text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. See "Risk Factors - General Risk Factors" for additional information.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats and to protect the confidentiality, integrity, and availability of our IT assets and data. We utilize a widely adopted industry framework to guide and benchmark the activities of our information security program in alignment with our risk appetite statement. Our cybersecurity program includes specific controls and processes for the monitoring, mitigation, and reporting associated with cybersecurity risks. For example, administrative, physical, and logical controls are in place for identifying, monitoring, and controlling system access, sensitive data, and system changes. In addition, we employ an information security training program that includes security training lessons and phishing exercises for all employees as well as mandatory staff training on cyber risks. We also regularly engage with third-parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, penetration testing, detection and response services, cybersecurity tabletops, and cybersecurity framework assessments. We also maintain cyber insurance coverage in an effort to reduce financial losses stemming from a security incident.

companyName: Federal Home Loan Bank of Des Moines

secItem: Item 1C


text: Risk Management, and Strategy recognizes the importance of identifying, assessing, and managing risks associated with cybersecurity threats. Rubicon's approach to risk management starts with assessing the likelihood and impact of a potential or known risk. Rubicon focuses on substantiating each identified risk by classifying its risk rating and residual risk, followed by categorizing the risk with two (2) additional criteria.

companyName: Rubicon Technologies, Inc.


text: Vendor risk management is an essential part of Stewart's Enterprise Governance Risk and Compliance (GRC) program. Critical vendors, which includes vendors that have access to personal information, are assessed and measured against standard security frameworks. Critical vendors are monitored for performance and compliance, and vendor security requirements are well defined and included with all master service agreements and contracts.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: We also utilize third-party service providers as a normal part of our business operations. We have established processes to support us in identifying and managing cybersecurity risks associated with the use of third parties, which include the completion of due diligence before engaging with a third-party, controls for response to mitigate any significant risks, and assessments and reviews throughout the relationship. Monitoring such risks and threats is integrated into our overall risk management program.

companyName: DEERE JOHN CAPITAL CORP


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Investment Advisor's Chief Operating Officer ("COO") and Chief Compliance Officer ("CCO") regarding the overall state of the Investment Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: Monitoring Cybersecurity Incidents The CISO implements and oversees processes for the monitoring of our information systems supported by a security operations center (SOC) and automated monitoring tools. We conduct continuous vulnerability scanning, incident simulations and proactive threat hunting. In the event of a cybersecurity incident, we have implemented an incident response plan, which includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Our cybersecurity specific risk assessment process, helps identify our cybersecurity threat risks by comparing our cybersecurity program to industry standards and best practices standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and the Center for Internet Security ("CIS"), as well as by annually engaging experts to attempt to infiltrate/test our information systems (as such term is defined in Item 106(a) of Regulation S-K).

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Our Information Security team, with support from our Legal Department, annually reviews our Cybersecurity Policy to ensure alignment with cybersecurity best practices.

companyName: EQT Corp

ticker: EQT


text: Risks from Cybersecurity Threats As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage, and transmission of confidential, sensitive, and other information within our computer systems and networks. Computer viruses, hackers, employee or vendor incidents, and other external hazards could expose our information systems—and those of our third parties who process our data, provide access to systems, or that have access to our systems—to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, reputation, results of operations and financial condition, and subject us to possible legal claims and liability. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations or financial condition.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company's Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company's key risk areas and risk-taking activities. The Board oversees management's performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company's Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management's senior operating committees, each responsible for a specified risk category. The Company's Information Security Risk Committee (ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board's Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.

companyName: US BANCORP \DE\

ticker: USB


text: Our cybersecurity policies, standards, processes, and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Catalyst Crew Technologies Corp.

ticker: CCTC


text: In an effort to deter and detect cyber threats, we regularly provide all employees with a data protection, cybersecurity, incident response, and prevention, training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: We have not engaged third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Our cybersecurity risk management policies and procedures are integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: The SPAC Board is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since the IPO.

