text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed in accordance with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and is periodically reviewed and updated at least annually and upon significant changes to our operating environment. Our program includes the following key elements: • Systems Safeguards. We adopt the "trust by design" framework when designing new products, services and technology. We employ a variety of preventative and detective tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. • Incident Response. We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the CISO and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. • Collaboration. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness. • Education and Training. We have regular and ongoing security education and training for employees, practical exercises that simulate actual cyber attacks, and recovery and resilience tests. • Third-Party Risk Management. We maintain a third-party risk management program designed to identify, assess and manage cybersecurity risks associated with external service providers, contractors and vendors.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: The Company's Security Incident Response Team ("SIRT") structure includes an Executive Response Team ("ERT"). The ERT is composed of all members of the Executive Management Team, the Head of Business Continuity Management, and the CISO (if the incident is due to a cyber breach), and it oversees a Management Response Team ("MRT"). In the event of a security incident, the Company's designated Response Coordinator, who is the Information Security Manager or the CISO's designee, shall investigate the reported security incident and assign an initial severity level. They will gather initial facts about the security incident, analyze information it has received, identify those entities affected by the security incident, assess the preliminary severity and extent of the damage (which can be financial or reputational).

companyName: Amalgamated Financial Corp.

ticker: AMAL

secItem: Item 1C


text: The Company assesses and reports on any findings quarterly at both an internal and external Enterprise Risk Management (ERM) meeting. Our approach to managing cybersecurity risk aligns with the five key functions contained within the COBIT Framework: meeting stakeholder needs; covering the enterprise end to end; applying a single integrated network; enabling a holistic approach; and separating governance from management.

companyName: ICC Holdings, Inc.


text: Terex bases its enterprise-wide cybersecurity program on the National Institute of Standards and Technology's Cybersecurity Framework to ensure our cybersecurity measures are rigorous, adaptable, transparent and aligned with best practices in the industry. We take a comprehensive approach to cybersecurity risks, with a multi-layered cybersecurity strategy based on prevention, detection and mitigation. Primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program rests with our Vice President ("VP") Cybersecurity and Senior Vice President ("SVP") Chief Digital Officer. Our VP Cybersecurity has significant cybersecurity education/training and many years of industry experience in the field of cybersecurity. In addition, our SVP Chief Digital Officer offers added in-depth knowledge with significant experience leading technology teams. Terex also has a Global Cybersecurity Group ("GCG"), consisting of management and non-management team members, that is tasked with the continuous development and implementation of information security policies and controls.

companyName: TEREX CORP

ticker: TEX


text: ITT employs a team of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Chief Information Security Officer (CISO), who altogether make up ITT's Cyber Security Operations Center (CSOC). The qualifications of our cybersecurity team include the following industry-recognized certifications: Certified Ethical Hacker (C|EH), Security+, GIAC Incident Handler Certification (GCIH), and GIAC Foundational Cybersecurity Technologies (GFACT). Additionally, our cybersecurity team possesses several Federal Emergency Management Agency (FEMA) and Department of Homeland Security (DHS) certificates pertaining to cybersecurity. The CSOC monitors the global ITT landscape for cyber threats, provides prevention strategies, initiates incident response for detected intrusions, and prescribes proactive and reactive mitigation strategies. The CSOC serves as the cornerstone for protecting, assessing, and managing cybersecurity risks for the enterprise, which includes, but is not limited to, back office processes, critical manufacturing processes, intellectual property, and sensitive data. The CISO reports to the Chief Information Officer (CIO), who in turn reports to the Chief Financial Officer (CFO). The combined expertise and qualifications of our cybersecurity team enable us to effectively monitor, assess, and respond to cybersecurity threats.

companyName: ITT INC.

ticker: ITT


text: Additionally, in Item 1A Risk Factors under the heading of "Risks Related to Electronic Data Processing and Digital Information," forward-looking cybersecurity threats that could have a material impact on the Company are discussed. That section of Item 1A should be read in conjunction with this Item 1C.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: Cybersecurity risks related to third parties are managed as part of our Third Party Management Policy, which sets forth the procurement, risk management and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our Third Party Lifecycle Management (TLM) program sets guidelines for identifying, measuring, monitoring, and reporting the risks associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring and termination. Our TLM program includes the identification of third parties with risks related to information security. Third parties that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems may have additional security requirements depending on the levels of risk, such as enhanced risk assessments and monitoring, and additional contractual controls.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Our VP and our CIO, are both experienced cybersecurity executives. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks, we employ multiple technologies, processes and controls, all working independently but as part of a cohesive strategy to minimize risk, including the following: • Management invests in organization capability and technology to manage and identify cybersecurity and information security risks. Our Company has information security employees across the globe, enabling us to monitor and promptly respond to threats and incidents, identify and maintain oversight of cybersecurity risks associated with third parties, evaluate and deploy cybersecurity technologies, and ensure associates are educated and prepared to address shared cybersecurity risks. • We emphasize security and resiliency through business assurance capabilities and incident response plans designed to identify, evaluate, and remediate incidents when they occur. We regularly review and update our plans, policies and technologies and conduct regular training exercises and crisis management preparedness activities to test their effectiveness. • We have implemented an information and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology, and new and emerging technologies. • Our global cybersecurity program increasingly leverages intelligence-sharing capabilities about emerging threats within the Consumer Packaged Goods sector, across other industries, with specialized vendors, industry groups, and through public-private partnerships with government intelligence agencies. Such intelligence allows us to better detect and work to prevent emerging cybersecurity threats before they materialize. • The Company's cybersecurity policies, standards and processes are designed and implemented in light of the requirements of the National Institute of Standards and Technology (NIST) frameworks for cybersecurity and privacy. • Our strategy to identify, assess, protect, detect, respond to and recover from cybersecurity threats is regularly tested by external parties through auditing, penetration testing, and other exercises designed to assess and test our cybersecurity health, resiliency and the effectiveness of our program.

companyName: PERRIGO Co plc

ticker: PRGO


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such material risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) a variety of tools designed to monitor our networks, systems and data for suspicious activity; (5) an internal red team program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (6) a threat intelligence program designed to model and research our adversaries; and (7) a variety of privacy, cybersecurity, and incident response trainings and simulations. We leverage industry standard security frameworks, including from the National Institute for Standards in Technology (NIST), the International Organization for Standardization (ISO), and the American Institute of Certified Public Accountants (AICPA), to evaluate our security controls, which vary in maturity across the business and are processes we work to continually improve.

