cybersecurity risk management practices.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and seek to strengthen the Partnership's defenses against cyber threats. Management also monitors AI usage and has implemented a framework that tracks use and is governed by CVR Energy's Artificial Intelligence Policy and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Partnership should a cybersecurity incident occur.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Our Information Security and Information Technology teams manage and monitor our cybersecurity environment. These teams track cybersecurity incidents across Gap Inc., our vendors and third-party service providers to remediate and resolve incidents. Incidents are escalated as appropriate based on a risk assessment framework, including as needed to senior management. Gap Inc.'s Privacy team is involved to the extent data privacy concerns are implicated. We maintain incident response plans to coordinate activities taken to respond to and remediate cybersecurity incidents. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and senior management makes final materiality determination and disclosure decisions.

companyName: GAP INC

ticker: GAP


text: A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Risk Management and Strategy AIR takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. AIR regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems according to its cybersecurity policies, standards, processes, and practices, which are integrated into its overall approach to enterprise risk management. To protect its information systems from cybersecurity threats, AIR uses various security tools that help it identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. AIR's cybersecurity program is designed to align with the National Institute of Technology Standards Cybersecurity Framework 1.1, which provides a structured approach for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Apartment Income REIT Corp.


text: The Company's cybersecurity program is supervised by our Chief Information Security Officer ("CISO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity, strategy, policy, standards, and processes. The CISO provides quarterly updates related to the cybersecurity program, including any notable incidents at regularly scheduled Audit Committee meetings. The CISO updates include details regarding the magnitude, financial impact, and remediation of cybersecurity incidents. Members of our Board and senior Company executives participate in annual tabletop exercises that focus on testing response plans to ransomware, cloud security, payroll disruption, and other incidents. In addition, in order to deploy a consistent cybersecurity framework, and to manage the risk of social engineering, software downloads, and phishing, we educate employees globally through ongoing security awareness training.

companyName: Dayforce, Inc.

ticker: DAY


text: The Company deploys advanced cybersecurity technologies and best practices to deliver a highly secure technology platform for its internal operations and hotels throughout its national portfolio. Our program is built around best practice guidance taken in part from both NIST and PCI DSS framework.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and notification provisions, and use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants.

companyName: Myseum, Inc.

ticker: MYSE


text: Management's Expertise Mr. Anderson holds a bachelor's degree in business administration with a focus on supply chain management and operations engineering from the University of Texas at Austin. He has served in various roles in information technology and information security for over 10 years, including as an IT business analyst with another publicly traded homebuilder where he was responsible for maintaining production data structures and system trainings. Mr. Anderson currently serves as a CyberUSA advisory board member where he regularly attends seminars given by cyber industry experts, including certain governmental agencies. Mr. Anderson is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents. In addition, the Company's CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Our management, including our CIO and CISO, are responsible for assessing and managing material risks from cybersecurity threats. Our CIO oversees our Global Technology Organization that has primary responsibility for our overall cybersecurity risk management program. Our CIO, who reports to our Chief Executive Officer, has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. Our CISO, who reports to the CIO, has approximately 30 years of cybersecurity experience assessing and managing cybersecurity programs.

companyName: Broadcom Inc.

ticker: AVGO


text: We have data privacy and security standards across the company that are designed to comply with relevant regulations, including the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA") and PCI DSS. We employ encryption, access controls, and other data anonymization techniques to safeguard data throughout its lifecycle.

companyName: CARNIVAL PLC

ticker: CUK


text: A significant cybersecurity incident may result from actions by our employees, suppliers, third-party administrators, or unknown third parties or through cyber-attacks and could affect our data framework or cause a failure to protect the personal information of our customers, suppliers or employees, or sensitive and confidential information regarding our business and could give rise to legal liability and regulatory action under data protection and privacy laws. The Company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the Company under the heading "We rely on technology in our business and any cybersecurity incident, other technology disruption or delay in implementing new technology could negatively affect our business and our relationships with customers," in Item 1A of this Annual Report on Form 10-K. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the Company, including its financial condition, results of operations, or business strategies.

companyName: HF Foods Group Inc.

ticker: HFFG


text: We also utilize certain third-party service providers to perform a variety of critical business functions and recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. Additionally, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

companyName: Nkarta, Inc.