companyName: INTEGRATED RAIL & RESOURCES ACQUISITION CORP


text: PPL has established an Executive Crisis Team comprised of PPL's executive leadership, including the Chief Executive Officer, Chief Technology and Innovation Officer, Chief Financial Officer, Chief Human Resources Officer, Chief Legal Officer, Chief Operating Officer, VP – Public Affairs and Sustainability, VP – Corporate Communications, Chief Security Officer and additional officers as circumstances may warrant, to allow the company to respond quickly to a crisis, including a cyber event. This team governs and manages corporate crisis preparedness across the business lines, operations, and functions. Material or potentially material risks are escalated to the Executive Crisis Team and other appropriate leadership for review and action.

companyName: PPL ELECTRIC UTILITIES CORP


text: Our Information Security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: We are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see "Item 1A. Risk Factors - Information technology failures and data security breaches, including as a result of cybersecurity attacks, could negatively impact our results of operations and financial condition, subject us to increased operating costs, and expose us to litigation".

companyName: DORIAN LPG LTD.

ticker: LPG


text: Our cybersecurity risk management program utilizes tools and processes designed to prevent, detect, and mitigate current and emerging cybersecurity threats, and we maintain procedures to address cybersecurity incidents. These tools and procedures include, but are not limited to, the use of external virtual chief information security officer (vCISO) services, annual cybersecurity risk assessments, and vulnerability scans and penetration tests. Our annual cybersecurity risk assessments are centered on three key components of cybersecurity risk management: (1) the identification of cybersecurity risks and threats; (2) the evaluation of the likelihood that these cybersecurity risks will manifest into cybersecurity threats and, should they manifest, the severity of their potential consequences; and (3) the establishment of policies and procedures intended to mitigate and contain the harm posed by cybersecurity threats.

companyName: Fusion Pharmaceuticals Inc.


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: we maintain cybersecurity threat operations with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response plans;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: We maintain incident response and recovery frameworks, tested twice yearly through simulations and tabletop exercises, to improve our preparedness to effectively manage and mitigate cybersecurity incidents.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Board Oversight and Governance WTW's board of directors has delegated the oversight of risks to the Audit and Risk Committee through its charter. The Audit and Risk Committee assists the board of directors in its oversight of the ERM framework, policies and practices used by WTW to identify, assess and manage key risks facing WTW, including financial and strategic risks as well as risks relating to matters of compliance and internal control, tax and pension, among other matters. The Operational Transformation Committee (the 'OT Committee') oversees risks arising out of WTW's operations related to cybersecurity and other risks. WTW's Chief Information Security Officer ('CISO') and Chief Information Officer ('CIO') report to the OT Committee on cybersecurity matters, including key risks. The OT Committee reports to the board of directors at each formal board meeting and the board of directors discusses those reports.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and portfolio investment information and the steps management is taking to monitor and control these risks. Our Chief Compliance Officer conducts regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues, and also delivers a comprehensive Annual Compliance Report to the Board, which report also addresses cybersecurity matters.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: The Board, primarily through the Audit Committee, provides oversight of our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular, quarterly presentations and reports from our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") on cybersecurity risks and management's mitigation activities, which address a wide range of topics including our cybersecurity risk profile, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and significant newly identified risks, technological trends, and information security considerations arising with respect to our industry peers and third parties. In addition, the CTO and CISO provide the Audit Committee with timely information regarding significant cybersecurity incidents, as applicable.

companyName: Travel & Leisure Co.