companyName: Workday, Inc.

ticker: WDAY


text: We devote significant resources to network security, data encryption, employee training, monitoring of networks and systems, patching, maintenance and backup of systems and data. We also follow best practices for IT and data security as our IT controls are aligned with DFARS / NIST 800-171 IT Security Standard for US Government Contractors. Although there have been no cybersecurity incidents that have been material to the Company to date, cyber-attacks are continually becoming more sophisticated, and our IT network is still potentially vulnerable to threats and incidents in the future. As part of our cybersecurity risk management processes, we maintain an incident response plan that establishes a set of procedures for reporting and handling cybersecurity events To assure long-term success, Luxfer is committed to discovering and preparing for all potential cybersecurity threats. We set out below certain mitigating actions that we believe help us manage our principal cybersecurity risks.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Kayne DL 2021, Inc.


text: We use the following approach to manage risks related to Information Asset protection: (i) identification and classification of Information Assets, (ii) identification and assessment of the threats to those Information Assets and the associated risk based upon impact to the business and the likelihood of their occurrence, (iii) assessment and analysis of risk, and determination of the actions required to lower risks to an acceptable level, (iv) implementation of appropriate controls or management acknowledgment or risk where controls cannot be implemented, (v) continuous monitoring and measuring of risk, (vi) ongoing communication of risks and mitigating actions, and (vii) auditing for compliance.

companyName: Clene Inc.

ticker: CLNN


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which are overseen by a team of internal cybersecurity professionals, including individuals with over ten years' experience handling vulnerability and security management, system upgrades, mitigation initiatives, user education and system re/accreditation. The Company provides regular desk-top educational training and incident simulation exercises to better address potential cyber security incidences and response thereto.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Our Board of Directors provides oversight of our ERM process and other guidelines and policies governing the processes by which our CEO and senior management assess our exposure to risk, including risk from cybersecurity threats. Our management Compliance Committee receives briefings from our CIO, Chief Information Security Officer, and other members of senior management on cybersecurity threats and related matters and assists the Board in its oversight and review of our ERM process.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: As methods of cybersecurity attacks are varied and constantly evolving, we regularly review and update systems, processes and procedures to safeguard against potential threats. However, there is no guarantee that the measures we undertake will be adequate to safeguard against all threats presented; and we may be unable to anticipate these techniques or implement adequate preventative measures. These attacks are also reviewed by our third party consultants.

companyName: PROCYON CORP


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include receiving briefings from internal security personnel; analyzing threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and reviewing alerts and reports produced by security tools deployed in the IT environment.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: The Company is committed to protecting the information of clients, employees, and stakeholders from both conventional and cyber threats. This commitment is upheld through the implementation of our comprehensive Information Security Program ("ISP"), designed to ensure the confidentiality, integrity, and availability of critical information technology ("IT") systems and data.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: We have a dedicated Information Security and Compliance organization ("ISC") that owns and operates the ISMS. The ISC organization reports directly to Keysight's Chief Information Security Officer ("CISO") and includes functions such as information security policy management, risk management, vulnerability management, compliance assurance, identity and access management, incident management, security awareness and education, and information technology ("IT") disaster recovery. Our management team has relevant expertise and experience in understanding risks from cybersecurity threats and overseeing risk management processes. Our CISO is an experienced cybersecurity senior executive with more than 25 years' experience in building and leading cybersecurity, risk management, and information technology teams.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: Education and Awareness We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: The Company has several processes in place to oversee and identify these risks, such as the Information Technology Risk Governance Committee ("ITRGC"), which is responsible for oversight of information technology ("IT") and information security ("IS") risk. This committee oversees the establishment and revision of IT and IS key risk and key performance indicators and ongoing monitoring of these metrics. The Company's Director of Enterprise Information Security is responsible for cybersecurity initiatives at the Company, including identifying and managing security risks, and escalating elevated risks to the Information Security Officer, who works in tandem with the Chief Risk Officer and collectively report on emerging and existing threats and mitigation strategies to the Board, which has oversight of cybersecurity risk, on a semi-annual basis, or more frequently, if needed. The Director of Enterprise Information Security and the Information Security Officer have 30 and 22 years, respectively, of information security experience across a wide range of industries and both possess substantial knowledge and expertise in how to manage information security and cybersecurity risks. Additionally, the team of employees supporting them maintain education and certification requirements necessary to carry out their responsibilities.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: We have a security awareness training program, required for all employees and contractors upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

companyName: Doximity, Inc.

ticker: DOCS


text: Board Governance and Risk Oversight PNC's Board of Directors maintains governance and oversight of the risks posed by cybersecurity threats through the Board-level Technology and Risk Committees.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information regarding cybersecurity-related risks we face, see "Risk Factors — Risks Relating to Our Business — We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cybersecurity incidents, as well as outages, natural disasters (including extreme weather), pandemics, terrorist attacks, accidental releases of information or similar events, may disrupt our business" and "Risk Factors — Risks Related to Our Business — Security breaches and other disruptions, including cyber-attacks, and our actual or perceived failure to adequately protect business and consumer data could give rise to liability or reputational harm."

companyName: Cable One, Inc.

ticker: CABO


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect our clients, customers, employees, and vendor information and prevent data loss and other security breaches. We also only use third party software for accounting, billing and payroll that have successful SOC 1 type 2 compliance. Both management and the Board are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents. Our current cybersecurity risk assessment program consists of an annual review of our risks and policies. The program outlines governance, policies and procedures, and technology we use to oversee and identify risks from cybersecurity threats.

companyName: SATIVUS TECH CORP.

ticker: SATT


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program, which we endeavor to align with industry standards. We have key Company policies and practices that directly or indirectly relate to cybersecurity matters, including policies and practices relating to antivirus protection, remote access, multifactor authentication, restricted access based upon business need and confidentiality of information, as well as procedures designed to reduce phishing, increase employee awareness of phishing attempts and other activities. The key elements of our efforts to identify, prevent, mitigate, and remediate cybersecurity risks and incidents through our cybersecurity risk management program include:

companyName: Airspan Networks Holdings Inc.