ticker: NKTX


text: We have implemented cybersecurity processes in accordance with our risk profile and business size and we are continually seeking to improve processes to enhance our risk management processes. Currently, we engage external resources that contribute to our existing cybersecurity practices and organizational risk assessment systems. For example, we have an employee training program that includes annual cybersecurity awareness training that is reinforced by approximately quarterly phishing campaigns.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations. In connection with these relationships, we perform due diligence, cyber risk scoring, cybersecurity related contractual obligations, and periodic reviews of third-party control environments to ensure alignment with the Company's risk exposure, business requirements, and risk tolerances.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Our board of directors is responsible for the oversight of cybersecurity risks and has delegated primary responsibility to the audit committee, which is responsible for overseeing our enterprise risk assessments and management policies, procedures, and practices (including regarding those risks related to information security, cybersecurity, and data protection).

companyName: lululemon athletica inc.

ticker: LULU


text: We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above. Audit results and the risk assessments are reviewed by our Chief Financial Officer, the principal of the MSSP, and our Vice President of Risk Management. Any exceptions are addressed with a remediation plan and implemented with appropriate resources. Audit results, risk assessments and remediation plans are discussed with the Audit Committee of the board of directors, who has responsibility for cybersecurity risk oversight, each quarter until all points are fully resolved.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Ongoing Education and Monitoring The chief information officer leads our cybersecurity team, which remains current with the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing education is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The chief information officer implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits, including penetration testing, to identify potential vulnerabilities. In the event of a cybersecurity incident, we are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Our information technology (IT) security department, led by our Senior Vice President (SVP) IT Infrastructure & Security, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes: • Enterprise security framework and cyber security standards; • Cyber security awareness and training plans; • Security assessments and monitoring; • Restricted physical access to critical areas, servers, and network equipment; • Incident response, crisis management, business continuity, and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.

companyName: FASTENAL CO

ticker: FAST


text: Our cybersecurity risk management policies and processes extend to cyber risks posed by our third-party service providers. To manage that risk we have implemented a process to identify critical vendors and perform a reasonable level of due diligence on the adequacy of their cybersecurity policies, processes and capabilities.

companyName: Tronox Holdings plc

ticker: TROX


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard / dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our head of Information Technology. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Molecular Templates, Inc.


text: Cyber Risk Management and Strategy We have developed and maintain processes designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both out internally managed IT systems and key business functions and sensitive data operated or managed by or maintained at third-party service providers. These processes are managed and monitored by a dedicated information technology team, which is led by our Head of IT, who reports to our Chief Technology Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. We constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third party service providers that have access to the personal information we collect, use, store, and transmit. We also conduct periodic employee trainings on cyber and information security, among other topics. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: Additionally, we require each third-party service provider with access to our internal systems, applications or data to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our practice is to perform due diligence, including the completion of security questionnaires and risk assessments, as appropriate, on these third parties.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: JFG conducts periodic cybersecurity risk assessments, including assessments of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CISO reviews the cybersecurity framework annually as well as on an event-driven basis as necessary, and reviews the scope of cybersecurity measures periodically, including to accommodate changes in business practices that may implicate security-related issues.

companyName: Senior Credit Investments, LLC


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past three fiscal years, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: Role Managing Risk Our Executive Team plays a primary role in informing the Audit Committee on cybersecurity risks. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies; reporting, if any, and learning from any cybersecurity events; mitigation efforts and insurance, and with regulatory requirements and industry standard.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: We have established policies and processes for assessing, identifying, and managing the risks from foreseeable cybersecurity threats and for detecting and responding to any cybersecurity incidents. These policies and processes are built into our information technology ("IT") function and are designed to align with the NIST Cybersecurity Framework, published by the U.S. National Institute of Standards and Technology.

companyName: Invivyd, Inc.

ticker: IVVD


text: We have in the past, and may in the future, experience cybersecurity incidents. Although prior incidents have not materially affected Ansys, future incidents from cybersecurity threats could have a materially adverse impact on us, including on our reputation, the results of our operations and our financial condition and could implicate lawsuits and potential civil liability, as well as regulatory fines and non-financial penalties.

companyName: ANSYS INC


text: We depend on information systems and technology in substantially all aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. We have a risk-based cybersecurity program, dedicated to protecting our data and information technology systems. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Our management team, including our Chief Executive Officer, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants which may be engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.

companyName: Hapi Metaverse Inc.


text: The CISO conducts a quarterly review of our inherent risk posture against the effectiveness of our cyber risk management strategies. This review helps in measuring the effectiveness of controls and identifying areas for improvement ensuring cyber controls is commensurate with our inherent risk profile and the Board's risk appetite.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: We engage third-party consultants in connection with our cybersecurity program. For example, we have engaged an independent consultant to not only perform certain testing but to also provide remediation recommendations as applicable regarding our information security program and information technology strategic plan.