ticker: TNL


text: Cybersecurity Incident Management The CDR organization uses a variety of prevention and detection tools and other resources to identify potential cybersecurity incidents. When a cybersecurity incident is identified, CDR's incident response team engages with the appropriate subject matter experts, the relevant management of impacted organization(s) and others to analyze, contain, eradicate, mitigate and recover from the incident as applicable. When appropriate, during the incident response process, the CISO, CDR leadership and the Company's Chief Legal Officer may be informed and consulted and if deemed necessary, incidents may be escalated for review by the Senior Leader Crisis Team, which consists of cross-functional leaders of the Company. The Company maintains a process in which a subgroup of the Company's Disclosure Council would make a recommendation regarding the materiality of a cybersecurity incident to the full Disclosure Council and subsequently to the Audit Committee. Additionally, the CDR organization has frequent operating rhythms to, among other things, review cybersecurity incidents and track the progress of cybersecurity initiatives.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Management is aware that preventive measures cannot prevent all cyber incidents. The CATO has direct oversight over the Company's security programs on a daily basis. When a cyber incident occurs, NNN's actions are guided by an incident response plan decision tree to (i) detect, contain and eradicate any threats, (ii) assess materiality, (iii) notify internal parties and the Audit Committee Chairperson, (iv) recover any compromised NNN data and information systems, (v) limit impacts of any such incident on NNN's operations, and (vi) report any such incident as require by law or as otherwise necessary. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."

companyName: NNN REIT, INC.

ticker: NNN


text: Cybersecurity risk management is an integral part of overall enterprise risk management. As part of its enterprise risk management efforts, the Board of Directors meets with the executive leadership team to assess and respond to critical business risks. These assessments include a review of our cybersecurity programs, as well as an overview of trending cyber threats based on industry intelligence and potential mitigation strategies. Performing these assessments regularly enables the Company to determine key business objectives and the IT assets and capabilities needed to achieve them. In addition, the assessments also provide the executive leadership and the Board of Directors an understanding of the Company's security landscape and allows it to prepare to respond to threats. Cybersecurity threats continue to be identified as one of the Company's significant risks, with our Sr Director of Tech assigned as the risk owner. Our Sr Director of Tech has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data analytics and customer service through his twenty years of experience in the information technology space. He holds a Bachelor's degree from the University of North Carolina, Charlotte.

companyName: AIR T INC

ticker: AIRT


text: As part of our cybersecurity program, our IT management reports to the Company's Chief Operating Officer and Chief Executive Officer and is responsible for assessing and managing cybersecurity risks and developing and implementing our cybersecurity program. Our current Head of Global IT has more than 15 years of experience in technology and process improvements, which includes the execution of digital business strategies within highly regulated industries. Our IT management has obtained relevant experience in various sectors such as technology firms, financial institutions, and consulting firms and have actively engaged in continuous learning and professional development initiatives to stay updated on evolving cybersecurity threats and trends. This includes participating in industry conferences, workshops, training programs, and becoming members of professional cybersecurity organizations.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: 2. Executive Leadership Involvement: Senior management actively participate in setting cybersecurity objectives, allocating resources, and monitoring performance against established goals through the IT Steering Committee.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: On a quarterly basis, our Chief Information Officer reports to the Audit Committee on our Information Security program, including presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, security initiatives, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and vendors; recent cybersecurity-related developments; strategic activities; and the execution of our cybersecurity awareness training. In turn, the chair of the Audit Committee reports out to the full Board on a quarterly basis regarding these matters, among other matters addressed by the Audit Committee.

companyName: Burlington Stores, Inc.

ticker: BURL


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may utilize various vendor management processes that may include reviews of security assessments or certifications and contractual measures.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Risk assessment and management efforts. We assess, identify and manage cybersecurity risks as part of a comprehensive information security program that is intended to align with standard industry frameworks, such as International Standard for Organization (ISO) 27000 and the National Institute of Standards and Technology (NIST) Cyber Security Framework.

companyName: Angi Inc.

ticker: ANGI


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs our Chief Financial Officer, President, and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Compliance Committee and the full Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Although we may face a number of cybersecurity risks in connection with our business, we have not experienced any cybersecurity threats, incidents, or challenges that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Governance

companyName: Xenetic Biosciences, Inc.

ticker: XBIO


text: The Company has also engaged well-known and established technology suppliers to support its key technology processes and operating technical security management activities including threat, vulnerability, and network security management.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: schedule tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes, technologies and incident response plan; and carry cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident.