text: Our processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of our systems and network for cybersecurity events; • Regular testing of our Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for our employees with access to email, as well as tailored training for employees in more sensitive roles. Periodic testing to ensure the security training is effective.

companyName: GENESCO INC

ticker: GCO


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including, through the Audit Committee, cybersecurity and information security risk management and controls. As part of its oversight function, the Board, directly and through its Audit Committee, oversees the Company's risk assessment and risk management policies, including related to cybersecurity. At least semi-annually (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Oversee Third-Party Risk Risk assessments are conducted when we onboard new services and new vendors, including third-party vendors, applications, and other technology services, when there are significant changes to IT or security architecture, and when systems handle sensitive data. Third-party risks are documented as part of a risk management process that follows an industry standard framework with a goal of remediation or mitigation.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: The audit committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is composed of all of our independent directors.

companyName: Pacific Oak Strategic Opportunity REIT, Inc.

ticker: PCOK


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customer's confidential information ("Information Systems and Data").

companyName: Xometry, Inc.

ticker: XMTR


text: Our Board of Directors (our "Board") is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our Board delegates to the Audit Committee oversight of certain aspects of our risk management process, including risks related to information technology, data privacy and cybersecurity.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: The ongoing improvement of our cybersecurity measures is overseen by our Senior Vice President of Corporate Systems. We do not employ or engage any third-parties for cybersecurity consulting or monitoring, aside from technical support teams from our application vendors.

companyName: Cineverse Corp.

ticker: CNVS


text: Security Incident Management – Security incident response plans and procedures have been developed in collaboration with our MSSP. They allow us to assess potential threats, first and second level notification and response protocols, and supporting notification protocols – both internally and externally. These plans, procedures, and protocols are tested and updated on a regular basis.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Limited Physical Access to Local Servers and Company's NAS: We enforce strict physical security measures to safeguard our local servers and Network Attached Storage (NAS) devices. Access to these critical assets is restricted to authorized personnel only, thereby mitigating the risk of physical tampering or data theft.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. In the event of a cybersecurity incident impacting us, the management team expects to report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our IPO.

companyName: Athena Technology Acquisition Corp. II

ticker: ATEK


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business, our business strategy, our results of operations or our financial condition.

companyName: Powerfleet, Inc.

ticker: AIOT


text: We have an established incident response plan to address and guide our employees and management on our response to a cybersecurity incident. The Company has two management committees that assist with cybersecurity incidents and risk management. These committees consist of senior leadership and cross-functional members from across our organization. The Consumer Data Privacy Committee assists with identifying and managing consumer data privacy issues. The Cybersecurity Disclosure Committee ("CD Committee") assists senior management in fulfilling their responsibilities for oversight of the accuracy and timeliness of disclosures made by the Company in response to cybersecurity incidents and vulnerabilities. In the event a potentially significant cybersecurity incident is identified by our information security team, such incident is reported to the CD Committee to consider applicable disclosures, with the assistance of outside counsel as needed. In addition, senior leadership prepares an enterprise risk management report identifying and evaluating enterprise risks, including cybersecurity risks, which is regularly presented to the Audit Committee.

companyName: Churchill Downs Inc

ticker: CHDN


text: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems.

companyName: HUMBL, INC.

ticker: HMBL


text: Kellye L. Walker, age 57, is Executive Vice President and Chief Legal Officer. Ms. Walker has overall leadership responsibility for Eastman's legal organization, including corporate governance, compliance and litigation management, as well as government affairs, product stewardship and regulatory affairs, global business conduct, global trade, global security, and the Company's global health, safety and environment organization. Before joining Eastman, Ms. Walker served as executive vice president and chief legal officer of Huntington Ingalls Industries. Prior to that, Ms. Walker's work experience includes serving as general counsel and chief legal officer at American Water Works Company, Diageo North America, and BJ's Wholesale Club. Ms. Walker was appointed to her current position effective April 2020.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Cybersecurity Governance Timberland Bank's Board of Directors ("Board") recognizes the significance of cybersecurity risks and provides oversight of the Bank's Cyber and Information Security Program. The Bank's Board of Directors is currently comprised of the Chief Executive Officer and seven non-employee directors; one of which has completed and received Cybersecurity Oversight Certification from the National Association of Corporate Directors ("NACD"). The Bank's primary responsibility for managing cyber risk is vested in the Bank's Information Security Analyst ("ISA"). The ISA reports to the Chief Risk Officer and serves as the primary custodian of the Bank's Cyber Security and Information Security Program.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: We maintain an extensive presence, with cybersecurity threat operations functioning continuously and uninterrupted with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.

companyName: BOYD GAMING CORP

ticker: BYD


text: Data Protection: We utilize advanced encryption and access controls to protect sensitive data both in transit and at rest. Regular audits are conducted to identify and address any vulnerabilities in our data storage and transmission practices.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: Farmer Mac's CISO manages Farmer Mac's cybersecurity program, including the identification, evaluation, and prioritization of security risks, as well as the company's response to security incidents. The CISO has more than 19 years of experience in cybersecurity and information technology and holds a Master's degree in Business Administration with a focus on Information Technology. The CISO also holds a Certified Information Security Manager (CISM) certification, which is an advanced certification indicating that an individual possesses the knowledge and experience required to develop and manage an enterprise information security program. The CISO reports to Farmer Mac's Senior Vice President – Enterprise Risk Officer, who in turn reports to the Chief Executive Officer.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: We follow industry standards for cyber security risk mitigation, including anti-virus/anti-malware protection, detection and response technologies, intelligent logging and event management, regular penetration testing and remediation. We use our own monitoring and detection, as well as emerging threat intelligence sources, in our efforts to improve protections from threats and improve internal processes based on cyber threats and risks that are impacting other companies. Our security posture is further enhanced through the use of third-party tools and services providing full time monitoring and threat response.