companyName: Sitio Royalties Corp.


text: Our Vice President of IT is tasked with continuously monitoring our systems and networks for potential cybersecurity threats. The IT department monitors for incidents that meet our established materiality thresholds, which encompass items such as cost, potential impact on operations, and reputational risks, and escalates incidents within our organization for further assessment and responsive action by the Cybersecurity Committee.

companyName: Celsius Holdings, Inc.

ticker: CELH


text: ESRT's Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of ESRT's Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer (CTO) is responsible for leading the assessment and management of cybersecurity risks, oversees teams across the Company supporting our cybersecurity policies and procedures around prevention, detection, mitigation and remediation of cybersecurity incidents, and reports at least quarterly to the Audit Committee on cybersecurity strategy and risks. Our CTO has over 25 years of experience in cybersecurity and information technology, is the Chair of the Real Estate Board of Cyber Committee, a Board Member of the Real Estate Cyber Consortium and is a Board Member of the Global Cyber Consortium.

companyName: Empire State Realty OP, L.P.

ticker: ESBA


text: Our cybersecurity risk management strategy and processes are designed to identify, assess, and manage risks to the confidentiality, integrity, and availability of our information technology environment, systems, and information. The cybersecurity risk management process is managed centrally and is led by our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer. Our cybersecurity program takes a risk-based approach and is integrated with our global enterprise risk management program. Our cybersecurity risk strategy is aligned with cyber/information security frameworks and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: TE Connectivity plc

ticker: TEL


text: We have a Vendor Managemen t department that established policies and procedures to follow when utilizing third-party vendors and ensures that key risk components are mitigated based on our standards. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins.

companyName: FNB CORP/PA/

ticker: FNB


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information regarding cybersecurity-related risks we face, see "Risk Factors—Technology Factors—Our information technology systems may be vulnerable to unauthorized external or internal threats due to hacking, ransomware, viruses or other cybersecurity breaches," included in Part I, Item 1A of this report.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee regularly reviews and discusses with management the strategies, processes, and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. Our Senior Vice President (SVP) of Information Technology and other internal members of our technology team provide regular reports to the audit committee regarding the evolving cybersecurity landscape, including emerging risks, as well as our processes, programs, and initiatives for managing these risks. The audit committee, in turn, periodically reports on its review with the board of directors.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: To date, such cybersecurity risks have not materially affected us. We do, from time to time, experience threats to our data and systems that have been halted by the policies and systems in place. For more information about the cybersecurity risks we face, see Operational Risks in Part I, Item 1A of this Annual Report.

companyName: UNION BANKSHARES INC

ticker: UNB


text: Crescent's Head of Information Technology has over 30 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. Team members who support our information security and compliance programs also have relevant educational and industry experience.

companyName: Crescent Private Credit Income Corp


text: The Company has experienced issues from cybersecurity threats, including issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of its information systems and data on which it relies. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies—A Disruption, Failure or Breach of the Company's Networks or Systems, Including as a Result of Cyber-Attacks, Could Harm Its Business."

companyName: SITE Centers Corp.

ticker: SITC


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and when appropriate, a third-party risk management process for service providers, suppliers, and vendors.

companyName: Namliong SkyCosmos, Inc.

ticker: NLSC


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as artificial intelligence (AI) related risks, phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity information through a number of different methods, including awareness campaigns, gamified activities, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our InfoSec Director. Our InfoSec Director has experience building global Information Security programs and has advised organizations across several highly- regulated industries, including financial services, technology, healthcare, government, non-profit, and retail. Our InfoSec Director, with oversight from the CTO, manages Prosper's information security risk management program and informs Prosper's Enterprise Risk & Information Security Committee ("eRISC"), which consists of members of Prosper's management team and includes our CEO, Chief Financial Officer ("CFO"), CTO, and GC, regarding the prevention, detection, mitigation, and remediation of cyber risks and incidents. The cybersecurity team has decades of experience in selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. eRISC meets on at least a quarterly basis to discuss any cybersecurity incident reports, as applicable, ongoing cybersecurity initiatives and strategies, take any actions approved by the voting members of eRISC, and discuss escalation and reporting to the Board, as needed.