companyName: GLAUKOS Corp

ticker: GKOS


text: Management plays an important role in assessing and managing Getty Images' material risks from cybersecurity threats. The CTO is responsible for oversight of the design and implementation of the security program and strategy. Getty Images' current CTO has served in various roles in technology for over 25 years, and has had had oversight of information technology and information security for both Getty Images (7+ years) and other organizations.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our Information Technology department. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and internal communications.

companyName: Lite Strategy, Inc.

ticker: LITS


text: We recognize the need to maintain the security and confidentiality of personal information, protected health information and other confidential data that we may collect or use in connection with our business, and the importance of assessing, identifying and managing various cybersecurity risks that may impact our business. Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of hardware, software and technical applications and platforms developed or provided by our third-party service providers, and facilitates coordination across different departments of our company.

companyName: Acutus Medical, Inc.


text: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: As part of our cybersecurity risk management program, we undergo regular assessments and audits by external and independent auditors. These include assessments following the Health Information Trust Alliance (HITRUST) Common Security Framework. We also undergo independent System and Organization Controls 2 (SOC 2) Type 2 audits and assessments to validate compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirements. We carry a HITRUST certification and PCI certification. The results of these audits and assessments are reported to our Board of Directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary or appropriate based on the information provided by these assessments and audits.

companyName: Waystar Holding Corp.

ticker: WAY


text: Overseeing our cybersecurity efforts on a day-to-day basis is our cybersecurity team, led by our Chief Information Security Officer ("CISO"). Our cybersecurity team, in partnership with third parties, designs and implements our data security and cybersecurity programs, risk assessments, monitoring procedures, and training programs for our associates. We continue to make investments to enhance our ability to identify, protect from and detect security risks within our environment.

companyName: HOME DEPOT, INC.

ticker: HD


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 25 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities; our CIO, whose experience includes managing the technology professionals and processes at public and private financial services companies; and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.

companyName: BGC Group, Inc.

ticker: BGC


text: Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given the nature and size of our Company, we do not have a dedicated enterprise risk function, but our executives regularly consider and evaluate risks to our Company. As part of that risk management process, members of our executive team identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity, and raise them for discussion with other executives, and where it is determined to be appropriate, issues are also raised to the Board for consideration.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: Security Policy and Requirements The Company regularly conducts cybersecurity training for its employees along with ongoing tests such as simulated phishing exercises for its employees. The Company also has its third-party service provider regularly conduct penetration testing and vulnerability scanning.

companyName: Innovex International, Inc.

ticker: INVX


text: We have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Bridge Investment Group Holdings Inc.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, and engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management. The Company recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. We believe we have built a strong and collaborative risk management culture focused on awareness which supports appropriate understanding and management of our key risks. Each employee is accountable for identifying, monitoring and managing risk within their area of responsibility.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: We have established processes to evaluate and address cybersecurity risks on an ongoing basis. As part of our risk management program, we engage with external third parties to measure the effectiveness of our cybersecurity program through penetration tests, control assessments, tabletop exercises, and other related activities. Further, we have implemented a defense-in-depth strategy in which we utilize real-time 24/7 monitoring to identify anomalies, potential threats, and alerts. This cybersecurity strategy incorporates frameworks, policies, and practices designed to protect the privacy and security of our sensitive information, backed by a suite of security technologies and tools to implement and automate select security protections. We maintain cyber risk and related insurance policies as a measure of added protection.

companyName: Woodward, Inc.

ticker: WWD


text: As part of the above processes, we engage with assessors, consultants, auditors, and other third-parties to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: Inari Medical, Inc.


text: We regularly provide associates with information security awareness training, including the recognition and appropriate handling of potential phishing emails, which can introduce malware to a bank's network, result in the theft of user credentials and, ultimately, place customer information at risk. We regularly use phishing campaigns to train associates to determine their ability to recognize phishing emails. For associates who fail a phishing campaign, the associates are assigned additional training courses.