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: As of the date of this filing, we do not believe that our Company, including our business strategy, results of operations, or financial condition, have been materially affected by any cybersecurity incidents for the reporting period covered by this Annual Report on Form 10-K.

companyName: City Office REIT, Inc.


text: Relevant Regulations As a regulated financial institution, BankPlus is also subject to financial privacy laws and the Company's cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Business—Supervision and Regulation—Financial Privacy and Cybersecurity" in Part I, Item 1 of this Annual Report on Form 10-K.

companyName: BANCPLUS CORP


text: As the Company's CSO, Jeff Simon has extensive experience in risk management and information security, including serving as the Chief Information Security Officer at Fidelity National Information Services, Inc. Mr. Simon received his Master of Science in Computer Science, Software Engineering & Artificial Intelligence from the Johns Hopkins Whiting School of Engineering and Bachelor of Science in Business Administration and Applied Economics from Marquette University. Mr. Simon is a Certified Information Systems Security Professional.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk management assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: Our CIO's experience includes over 25 years of experience in information technology leadership roles, including ProBuild Holdings, the nation's largest supplier of building materials; Gates Corporation, a manufacturer/distributor of automotive parts; and Nupremis Inc., a start-up that provided hosting and managed services. We also have a dedicated CISO, whose team is responsible for management of PFG's Information Security Program, policies, compliance with internal/external mandates, strategy, security incident planning and response. Our CISO reports to our CIO and has more than 20 years of cybersecurity, technology assurance and controls experience, including 17 years as a Certified Information Systems Security Professional (CISSP) and 12 years at PFG in information security and compliance. Our CISO joined PFG following several years of experience working in information security consulting, including Big 4 Accounting and Assurance, as well as working in industries including banking and finance.

companyName: Performance Food Group Co

ticker: PFGC


text: Employee awareness towards potential threats and how to steer clear of any phishing or social engineering attacks, is a critical element that governs efficacy of any cybersecurity measures. To that end, Crexendo subscribes to periodic security awareness training, and mock tests for all employees and contractors. Employees and contractors are evaluated for timely completion of the trainings, on corresponding quiz scores, and based on how they fare tackling mock phishing emails. Worse than minimum required scores trigger actions to guide the person towards better security awareness and thereby score. Disciplinary actions are in store for employees/contractors who still fail to secure the minimum required score.

companyName: Crexendo, Inc.

ticker: CXDO


text: The Company's cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company's cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 38 years of IT experience, 33 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Board of Directors' Oversight and Management's Role Our Information Systems team is responsible for our efforts to comply with applicable cybersecurity standards, establish effective cybersecurity protocols and protect the integrity, confidentiality and availability of our Information Systems infrastructure. This team is responsible for cybersecurity threat prevention, detection, mitigation and remediation for the combined organization. Our cyber incident response plan requires all detections of suspicious activity in our Information Systems environment to escalate that activity to our Information Security Team who then evaluates the threat. Management (including representatives from the legal, operations, human resources, Information Systems and risk management departments) is notified by the Information Services team whenever a discovered cybersecurity incident may potentially have a significant impact on our business operations.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: Mosaic's cybersecurity program is comprised of people, processes, and technology that are designed to adequately protect the confidentiality, integrity, and availability of information technology systems and data. Mosaic has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk. The team works closely with the Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Enterprise Risk Management committee, which is comprised of members from our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes. Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.

companyName: MOSAIC CO

ticker: MOS


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents have in the past affected our business. On December 15, 2020, we detected a ransomware incident (the "Ransomware Incident") impacting our operational and information technology systems, which caused service delays for our customers. We suffered unexpected costs and impacts from the Ransomware Incident and may in the future incur costs in connection with any future cybersecurity incidents, including infrastructure investments, remediation efforts and legal claims resulting from the above. It is reasonably likely to affect us, including our business strategy, results of operations or financial condition. For more information about our cybersecurity risks, see Item 1A, Risk Factors - "Our business is subject to cybersecurity risks."

companyName: FORWARD AIR CORP

ticker: FWRD


text: Our chief information officer, who leads our IT department, oversees our cybersecurity program. Our chief information officer has twenty-eight years of IT experience. Our chief information officer reports to our chief financial officer. As part of our company's risk management function, our chief information officer provides periodic updates about our cybersecurity risk profile to our executive leadership team. We have an incident response program that provides for the prompt escalation of certain cybersecurity incidents to certain members of management, including our chief financial officer and our general counsel, so that decisions regarding disclosure and reporting of such incidents can be made in a timely manner.

companyName: B&G Foods, Inc.

ticker: BGS


text: T o date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: RenX Enterprises Corp.

ticker: RENX


text: Centuri's cybersecurity team performs independent reviews of new vendors whose services may be potentially integrated within the Centuri enterprise. As part of a standardized review process, Centuri's cybersecurity team maintains a Control Assurance Toolkit to review vendor activities, practices, and controls for alignment with Centuri's policies and procedures. Resulting control recommendations are coordinated to ensure appropriate implementation during integration activities.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Our management team, including our Chief Financial Officer, Chief Technology Officer and General Counsel (the cybersecurity disclosure committee), is responsible for assessing material risks from cybersecurity threats and our General Counsel oversees any required reporting obligations and notifications. Our Chief Technology Officer has primary responsibility for overseeing our security incident response plan, including identification and initial assessment of threat levels and escalations. Critical incidents are escalated to a cross functional data security incident management team for review, which then escalates potentially material incidents and threats to the cybersecurity disclosure committee for determinations of materiality and Audit Committee and Board communications. Our Chief Technology Officer has 20 years of experience with cybersecurity management response, and multiple direct reports who have 10 or more years of experience leading technology infrastructure and security incident response. Our General Counsel has over seven years of experience leading our incident response management team.

companyName: LANDS' END, INC.

ticker: LE


text: Our cybersecurity processes have been integrated into our overall risk management system and processes. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: Management of cybersecurity risks is a component of the Company's overall risk management strategy. The Company relies on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. The Company's operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. The Company's cybersecurity risk management strategy is designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We depend on our information technology systems, and any failure of these systems could harm our business. Any real or perceived security breach, loss of data, and other disruptions or incidents could compromise the privacy, security, integrity or confidentiality of sensitive information related to our business or prevent us from accessing critical information and expose us to liability and reputational harm, which could adversely affect our business, results of operations and financial condition."