companyName: PROSPER MARKETPLACE, INC


text: We have implemented processes designed to identify, review and manage risks from potential data breaches, unauthorized occurrences, and other information security losses on or through our information technology systems that could result in adverse effects on the confidentiality, integrity, and availability of our systems and electronic information. These processes are managed and monitored by our information technology (IT) team as managed by our Chief Operating Officer, or "COO". Our COO has experience in overseeing our cybersecurity and information technology programs. We rely heavily on information technology consultants for advice and expertise on monitoring evolving industry standards and to monitor our compliance with applicable policies. Our processes include mechanisms, controls, technologies, and systems designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. With the assistance of our third-party vendors, we conduct regular penetration and vulnerability testing, security audits, and ongoing risk assessments. Our internal information technology team conducts due diligence on key technology vendors, contractors and suppliers. We also conduct periodic employee training on cyber and information security, among other topics, and conduct internal false flag and/or phishing campaigns to identify any employees that might need additional training.

companyName: NextCure, Inc.

ticker: NXTC


text: The Company's cybersecurity risk management program is under the direction of our Director of IT, who reports directly to our Chief Financial Officer and has over two decades of experience in the field of information technology and security. Our Director of IT drives collective focus and central coordination of our cybersecurity risk management program internally and oversees our retained external MSSP personnel. Management reports to the Audit Committee, at least quarterly, and more frequently if needed, on the Company's cybersecurity risk management program, including periodic assessments and tests addressing cybersecurity threats and incidents.

companyName: FreightCar America, Inc.

ticker: RAIL


text: We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with third party service providers, owners, franchisees, and other companies with whom we do business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Through third party service providers and attendance at seminars, Vice President of IT and Digital and CISO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition enhances our processes to identify, prevent, mitigate and remediate of cybersecurity threats and cybersecurity incidents.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Our internal cybersecurity team collaborates with external cybersecurity service providers, including auditors and consultants, to refine our cybersecurity measures. These service providers carry out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to pinpoint potential security flaws and suggest enhancements.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: At STERIS, the ERM program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.

companyName: STERIS plc

ticker: STE


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threats and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity update and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Information Officer. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: The Audit Committee reviews our disclosures with respect to cybersecurity and information technology risks. The Audit Committee also reviews with management guidelines and policies to govern the process by which risk assessment and risk management is undertaken, including but not limited to cybersecurity and information technology risks. As part of the Company's enterprise-wide risk management program, our Internal Audit team also reports to our Audit Committee regarding assessments of our cybersecurity and information technology risks, at least annually, based on regular updates by our CIO regarding such risks. Our Internal Audit team periodically reports to our executive officers and the Audit Committee regarding such risks.

companyName: PBF Energy Inc.

ticker: PBF


text: Our Chief Information Officer is responsible for developing and implementing our information security program. Our Information Security team monitors our exposure to external cybersecurity threats, leveraging automated tools and manual processes to ensure cybersecurity risk is effectively mitigated on a continuous basis. This team leverages internal IT resources, a managed security service provider, and additional third-party security software and technology services. When a specific incident has been identified, the Information Security team leverages our Cyber Incident Response Plan in conjunction with established Information Security policies to begin assessment of the incident. Depending on the type and/or severity of the incident, our Information Security team will determine (in compliance with our Cyber Incident Response Plan) whether third party expertise or consultation is necessary. If such expertise or consultation is determined to be necessary, our Information Security and Corporate Legal teams will engage with third-party experts. As part of its review of incidents, our Information Security team considers the risk exposure, potential impact, severity and implications with respect to our information technology systems. Our Information Security team is responsible for escalating incidents which are determined to be higher risk to our Cyber Event Disclosure Committee. The Cyber Event Disclosure Committee will work with our General Counsel to determine the materiality of the incident and any required disclosure. When an incident is determined to be material and is required to be disclosed, the Cyber Event Disclosure Committee will notify our senior leadership and our Board of Directors through the Audit Committee of our Board of Directors. The Cyber Event Disclosure Committee will collaborate with our Corporate Legal and Financial Reporting teams to develop any required Form 8-K Item 1.05 disclosure.

companyName: REVVITY, INC.

ticker: RVTY


text: Our information technology team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: Given the integration of third-party services within our operational framework, we extend our cybersecurity vigilance to our partners and suppliers. This includes contractual safeguards and continuous monitoring to manage and mitigate risks presented by external entities.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: Third-party Risk we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: RHINO BITCOIN INC.

ticker: RHNO


text: Our CIO has served in various roles in information technology for over 35 years. Our Hotels Chief Information Technology Officer holds an undergraduate degree in business administration and a master's degree in management of information systems and has served in various roles in information technology for over 30 years. Our Vice President of Information Security has served in various roles in information technology and information security for over 15 years. Our General Counsel and Chief Financial Officer each holds undergraduate and graduate degrees in their respective field, and each has significant experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats.