companyName: FIRST BANCSHARES INC /MS/


text: Our cross-functional Information Security Steering Committee ("ISSC") is the senior management team that oversees the direction, execution, and effectiveness of our cybersecurity program, policies and procedures including: cyber risks, mitigations, risk treatment plans, incident response plans, compliance with applicable regulations, and ensuring business-aligned cybersecurity objectives. The ISSC is chaired by our Chief Information Security Officer ("CISO") and consists of representatives from risk, compliance, internal audit, IT, accounting, finance, legal, and other key executives, including our Chief Information Officer ("CIO") and Chief Financial Officer. The ISSC meets quarterly to guide, direct, and monitor the performance and effectiveness of our cybersecurity program and elevates risks and mitigation plans, as appropriate, to the Board.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and Chief Policy Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.

companyName: FORD MOTOR CO

ticker: F


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "We, and our third-party service providers, are exposed to risks related to information technology infrastructure, information management and protection, cybersecurity threats, and cyber incident; if we or our third-party providers fail to protect confidential information and/or experience a cyber incident, there may be damage to our brand and reputation, material financial penalties, and legal liability." and "Our business is subject to evolving corporate governance and public disclosure regulations and expectations, including with respect to environmental, social and governance matters that could expose us to numerous risks." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K. For more than 5 years, we have not identified any known cybersecurity threats including as a result of any prior cybersecurity incidents, that have materially impacted us, including the expenses we have incurred from cybersecurity incidents that were immaterial. This includes penalties and settlements, of which there were none. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's cybersecurity risk management program controls, including management's assessment of recent cybersecurity incidents meeting certain criteria.

companyName: CoreCivic, Inc.

ticker: CXW


text: The CISO is responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations and third-party risk assessments; identifying and keeping abreast of developing security threats; as well as overseeing and implementing regular security awareness training of all employees on cybersecurity. For example, we adjust our policies, standards, and processes based on assessment results. In leading the cybersecurity risk management program, the CISO regularly works with other divisions of the company, including legal, compliance, IT, audit, and others to address potential risk from external threats, internal actions, and relationships with third-party service providers.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: In evaluating the risks posed by third parties, our cybersecurity program also includes a dedicated function for Third Party Risk Management, that oversees the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process personal information, intellectual property, or other sensitive information.

companyName: Anywhere Real Estate Group LLC


text: Our management team, including the Chief Executive Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, mitigate or remediate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident impacting our data at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from our Chief Compliance Officer, Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board and the Governing Body receive regular updates regarding the Audit Committee's activities.

companyName: Endeavor Group Holdings, Inc.


text: Our Vice President and Head of Information Technology and representatives from our management committee on cybersecurity provide annual briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: While we are not aware of any significant cybersecurity incidents that have occurred to date, we are exposed to, and may in future be adversely impacted by cyberattacks and interruptions to our information technology systems and infrastructure. Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, and/or result in the loss of trade secrets, proprietary information, or competitively sensitive data.

companyName: Third Harmonic Bio, Inc.


text: Management and Strategy we follow IoT cybersecurity standards and regulations, our products and information systems are potentially subject to cyber risks of data leakage and operational damages. To protect our products and information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, annual cyber testing, internal auditing, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. Any reported vulnerability is analyzed and reported to the CISO.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: We collect and maintain data and information necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business, including systems infrastructure operated and maintained by third-party service providers. In the ordinary course of business, we collect, store, and transmit confidential information, including intellectual property, proprietary business information and personal information. It is critical that we do so in a secure manner to maintain the privacy, security, confidentiality, and integrity of such confidential information.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical IT systems and information. Our program is integrated into, and cybersecurity risks are among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity organization continually evaluates and addresses cybersecurity risk in alignment with our business objectives to address the evolving regulatory landscape and emerging risks, including those resulting from geopolitical shifts and technological innovations such as the growth of cloud technologies and artificial intelligence. We maintain a formal cybersecurity training program, including annual trainings for all Kenvuers, covering, among other topics, phishing, email security, and data privacy. We employ automation, and we also engage our internal audit function and a range of external consultants and other expert third parties in connection with the evaluation and management of cybersecurity risk and the maturation of our cybersecurity program.

companyName: Kenvue Inc.

ticker: KVUE


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity."