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Immunocore Holdings plc

ticker: IMCR


text: The Board of Directors oversees cybersecurity risk management as part of its broader risk oversight responsibilities. The Board receives at least annual reports from the ISSC on cybersecurity risks, emerging threats, regulatory developments, and the effectiveness of our information security program. The Board also reviews and approves the ISP annually to ensure alignment with business strategy and regulatory requirements.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, or our operations, business strategy, results of operations, or financial condition, including as a result of any prior cybersecurity incidents.

companyName: Eventbrite, Inc.

ticker: EB


text: The Cybersecurity Committee assists the Board with its oversight of the Company's cybersecurity risks and our cybersecurity program. The Committee reviews our incident response plan, including escalation protocols, business continuity program plans, program budgets and resources, and our cybersecurity insurance program. The Committee also reviews and discusses the activities of the Council at each of its regularly scheduled meetings. The Committee operates pursuant to a written charter and calendar, each of which are reviewed on an annual basis. The Cybersecurity Committee and the full Board receive quarterly status reports on the cybersecurity program from the CSO, addressing progress and updates on various cybersecurity functions and initiatives including, for example, compliance, assessments, security operations and incident response, business resilience, distributed denial of service attacks, data privacy, technology and asset management, controls, and vulnerability management.

companyName: VERISIGN INC/CA

ticker: VRSN


text: The Partnership, in the normal course of business, at times experiences cybersecurity threats and incidents affecting its data or systems or systems of third parties relied on by the Partnership, and the Partnership's programs and measures discussed above may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. The Partnership has not identified any previous cybersecurity incidents that have materially affected or are reasonably likely to have a material effect on its business strategy, reputation, financial condition or results of operations. For information on material risks of potential cybersecurity threats, refer to Part I, Item 1A – Risk Factors – Risks Related to Business Operations – Information Security Incidents and Fraud.

companyName: JONES FINANCIAL COMPANIES LLLP


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information technology systems, our information security and compliance team utilizes a regularly updated cybersecurity incident response plan ("IRP"). The IRP has been designed taking into account a third-party cybersecurity framework focused on properly containing, investigating, and fully eradicating an incident. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing and resolving the incident as quickly and efficiently as possible, mitigating damage to the Company's systems and networks, minimizing impact on the Company's stakeholders, analyzing and executing upon reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team, including specified external forensic investigators and advisors, will depend on the particular facts and circumstances, the response team is led by the Vice President, IT Security & Compliance or his delegee. The plan also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident. Pursuant to its charter, the Audit Committee of the Board of Directors, which consists solely of independent directors and whose chair has cybersecurity experience, reviews, discusses with management, and oversees the Company's privacy, information technology and security and cybersecurity risk exposures, including: (1) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (2) the programs and steps implemented by management to monitor and mitigate any exposures; (3) the Company's information governance and information security policies and programs; and (4) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. The Audit Committee receives quarterly updates from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team, including a detailed threat assessment relating to information technology and cybersecurity risks as well as short- and long-term plans to mitigate identified risks and invest in new technological solutions and resources to support our cybersecurity program. The Board of Directors also receives updates on cybersecurity matters from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team on at least an annual basis, with periodic updates provided as needed. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.

companyName: Playa Hotels & Resorts N.V.


text: Our Board, supported by the ITBC and the ITSC, actively oversees our processes for management of cybersecurity risks and threats. The Board's responsibilities include the ongoing administration of the ISP, conducting an annual review, and granting approval. Regular reviews of reports by both the Board and the ITBC, submitted by the ITSC, ensure timely awareness of emerging concerns and facilitate continuous enhancements to our cybersecurity posture. In addition to governance oversight, the Board designates key roles crucial for effective cybersecurity management. This includes appointing the Information Security Officer ("ISO"), Chief Information Officer ("CIO"), and Chief Compliance Officer ("CCO"). The ISO and CIO roles are filled jointly by one individual, who has been with the organization for 19 years with over 25 years of experience in information technology. Our Chief Compliance Officer has been with the organization for over 36 years, with over 15 years of experience in compliance. These professionals bring diverse qualifications, certifications, and experience, ensuring a comprehensive approach to our information security initiatives. These qualifications and certifications include Certified Information Security Manager (CISM), Certified Banking Security Manager (CBSM), and Certified Information Security Professional (CISSP).

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: The full Board of Directors engages in oversight of TDS' cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and TDS' assessment of cybersecurity threats and mitigation plans. The TDS Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, at least on an annual basis.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: We engaged a third-party expert in January 2021 for the development of our information technology ("IT") risk management program, which included the development of a common framework for assessing and mitigating IT risks for the Company. The framework included a specific cybersecurity category to address measures to protect the Company from malware, ransomware and phishing, among others. The outcome was the creation of Company IT narratives and an IT risk control matrix. We regularly work with a third-party expert to test and update our risk mitigation controls.

companyName: JANEL CORP

ticker: JANL


text: As part of our cybersecurity risk management process, we conduct "tabletop" exercises during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cyber incident preparedness. These exercises are conducted at both the technical level and senior management level, which has included participation by a member of our Board of Directors. In addition, all employees are required to pass a mandatory cybersecurity training course on an annual basis and receive monthly phishing simulations to provide "experiential learning" on how to recognize phishing attempts.

companyName: BOEING CO

ticker: BA


text: Our VP of IT Security has held IT security and leadership roles at the Company for over 24 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.

companyName: SEMTECH CORP

ticker: SMTC


text: Jill Granat. Ms. Granat, age 59, was appointed General Counsel and Corporate Secretary of RBI in December 2014. Ms. Granat served as Senior Vice President, General Counsel and Secretary of Burger King Worldwide and its predecessor since February 2011. Prior to this time, Ms. Granat was Vice President and Assistant General Counsel of Burger King Corporation from July 2009 until February 2011. Ms. Granat joined Burger King Corporation in 1998 as a member of the legal department and served in positions of increasing responsibility with Burger King Corporation.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the materiality, public disclosure and reporting of such incidents can be made by management in a timely manner. Senior leadership also briefs the Board on information security matters at least annually.

companyName: BADGER METER INC

ticker: BMI


text: The Audit Committee reviews cybersecurity information technology risks in connection with its oversight of our enterprise risk management program, and reports to the Board on enterprise risk management matters on a quarterly basis. If a critical cybersecurity event is identified by the CISOs, the Cyber Security Steering Committee, with input from the business, will assess its materiality, and events that are deemed material will be reported to the Audit Committee and the Board of Directors. Additionally, our CISOs meet regularly with our senior management team and the Board of Directors or the Audit Committee to brief them on technology and information security matters, including cybersecurity risk related matters.