companyName: MARCUS CORP

ticker: MCS


text: The Risk Committee receives regular reports from our Information Security leadership on our cybersecurity risks, including key status updates, security issues, current and future priorities, independent assurance, threat landscape and audit findings. The Risk Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity oversight.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: To prevent unauthorized access, we have established a series of security gates across all production environments and instances two individuals have update access to production database instances, and a limited number of individuals have read-only access to our cloud environments, 2-3 members of our Platform Engineering team have access to production and test instances, and logs are generated for any changes made Risk Management: We maintain multiple AWS and Google Cloud environments, each with three sets of development, testing, and production environments. Our primary data warehousing solution is Amazon Redshift, while we use Amazon S3 Glacier for archival storage and Amazon S3 for object storage. We also employ Amazon Sagemaker for machine learning tasks and internally host Apache Superset on the AWS platform for data visualization.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: The Written Information Security Program ("WISP"), our enterprise information security and cybersecurity program, is incorporated within the ERM program and led by our Chief Information Security Officer ("CISO"). The WISP is designed to (i) ensure the security, confidentiality, integrity, and availability of our information systems and data (ii) protect against any anticipated threats or hazards to the confidentiality, integrity, or availability of such information and information systems and (iii) protect against unauthorized access to information or information systems that could result in substantial harm or inconvenience to us, our associates, or our clients. The WISP is built upon a foundation of advanced security technology, a well-trained team of experts, and is designed to operate in alignment with applicable regulatory requirements. WISP deploys multiple layers of controls to identify, protect, detect, respond to, and recover from information security and cybersecurity incidents. These controls are measured and monitored by subject matter experts and a security operations center with integrated cyber detection, response, and recovery capabilities. The WISP includes our Incident Response program, which manages information security incidents involving compromises of sensitive information, and our Security Incident Response Plan ("SIRP"), which provides a documented framework for handling high severity cybersecurity incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills around security matters at both a technical and management level, and our associates receive annual cybersecurity awareness training.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Cybersecurity risks are included in the risk universe that the Company's Enterprise Risk Management (ERM) function evaluates, with input from information security subject matter experts at the Company, to assess top risks to the enterprise. The ERM process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. Integrating cybersecurity risk into the overall ERM process in this manner assists the Company in identifying, assessing, and managing material cybersecurity risks.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: We recognize the necessity of a flexible and dynamic cybersecurity risk management strategy to defend against threats in a fast-changing digital world. For this purpose, we have invested in building a cybersecurity infrastructure to protect our information systems and secure our data from cyberattacks. Our information security program features risk management strategies, security awareness training, security operations, incident response, security governance, third-party risk management, IT security risk management, security architecture, and vulnerability management.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: As a part of the Company's overall integrated approach to risk management, the Company assesses, identifies and manages cybersecurity related risks. The full Board of Directors provides an additional level of cybersecurity risk oversight.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: Monitoring Cybersecurity Risks and Incidents Our Director of IT Cybersecurity and Networking meets regularly with members of our executive team to discuss and review risks related to cybersecurity. The reviews may include evaluations of risks and incidents identified by third-party providers retained to review our cyber risk as well as cybersecurity threat scenario planning. Identified risks related to cybersecurity threats may also be analyzed as part of our ERM process.

companyName: Cactus, Inc.

ticker: WHD


text: The chief risk officer, chief information officer and chief technology officer of Goldman Sachs among others, periodically brief the GS Board on operational and technology risks, including cybersecurity risks. The GS Board also receives regular briefings from the chief information security officer of Goldman Sachs ("CISO") on a range of cybersecurity-related topics, including the status of the Cybersecurity Program, emerging cybersecurity threats, mitigation strategies and related regulatory engagements. In addition, these are topics on which various directors maintain an ongoing dialogue with the CISO, chief information officer, and chief technology officer.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: The Company has designed and assess its cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. The Company's information security team has primary responsibility for overall cybersecurity risk management program. The Company's cybersecurity professionals are led by the Information Security Officer, who has over 23 years of experience in the information technology field, including over 3 years of experience focusing solely on the cybersecurity space. The Information Security Officer has Security+ and Network+ certifications and is currently working on obtaining CISSP. The Company's cybersecurity risk management is integrated as part of its overall risk management program, and the Company's Chief Risk Officer, Information Security Officer in conjunction with Chief Information Officer work together to develop and maintain the cybersecurity program. In addition to its own employees, the Company engages third party service providers to provide security products and services as needed, using their expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third party service providers are managed by the Information Security Officer and Chief Information Officer.

companyName: PCB BANCORP

ticker: PCB


text: Board Oversight of Cybersecurity Our board has a strong focus on cybersecurity. Our approaches to cybersecurity and privacy risk are overseen by the audit committee. At each regular meeting of the audit committee of our board of directors, our Chief Risk Officer, Chief Compliance Officer, Chief Security Officer, Chief Information Security Officer and Chief Audit Officer provide reports relating to existing and emerging cyber and data security risks, as well as reports on the Company's risk assessments and security incidents. Our audit committee chairman reports on these discussions to our board of directors on a quarterly basis. "See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity."