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our Company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and the Board of material cybersecurity threats and incidents. We engage third-party security experts for risk assessment and system enhancements. The Company delivers annual security awareness training to employees, augmented by periodic role-specific modules and recurring phishing simulation exercises to measure user susceptibility and inform further training.

companyName: Worthington Steel, Inc.

ticker: WS


text: Internal and External Penetration Testing – we conduct regular Internal and External Penetration Testing to identify and assess network security vulnerabilities. Six Flags IT evaluates and remediates vulnerabilities based upon business impact and exploitability.

companyName: Six Flags Entertainment Corp/OLD


text: The audit committee of our board of directors has oversight responsibility for our data security practices and cybersecurity threats, periodically reviewing and discussing with management our policies, practices and risks related to information systems, information security, data privacy and cybersecurity. At least annually, the entire board of directors receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks, and information security considerations arising with respect to our peers and other third parties. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters such as enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.

companyName: Inari Medical, Inc.


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Stardust Power Inc.

ticker: SDST


text: Our Vice President of Finance & Corporate Controller is responsible on an interim basis for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Associate Director of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for approving budgets related to the foregoing.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: As of the date of this report, we have not identified any cybersecurity event or risks from cybersecurity threats that, individually or in the aggregate, would materially affect us. Notwithstanding, we, or third parties upon which we relay, may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us or our business strategy, results of operations or financial condition. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology, including, without limitation, the risk factor under the heading "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively"

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: Our chief information officer meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. In addition, the chief financial officer reviews with the audit committee at least annually our risk management program, which includes cybersecurity risks, and is also reported to the board.

companyName: AAON, INC.

ticker: AAON


text: We rely on the information technology and systems maintained by our managers, including RMR, and rely on our managers to identify and manage material risks from cybersecurity threats. RMR and our hotel managers take various actions and incur significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: Service Properties Trust

ticker: SVC


text: We have implemented a cybersecurity program consistent with industry practices to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our networks, systems, and data.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Prepare complete documentation of the incident, investigate the incident further, understand what was done to contain it, and determine whether anything in the incident response process could be improved.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: of Third-Party Service Providers have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity have relied on the third-party security assessment procedures and data outflow control procedures to manage risks from cybersecurity threats associated with our use of third-party service providers. For example, the servers of the system of Hunan Ruixi are housed at third-party data centers, and its operations depend on the service providers' ability to protect such systems in their facilities as well as their own systems. The qualified third-party performs security assessment by timely assessing their cybersecurity policies, data encryption and privacy policies and relevant certificates, establishing procedures in granting such third parties access to our database and requiring them to conduct regular inspections. Since in cooperation with third-party service providers may involve data outbound, we desensitize sensitive information before transferring such data.

companyName: Senmiao Technology Ltd

ticker: AIHS


text: Our day-to-day operations are managed by our management team under the oversight of our Board. As such, we rely on it's cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats. With oversight from our Board, our management team has implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats to our systems, some of which are supported by third parties. These processes are integrated into our overall risk management systems. To protect our systems from cybersecurity threats, the management team uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. Our risk management processes extend into the oversight and identification of threats associated with our use of third-party service providers, including through due diligence of such providers' cybersecurity practices, contractual obligations to operate their IT systems in accordance with cybersecurity standards and ongoing monitoring.