companyName: JBT MAREL Corp

ticker: JBTM


text: We utilize external standards, such as the Center for Internet Security framework as a starting point for the design and development of our systems that assess risk and mitigation measures. An annual risk assessment is completed and presented to the executive leadership team and the Company's Board of Directors. We discuss changes to our policies, procedures and processes needed to address gaps identified through the assessment.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Our Chief Information Officer (CIO) has over 20 years at Unisys with experience and knowledge of IT infrastructure, systems and operations; and previously our CIO spent two years as the CIO for Whitney, Bradley & Brown, Inc. (n.k.a. Serco Inc.). At Unisys, the CIO partners with our CISO and CPO on cybersecurity risk management matters.

companyName: UNISYS CORP

ticker: UIS


text: Our CISO, who reports to the Chief Financial Officer, leads the Information Security Office and our cybersecurity program. Our CISO has worked in information technology and cybersecurity roles for more than three decades and has led our program since 2018. As part of his role, our CISO is responsible for communicating and coordinating cybersecurity-related matters with the Board and the Cybersecurity Committee (as discussed above) and our executive leadership team. For example, our CISO collaborates with the Chief Technology Officer and the Chief Legal Officer on cybersecurity measures throughout the organization and the CISO works with the Chief Product Officer in connection with the introduction or updating of security features for the Dynatrace platform and our services.

companyName: Dynatrace, Inc.

ticker: DT


text: Under the oversight and direction of the Akamai executive management team and the Audit Committee of Akamai's board of directors, the Chief Security Officer (the "CSO") has primary responsibility for overseeing Akamai's management of cybersecurity risks. Reporting to the Chief Executive Officer through the Company's Executive Vice President and General Manager of the Security Technology Group, the CSO leads Akamai's Information Security Committee, which works cross-functionally with other Akamai departments, including legal, business, policy and technical functions, as appropriate, to exchange information related to cybersecurity. Our current CSO is an accomplished security professional with over 15 years of experience in building and leading information security teams at both public and private companies. Akamai's information security team is comprised of senior ranking staff who have experience in a broad range of security domains, including security operations, software security, risk management and auditing.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Our process of identifying and remediating cybersecurity risks has been integrated into our overall risk management system and processes. It is overseen by our Chief Information Security Officer and Chief Risk Officer, who report to our Board of Directors and its Risk and Technology Committee on a quarterly basis. The Chief Information Security Officer provides ongoing oversight for the management of cybersecurity risks across the firm leveraging a series of qualitative and quantitative risk assessment routines. Risk escalations are facilitated through the enterprise risk management framework, including the Company's Enterprise Risk Committee and the Board of Directors via the Risk and Technology Committee. Facilitated via regular updates on cybersecurity risk, our Board of Directors takes an active role in overseeing, managing, and setting risk tolerances for our cybersecurity program. Our Chief Information Security Officer has 15 years of technology and cybersecurity experience, including previous senior leadership roles at major financial institutions and possesses industry certifications such as the Certified Information Systems Security Professional (CISSP). Additional leaders and key contributors composing the cybersecurity leadership team possess specific expertise, certifications, and previous work experience aligned to their assigned domains. Our Enterprise Risk Committee, responsible for providing oversight for cybersecurity risks, is a cross-functional representation of senior leadership with requisite experience and expertise to provide risk oversight, including the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, Chief Compliance Officer, Chief Privacy Officer, and FIS Business Presidents.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: In an effort to deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention trainings, which cover a range of timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This incident response and prevention training functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Generation Bio Co.

ticker: GBIO


text: The Board of Directors has oversight responsibilities regarding cybersecurity risk. At regularly scheduled meetings (at least quarterly), in addition to such additional interactions as may be necessary in specific circumstances, our Chief Executive Officer and CTIO update the Board on emerging cybersecurity risks and developments impacting Nordstrom.

companyName: NORDSTROM INC


text: We operate a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience, and supporting the integrity of components and systems used in its products and services. We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or joint venture partner could materially adversely impact us. We assess third-party cybersecurity controls through a cybersecurity third-party risk assessment process. Identified deficiencies are addressed through a risk remediation process. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified.

companyName: CATERPILLAR INC

ticker: CAT


text: In recognition of the evolving cybersecurity threat landscape, we acknowledge the increasing sophistication and frequency of cybersecurity incidents. While we cannot completely protect against the possibility of a cybersecurity incident occurring, we take measures designed to mitigate risks from cybersecurity threats, including those implemented by our third-party managed services provider.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: The Company relies extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and a constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this 2023 Form 10-K for additional information. Implementing an Information Security Program that establishes policies and procedures for security operations and governance;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. IHM and the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel (the "Executive Leadership Team") are responsible for assessing and managing cybersecurity risks. Certain members of IHM periodically report to the Company's management on cybersecurity issues and management presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Reporting to Board of Directors The ERM Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The CISO, in his capacity, informs the Chief Executive Officer, the Chief Financial Officer, the Chief Audit Executive, the Chief Information Officer, and the Legal Department of aspects related to cybersecurity risks and incidents. Furthermore, the CISO escalates significant cybersecurity matters to the ERM Committee.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: We also engage third parties to assist with cybersecurity risk assessments, incident detection and response, vulnerability management, systems monitoring, and employee training.

companyName: Cryoport, Inc.

ticker: CYRX


text: As of September 30, 2025, the Company has not encountered cybersecurity incidents that the Company believes to have materially affected or are reasonably likely to materially affect the Company taken as a whole, including its business strategy, results of operations or financial condition.

companyName: Energy Services of America CORP

ticker: ESOA


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. Our CISO has over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CISO holds a Bachelor's of Science in Information Technology and a Master of Business Administration, and is also a Certified Information Systems Security Professional. He oversees our cybersecurity program and chairs a cross-functional committee that spans information security, IT, product security, physical security, and legal.