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Our Information Security team of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout the Company in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT systems, assets, and networks are aligned with the parent company and affiliate cybersecurity framework. We engage independent third-party consultants from time to time to assess the adequacy of our cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. The Senior Vice President – Chief Information Officer, or CIO, who reports to the Executive Vice President and Chief Operating Officer, oversees this group and is responsible for managing the program, in collaboration with our business and functions. Our CIO has been in that role at the Company since 2004 and has extensive experience with cybersecurity and information technology at the Company.

companyName: Waste Connections, Inc.

ticker: WCN


text: The Company also conducts cybersecurity exercises and training. For example, certain corporate associates and management-level associates in our stores and distribution centers must complete cybersecurity training on an at least annual basis, which educates the associates on the Company's policies and procedures for the handling of customer and employee personal data, incident reporting, and avoiding common cybersecurity threats such as phishing attacks. In addition, targeted training for corporate associates occurs throughout the year, and regular audiences include associates on the Company's marketing, data analytics, and user experience teams. The Company's management holds annual executive data incident tabletop exercises and the information security team holds more frequent technical tabletop exercises.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: a security team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Our chief information and operations officer is a member of our leadership team and has been in this role since 2008. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. In 2023, we established an information technology risk committee comprised of senior managers in our information technology, loan origination, loan servicing, accounting, and legal groups that meet monthly to review information security risks and the development and implementation of policies and procedures and other controls to mitigate cybersecurity and other information security risks. Our CISO provides a report to our management risk committee on the activities of the information technology risk committee, which committee, in turn, reports regularly to the full Board on its activities.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and personnel, including our VP of IT, who reports to our Chief Accounting Officer, to manage the risk assessment and mitigation process.

companyName: Arq, Inc.

ticker: ARQ


text: We provide all salaried employees, including new hires, cybersecurity training courses that sensitize them to risks and threat actor tactics. We also provide specialized security and data privacy training for certain employees, such as those handling sensitive or protected health information. On a quarterly basis, our cybersecurity organization conducts simulated phishing exercises to test and educate employees on real-world threats.

companyName: Aramark

ticker: ARMK


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness and GLBA Safeguards Rule to protect user data. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to industry best practices for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.

companyName: Oak Valley Bancorp

ticker: OVLY


text: We also have a cybersecurity incident response plan to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Audit Committee and the Board. We periodically (at least annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.

companyName: FLEX LTD.

ticker: FLEX


text: Cybersecurity-related risks are assessed as part of the enterprise risk management program. The Audit Committee is responsible for overseeing the Company's enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks. Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly updates on the these risks.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Additionally, Deutsche Bank Group's Information Security Management System has been certified according to ISO 27001 for all information security domains defined in that standard since 2012. To maintain the ISO 27001 certification, Deutsche Bank Group performs a full recertification process every three years, with the latest taking place in 2024. With the last recertification, Deutsche Bank upgraded its Information Security Management System to the 2022 version of ISO 27001. Furthermore, the Deutsche Bank Group performs an annual surveillance audit designed to ensure compliance between certification intervals.

companyName: RREEF Property Trust, Inc.


text: The Company has also established a governance structure and organization to manage cybersecurity risk. This includes escalation and reporting of cybersecurity incidents through the Chief Risk Officer's organization to an Executive Response Team and the Board, and periodic reporting on the Information Security Program to the Information Security Subcommittee of the Enterprise Risk Management Committee, an executive committee that oversees the Information Security Program, and the Enterprise Risk Oversight Committee (the "EROC"), the Board committee that oversees the ERM framework.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: The Company has cybersecurity capability, including a Security Operations Center ("SOC") that is managed by a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes. The SOC provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss. As part of the Company's holistic approach to cybersecurity, we have implemented programs and technology associated with threat hunting, vulnerability scanning, and threat detection and response technology.

companyName: Garrett Motion Inc.