companyName: Hi-Great Group Holding Co

ticker: HIGR


text: Our cybersecurity programs are under the direction of our Vice President and Chief Information Officer ("CIO") who receives regular reports from our Director of Cybersecurity. The Director of Cybersecurity, oversees our dedicated cybersecurity team comprised of 2 Senior Security Engineers and 2 Security Analysts and is augmented by a 24x7 managed security services who actively manage and execute our efforts to prevent, detect, mitigate and remediate cybersecurity incidents. The Director of Cybersecurity has over 15 years of experience in cybersecurity, with demonstrated expertise in incident response, threat detection, vulnerability management, and third-party risk assessments. He holds advanced degrees in IT Project Management and Network Security and maintains industry certifications including CISSP (Certified Information Systems Security Professional) and GCIH (GIAC Certified Incident Handler). The two Senior Security Engineers have 16 and 10 years of experience, respectively. Their areas of specialization include network security architecture, endpoint protection technologies, and operational technology (OT) security integration. Both hold advanced certifications such as CISSP, GRID (GIAC Response and Industrial Defense), and GCIP (GIAC Critical Infrastructure Protection). The two Security Analysts bring 3 and 4 years of experience, respectively. Each holds a bachelor's degree in Computer Science and maintain industry certifications including CompTIA Security+ (SEC+). Their responsibilities include real-time security monitoring, phishing simulation campaigns, and user awareness support. Collectively, the cybersecurity team brings 48 years of combined experience and is actively engaged in ongoing professional development to remain current with emerging cyber threats, technologies, and regulatory requirements.


text: JetBlue management has an overall responsibility for assessing and managing risks from cybersecurity threats to the Company and has an established cyber risk committee that consists of the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Chief Information Security Officer. (CISO). Our CISO has primary responsibility for the design and execution of our cybersecurity risk management program, and helps the committee stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, including but not limited to briefings with internal security team members, threat intelligence obtained from public and private sources, and alerts and reports produced by security tools deployed in the IT environment. Our current CISO has nearly two decades of experience in IT risk and program management, threat intelligence, and cybersecurity governance; he also has several cybersecurity industry certifications and specialized training in cybersecurity.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with third-party forensic vendor(s) available for incident response and investigation. Additionally, we maintain cybersecurity insurance.

companyName: TransDigm Group INC

ticker: TDG


text: As detailed elsewhere herein, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: Our risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of advanced cybersecurity technologies. These measures are designed to help protect Mullen's proprietary systems and customer data from both internal and external cybersecurity threats. From time to time, Mullen has engaged third parties, on an as needed basis, to perform various cybersecurity services and risk assessments. Additionally, we maintain third-party tools to monitor for vulnerabilities.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: Reporting to Board of Directors As discussed above in "Cybersecurity Board of Directors Oversight of Risks," our InfoSec Director regularly updates our eRISC committee regarding all aspects related to cybersecurity risks and incidents and also maintains direct communication with the CEO, CFO, CTO, and GC for escalation of such incidents directly to the Board. This ensures that the highest levels of management and the Board are kept informed of the cybersecurity posture and potential risks facing Prosper.

companyName: PROSPER MARKETPLACE, INC


text: The Board of Directors oversees the Company's risk management program, including the management of cybersecurity threats. The Board of Directors receives regular reports from the CTSO on cybersecurity threats and the Company's strategy to manage the risks associated with such threats. The TIS Committee provides Management oversight of the Company's cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to our clients and investments (Information Systems and Data).

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Within the Enterprise Risk Management Framework, we have established committees, both at the management and board level, to oversee risk, and ensure cybersecurity risk is escalated appropriately to the Board.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective knowledge, tools, and awareness to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. The personnel training occurs at the time of hiring and at least once annually thereafter. The Cybersecurity Committee, along with other members of executive management, practices the incident response process through an annual tabletop exercise facilitated by external consultants.

companyName: MARCUS CORP

ticker: MCS


text: Our Audit Committee, composed of two independent Board of Director members, has oversight responsibility for the Company's cyber-security risk. The internal members of management that oversee cybersecurity is the Chief Financial Officer, ("CFO") and the Director of Franchise Operations/Staff Attorney, ("DFO"). The CFO reports to the Audit Committee prior to each quarterly and annual 10-Q and 10-K filing, respectively, on any current cyber changes, procedures and any identified risks. The CFO provides the Audit Committee any cyber insurance information and will obtain approval for any changes in cyber insurance coverage. The CFO will also provide the Audit Committee any information on any possible third-party information technology, ("IT") service and consultant changes. The Audit Committee will review and approve any change in IT service providers. The Audit Committee will be immediately notified of any cyber security threats or incidents.