companyName: SYNOPSYS INC

ticker: SNPS


text: We work with industry-leading security consulting and technology partners and employ a "defense-in-depth" approach that uses multiple security measures to protect the integrity of our proprietary and confidential information. This approach aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. We periodically review our strategy and modify its implementation based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants. We have documented policies, procedures, and guidelines related to information security, known as our "Written Information Security Program." Our program (i) balances responsiveness to rapidly changing threats with ensuring our IT security environment's sustainability and overall effectiveness and (ii) is reasonably likely to defend against risks of cybersecurity threats that would have a material impact on our business strategy, results of operations, or financial condition. This program focuses on the following six key areas used to monitor various IT performance and security metrics: • Proactive cybersecurity processes, including vulnerability scanning, penetration testing, and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that we regularly evaluate using incident response and disaster recovery exercises based on realistic scenarios; • Endpoint technology that includes encryption, threat management, monitoring, investigation support, and backups; • Identity and access management controls that often include multi-factor authentication and additional safeguards for staff granted elevated privileges; • Employee cyber risk awareness and training that covers cybersecurity threats and actions to prevent or report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring, and contractual obligations. We review third-party control environments when possible and practical, aligning the risk exposure with our business requirements and risk tolerances.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Board of Directors and Audit Committee receive quarterly reports on information security from our CIO. The Audit Committee is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.

companyName: biote Corp.

ticker: BTMD


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with third-party vendors to perform external penetration testing, which identifies potential threats and reduces the impact and/or likelihood of these threats. Our employees perform similar intrusion tests and internal and external scans to help improve and harden the company's security posture. We also conduct security assessments of our IT vendors and certain business partners and maintain cyber incident response plans that are periodically reviewed and updated by our IT Security and Cyber Defense Teams and leveraged table top exercised performed by our IT teams. The incident response plan ties into our Cybersecurity Committee processes for review to ensure the required reporting of material incidents to the Board of Directors, as applicable.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Our information security program includes, among other aspects, antivirus and malware protection, encryption and access control, and employee training. Risks identified by the Chief Administrative Officer and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Chief Administrative Officer also periodically discusses trends in cyber risks and our strategy with our Audit Committee and management.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: Since the closing of the Transfer Agreement, we have been a shell company with nominal operations and assets and our sole business activity has been to seek, investigate, and, if warranted, acquire an interest in a business opportunity. Therefore, we do not believe that we face significant cybersecurity risk.

companyName: Agassi Sports Entertainment Corp.

ticker: AASP


text: Our VPO and acting CISO provides periodic briefings to our executive officers regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our VPO and acting CISO also provides periodic briefings to the board of directors, including the audit committee, on cybersecurity risks and activities.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: Our Sponsor, Advisor and we regularly engage third parties to provide technology and/or to perform property management services, where they and we have imperfect visibility into those third parties' susceptibility to cybersecurity threats and/or their controls. To help address this risk, our Sponsor's cybersecurity program also includes assessments of cybersecurity threats associated with their, or Advisor's and our use of certain third-party service providers. They and our Advisor leverage pre-procurement security assessments and post-procurement continuous monitoring to evaluate the security risk of certain third-party service providers.

companyName: JLL Income Property Trust, Inc.


text: Our information technology function helps identify, assess and manage our cybersecurity threats and risks. Our information technology function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated vulnerability scanning tools of the threat environment, third-party cybersecurity audits, and use of external intelligence feeds.

companyName: Repare Therapeutics Inc.


text: Our Board of Directors provides oversight to our Cybersecurity efforts to ensure effective governance in managing risks associated with cybersecurity threats. Our Head of Information Technology, provides periodic updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: These committees provide periodic summary reports on their activities and initiatives to appropriate senior executives, and the Executive Vice President and General Counsel and/or various members of the cyber and data privacy teams communicates updates to the Audit Committee or the Board.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: • Response Team: Pursuant to our Crisis Response Program, our Response Team, which comprises the General Counsel, Chief Financial Officer and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the General Counsel or Chief Financial Officer, on behalf of the Response Team, will report to or engage the Chief Executive Officer and the Chairman of the board of directors if and when an incident becomes a crisis or potential crisis. • Other Roles: The Cyber Risk Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines and independent auditors to certify compliance with our internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework. We also conduct reviews for compliance with data protection regulation such as Europe's General Data Protection Regulation (GDPR) and regulation of various U.S. states such as the California Consumer Privacy Act (CCPA).

companyName: E2open Parent Holdings, Inc.


text: Technical Safeguards: We implement current information technologies to support our cybersecurity practices. These technologies are designed to protect our information systems from cybersecurity threats and include email and internet protection, firewall and network security, intrusion detection and prevention systems, anti-malware endpoint detection and response, security event monitoring and alerting, high availability and replication, system configuration and asset management, backup and restoration processes, vulnerability and patch management, identity and access management and data encryption. These technologies and controls are continuously evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as audits by third-party specialists and certifications.

companyName: Xencor Inc

ticker: XNCR


text: The Company engages with third parties to perform security assessments of its technology environment to perform penetration testing and maturity assessment as well as providing services to support threat analysis and incident detection and response.

companyName: Johnson Controls International plc

ticker: JCI


text: Our management, represented by our Interim Chief Financial Officer, John Garilli, oversees the Company's cybersecurity risk management program. We have elected to engage third-party providers to maintain our network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our third-party providers update Mr. Garilli and other members of our executive management team with any network issues on a weekly basis and make recommendations for security upgrades as needed. The Interim Chief Financial Officer or the Chief Legal Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.

companyName: Seritage Growth Properties

ticker: SRG


text: Management often engages with specialized third-party assessors, consultants, auditors, and other experts to review, validate, and enhance its cybersecurity practices. Third-party independent assessments provide an external perspective on management's cybersecurity posture, allowing it to leverage best practices from the industry and ensure its defenses remain robust. All third parties engaged for such processes are subjected to rigorous scrutiny to ensure the third parties meet management's security standards.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Information security risks have significantly increased in recent years in part because of the proliferation of new technologies, the increasing use of the Internet and telecommunications technologies to conduct our operations, and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including, among others, foreign state agents. Our business and operations rely on the secure and continuous processing, transmission and storage of confidential, proprietary and other information in our computer systems and networks, including, but not limited to, sensitive personal information, such as PHI, social security numbers, and/or credit card information of our patients, teammates, physicians, business partners and others. Our business and operations also rely on certain critical IT vendors that support such processing, transmission and storage (which have become more relevant and important given the information security issues and risks that are intensified through our increased use of remote work arrangements).