ticker: GTX


text: The CISO leads a full-time Security Risk & Compliance team that assesses, identifies and manages material risks from cybersecurity threats and oversees our Information Security Risk Management Program. These efforts include the identification, assessment, and treatment of potential harms to Tyler's technology, data, and intellectual property. The team continually monitors the potential for harm to help manage the level of risk.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: The Risk Committee is tasked with developing and overseeing risk management processes and systems of internal controls. These are intended to ensure that management and the Company's Board of Directors have identified, and evaluated key enterprise risks and implemented mitigating controls. This includes the groups Incident Management and Information Security Plan, which assesses, identifies, and manages cybersecurity risks. The Committee reports to and receives direction from the Board as part of its oversight function.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer ("CTO"), internal staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Wag! Group Co.


text: Notwithstanding the efforts we take to manage our cybersecurity risk, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: We have processes in place for assessing, identifying and managing significant risks from potential cyber threats and vulnerabilities. To protect our information systems from cyber threats, we use a wide variety of tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and/or remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities affecting information systems and data.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: We periodically engage consultants, auditors, or other third parties. These service providers assist us to design, implement or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.

companyName: COHERENT CORP.

ticker: COHR


text: After the discovery and confirmation of an incident, the IR core team evaluates materiality, which includes business impact analyses, consideration of the nature, scope, and timing of the incident, and an assessment of whether it is at least reasonably likely the incident will have a material impact on our operations and/or consolidated financial statements.

companyName: AdTheorent Holding Company, Inc.


text: On February 13, 2024, as amended on February 21, 2024, the Company disclosed the occurrence of a cybersecurity incident. We continue to investigate the extent of the incident. As of the date of this Report, the incident has not had a material impact on the Company's operations, and the Company has not determined the incident is reasonably likely to materially impact the Company's financial condition or results of operations.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: There is also oversight of the risks posed by cybersecurity threats and no analysis of what may be the result of such a breach of cybersecurity. There is no audit of Company personnel software loaded on computers or security requirements and no audit of computer usage. Given the distance between coworkers this would be too expensive at the present time in the cycle of the Company were we are severely underfunded.

companyName: NEXT-ChemX Corporation.

ticker: CHMX


text: As of the date of this annual report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition. Our board of directors (the "Board")

companyName: Armlogi Holding Corp.

ticker: BTOC


text: Further, as part of our cybersecurity risk management processes, we maintain a cybersecurity incident response plan (CIRP) that establishes a set of procedures for reporting and handling cybersecurity events. The CIRP delegates to an internal incident response team the initial assessment, investigation and remediation of the event and includes, among other procedures, guidelines for escalation to senior management and engagement with law enforcement. In certain instances, events are escalated to the Cybersecurity Incident Disclosure Subcommittee, which is a subcommittee of the Company's Risk Management Committee (RMC) (discussed further below) and is responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents under the federal securities laws, including making the materiality determination and approving related securities disclosures.

companyName: Walt Disney Co

ticker: DIS


text: Third-party partners who are in possession of our confidential information are generally required to notify us in the event of a cybersecurity incident within their systems that have, or are reasonably likely to, compromise the security of such information. When appropriate, we enlist CyberTeam to perform a risk and security assessment of the cybersecurity protocols and procedures of critical third-party partners.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: Cybersecurity risk oversight is also a key area of focus for management. As discussed above, the CISO is the primary management team member responsible for the cybersecurity program, strategy, policy, standards and processes. On a quarterly basis, or more frequently if a need arises, the CTO and CISO present a briefing to the Audit Committee regarding the Company's cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Potentially material cybersecurity matters are escalated to the Audit Committee and/or the full Board of Directors, as appropriate, for risk oversight.

companyName: GoHealth, Inc.

ticker: GOCO


text: Company engages two external cybersecurity and information technology consultants to work with the Company, including the general counsel, to help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, and conducting third-party threat assessments.

companyName: GENELUX Corp

ticker: GNLX


text: Board Oversight of Cybersecurity Risks The Board of Directors of the Company provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Audax Credit BDC Inc.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.

companyName: AVIENT CORP

ticker: AVNT


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee risks related to cybersecurity matters to our Audit Committee. Our Audit Committee regularly receives reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as customers, service providers, and suppliers, and the current threat environment. These reports and presentations are provided by senior personnel with responsibility for IT security, including our Security, Risk and Compliance Director (SRC Director) and our Chief Information Officer. Our board, through its interactions with our Audit Committee chair and our SRC Director and Chief Information Officer receives periodic updates regarding cybersecurity risk matters and prompt and timely information regarding significant cybersecurity incidents and our response to such incidents.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party CROs, CMOs, licensees, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption in our business and operations or could subject us to sanctions and penalties that could have a material adverse effect on our reputation or financial condition." included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.

companyName: AGENUS INC

ticker: AGEN


text: As part of our enterprise security program, we perform risk assessments relating to cybersecurity and technology risks. Our enterprise security program has been developed based on industry standards, including those published by the International Organization for Standardization (ISO) and the National Institute of Standards and Technology. The program includes a comprehensive set of enterprise security policies and procedures that guide our protection strategy. Our policies, procedures and practices include, but are not limited to: • identifying critical assets and high-risk threats and analyzing identified risks to determine the potential impact on the organization and the likelihood of occurrence; • cybersecurity detection, controls and remediation practices, including vulnerability assessments, penetration testing and tabletop exercises; • an incident response and recovery plan that includes escalation protocols, procedures for containment of incidents and investigation and remediation procedures; • installation of and regular updates to antivirus software on all company managed systems and workstations to detect and prevent malicious code from impacting our systems; • conducting regular workforce trainings for employees to identify cybersecurity concerns and educate employees on potential risks and best practices; • evaluating the effectiveness of our program by performing internal assessments; • periodic external audits by an independent third party to test for the adequacy of, and compliance with, controls and standards; and • regular collaboration with leading global security providers, intelligence and law enforcement communities and industry peers to exchange information on trends and best practices in order to address new and evolving cybersecurity risks.

companyName: ANALOG DEVICES INC

ticker: ADI


text: The Company regularly reviews its cybersecurity standards, and procedures and evaluates the effectiveness of implemented security controls. The Company adjusts its cybersecurity standards and programs as necessary.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: We maintain a variety of programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, as well as various other regulatory requirements and industry-specific standards. The Bank also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: We have a third party risk management program designed to oversee, identify, and mitigate material risks from cybersecurity threats associated with our use of third-party service providers. We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example: reviewing the third party's relevant security audits and assessments, conducting our own security assessments, and imposing contractual obligations related to information security.

companyName: Zoom Communications, Inc.

ticker: ZM


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection with onboarding new vendors and engaging in periodic reviews thereafter as appropriate.

companyName: Beyond Air, Inc.

ticker: XAIR


text: We staff an internal cybersecurity team and maintain a third-party managed security operations center which in-concert provide 24x7x365 real-time detection and response. These teams are always connected and routinely respond to perceived threats within minutes. Time to detect and respond metrics are continuously evaluated for opportunities to enhance our program.

companyName: RadNet, Inc.

ticker: RDNT


text: The audit committee meets periodically to review and assess the effectiveness of our cybersecurity program, incident response plans, and overall resilience against evolving threats. The audit committee also actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures cybersecurity considerations are integrated into Snap One's broader strategic objectives.

companyName: Snap One Holdings Corp.


text: Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and supported by our business continuity teams.

companyName: BGC Group, Inc.

ticker: BGC


text: All employees receive cybersecurity training upon hire with annual or more frequent training thereafter with job-specific topic considerations. Our IT team engages third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. The employees within our broader IT team who specialize in cybersecurity operations (Security Ops Team) are responsible for coordinating and overseeing the activities of these third-party vendors.

companyName: EXELIXIS, INC.

ticker: EXEL


text: Pursuant to the Audit Committee Charter, the Audit Committee reviews management's assessments of, and plans with respect to, the Company's cybersecurity and other enterprise risks. The Audit Committee typically receives updates from a Security Committee member quarterly with respect to Information Security team activities.

companyName: QUINSTREET, INC

ticker: QNST


text: Chief Financial Officer oversees information security efforts in conjunction with a third-party IT services company and reports material cybersecurity matters to the Chief Executive Officer and Board of Directors.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: Incident Response and Recovery Planning—We maintain incident response and recovery plans that address our response to a cybersecurity incident. These plans are tested and evaluated on a regular basis.

companyName: Redfin Corp


text: The Company has implemented technologies and tools to evaluate its cybersecurity protections and maintain a cyber risk management strategy related to its technology infrastructure that includes monitoring emerging cybersecurity threats and assessing appropriate responsive measures.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: The Audit Committee receives periodic reports from management and the IT Managers for Graham Corporation and BN on our cybersecurity risks at least annually. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: GRAHAM CORP

ticker: GHM


text: Risk Management and Strategy DuPont has implemented processes for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. DuPont's cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and containment. The Company has other policies and procedures which directly or indirectly relate to cybersecurity, including those related to remote access monitoring, encryption standards, antivirus protection, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. The Company also engages third parties in connection with the assessment of its cybersecurity risk management processes against the NIST framework.

companyName: DuPont de Nemours, Inc.

ticker: DD