companyName: DAVITA INC.

ticker: DVA


text: The Company has not incurred material cybersecurity incidents over the past three years The Company is not aware that any risks from cybersecurity threats, including because of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the company. The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. In addition, the Company has: • Managed Security Service Provider (MSSP) that maintains 24 hours per day, 7 days per week, monitoring of the Company's environment; • Formed partnership with Cybersecurity Infrastructure Security Agency (CISA), to monitor the Company's external traffic and external facing web environment; • Performed an internal red campaign; • Been audited by internal and external auditors.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: If required, we engage consultants, or other third parties in connection with our risk assessment processes. These service providers, where appropriate, assist us in the assessment, testing or other aspects of our security controls to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, as well as assist us in designing and implementing our cybersecurity policies and procedures.

companyName: Lite Strategy, Inc.

ticker: LITS


text: We work with third-party service providers to proactively assess our information security program and provide us with an industry view of the cyberthreat landscape, in addition to monitoring and supporting our control environment and breach notification and response processes.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – The failure in cyber security systems, as well as the occurrence of events unanticipated in the Fund's disaster recovery systems and management continuity planning could impair its ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.

companyName: AB Private Credit Investors Corp


text: We face cybersecurity risks in connection with our business operations. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced threats to our data and systems, including social engineering threats, denial of service attacks, malware and computer virus attacks. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors.

companyName: National CineMedia, Inc.

ticker: NCMI


text: The Company has a cybersecurity strategy designed to protect our information systems and data from an evolving cyber-threat landscape. Our cybersecurity program, administered by our Chief Financial Officer and overseen by the Audit Committee, has the support of executive leadership and the Board of Directors, and the Company continues to invest in cybersecurity to protect the Company's systems.

companyName: ADAPTIN BIO, INC.


text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite improved data protections and efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to fully protect all information systems from all evolving threats. Such incidents may lead to reputational harm, loss of goodwill, revenue and customer loss, legal actions, and statutory penalties, among other consequences. While we have not experienced any material cybersecurity incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents.

companyName: VirTra, Inc

ticker: VTSI


text: Diversified engages with key technology partners and suppliers to ensure potentially vulnerable systems are identified and secured, including continuous incident monitoring, regular threat testing, and control and protection of confidential information. Third-party providers are subject to an assessment every 90 days, based on various criteria, such as whether the third-party provider has access to Diversified's network, data and information systems. Third-party providers that have access are required to use MFA and their system and organization controls reports are obtained and reviewed annually.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: Our day-to-day cybersecurity and technology risk management efforts, including oversight of our information security management system, are led by our EVP of Internal Operations, a member of our executive leadership team with over three decades of experience in the field, whose cybersecurity experience includes serving as our Chief Information Officer and in executive roles at other companies leading security, operations, audit, and compliance teams. Our Chief Information Security Officer (CISO), who has over two decades of experience in cybersecurity, including over five years at Veeva, reports to the EVP of Internal Operations and oversees our security team. Our CISO's cybersecurity experience includes serving as a security architect and Director of Security Engineering at Veeva, and overseeing security, automation, and performance testing for other technology companies.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: The Company has developed and is continuing to develop processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the information technology systems and information it uses or will use, transmit, receive, and maintain. The processes for assessing, identifying, and managing material risks for cybersecurity threats include the Company's efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks.

companyName: TWIN DISC INC

ticker: TWIN


text: We periodically engage third-party cybersecurity experts to provide independent assessments of our cybersecurity readiness and control effectiveness. Our goal in collaborating with external cybersecurity firms is to gain insights and knowledge into emerging threats and vulnerabilities, industry trends and best practices to inform our risk remediation efforts. Additionally, we engage with our internal teams to perform tabletop exercises that inform our cybersecurity response capabilities and resilience.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: Board Oversight of Cybersecurity Risk Our Board of Directors has a significant role in the oversight of BBSI's cybersecurity risk. The Board's Risk Management Committee provides oversight of BBSI's enterprise-wide risk management framework, including the strategies, policies, procedures, processes, and systems established by management to identify, assess, measure, monitor, and manage cybersecurity and other risks facing the Company. The Board of Directors also periodically receives reports from third-party consultants on the current cybersecurity threat environment, the results of third-party penetration testing, and the evaluation of the Company's cybersecurity preparedness.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: Our Senior Vice President of Information Technology, a certified CISSP, who reports directly to the Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which comprises solely independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Information Technology. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors (the "Board"), primarily through its audit committee of the Board (the "Audit Committee"). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: The Adviser's cybersecurity risk management and awareness programs, which apply to us, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to us. The Adviser also completes external reviews of the cybersecurity program and practices applicable to us, which may include assessments of relevant data protection practices and targeted attack simulations.

companyName: HPS Corporate Lending Fund


text: In the event of a reported potential cybersecurity incident, our IT Team decides whether such an incident triggers our Cybersecurity Threat Evaluation and Response Plan (the "Response Plan"). If triggered, the Company's cybersecurity response team, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team, as appropriate and as set forth in the Response Plan, are responsible for developing, recommending and implementing measures to address the cybersecurity incident, including when appropriate, assessing, containing and mitigating its impact, notifying members of the Company's management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The IT Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of a cybersecurity incident.

companyName: CTS CORP

ticker: CTS


text: The Company's Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Interim CFO, General Counsel, Vice President of Investor Relations and Communications, Corporate Controller, and Financial Reporting Manager. The Cybersecurity Subcommittee of the Company's Disclosure Committee is comprised of, among others, the Company's Interim CFO, Head of IT, General Counsel, Corporate Controller, and IRT Security Officer.


text: We take an enterprise approach to information security risk management and governance. Our information security program and framework comprise processes, policies, practices, systems, and technologies that are designed to identify, assess, prioritize, manage, and monitor risks to our information systems, including risks from cybersecurity threats and events and risks associated with the use of third-party service providers.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Our Board of Directors (the "Board") recognizes the importance of cybersecurity and safeguarding our information systems and data assets. It is imperative that we maintain the trust and confidence of our customers, business partners and employees. Protecting our data and the data of our customers, business partners and employees is critical to maintaining that trust. As such, the Board is actively involved in overseeing our cybersecurity risk management program.

companyName: CULP INC

ticker: CULP