companyName: BAB, INC.

ticker: BABB


text: Ball faces risks from cybersecurity threats that could have a material adverse effect on the company, including its business strategy, results of operations, financial condition and reputation. Ball experiences cyber threats in the normal course of its business; however, prior cybersecurity incidents have not materially affected the company. Refer to Item 1A, Risk Factors – Technological Risks, for additional details on cybersecurity risks that could potentially materially affect the company, including its business strategy, results of operations, financial condition and reputation.

companyName: BALL Corp

ticker: BALL


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: We maintain a cybersecurity policy, reviewed with our audit committee, which is designed to address cybersecurity risks to the Company (including by escalating certain cybersecurity incidents to members of management and the board of the audit committee, in each case depending on the circumstances). We also maintain incident response procedures designed to assist the Company in responding to cybersecurity incidents.

companyName: Annexon, Inc.

ticker: ANNX


text: Although we have not, as of the date of this Report on Form 10-K, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future.

companyName: Nexalin Technology, Inc.

ticker: NXL


text: Our systems are reasonably designed to enable the information technology infrastructure group to capture application, system and network alerts. In the event of a cybersecurity incident, the Cyber Incident Response Team (the "CIRT"), led by a designated Cyber Incident Coordinator (the "CIC"), is responsible for collecting and analyzing relevant data about the incident and its risks. Members of the CIRT, including the CIC, are selected based on their knowledge of either cybersecurity or the specific information systems or business function affected by the incident.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: At the management level, our cybersecurity program is managed by our Director of IT, who reports to our Chief Operating Officer. Our Director of IT has over 12 years of IT security experience in regulated industries such as government, energy, and biopharma. He has over 20 years of combined IT experience.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: Under the leadership of the Company's Chief Technology Officer, the Company's information technology department is primarily responsible for assessing and managing material risks to the Company's information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the Company's information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the Company's information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.

companyName: SITE Centers Corp.

ticker: SITC


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.

companyName: NL INDUSTRIES INC

ticker: NL


text: Regular assessments are conducted to identify potential cybersecurity risks across our organization, ensuring a comprehensive understanding of our risk exposure. To support our capabilities, we engage assessors, consultants, auditors, and other third parties with specialized expertise in cybersecurity. Their assessments cover various aspects of our infrastructure, including penetration testing, vulnerability assessments, and compliance audits, enabling us to strengthen our defenses against current and emerging threats.

companyName: Altus Power, Inc.


text: Our Information Security Department and Security Management functions, led by our Chief Information Officer ("CIO") and supported by our Director of Information Security and Compliance, (collectively, "Security Team"), help identify, assess and manage the Company's cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry's risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: While we have experienced cybersecurity incidents in the past, to date we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and continue to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. As discussed more fully under Item 1A – "Risk Factors", however, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. No matter how well designed or implemented our cybersecurity controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventative measures against cybersecurity breaches in a timely manner.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example maintaining an incident response policy and incident detection and response procedures, disaster recovery and business continuity plans and an IT contingency policy, encrypting certain data, conducting risk assessments for certain data and systems, implementing certain network security, physical and access controls, monitoring our systems, providing periodic training to employees and using tools such as penetration testing tools.

companyName: Y-mAbs Therapeutics, Inc.


text: Our CISO and information security team actively monitor and evaluate our networks, systems, data, and security risk profile to identify and assess cybersecurity risks. The information security team uses a variety of methods to identify and assess these risks, including, conducting networks scans, using manual and automated tools, conducting vulnerability and maturity assessments, and subscribing to services and reports providing threat intelligence.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Security Awareness Training All Pathward employees play a crucial role in cybersecurity defense. Pathward has implemented a security awareness training program that includes annual mandatory training for employees and contractors as well as ongoing phishing resiliency testing. The security awareness program also includes periodic videos and educational articles that are shared with employees through a partnership with corporate communications.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: Our cybersecurity program draws from the recognized framework established by the National Institute of Standards and Technology and focuses on five key pillars of threat mitigation, which consist of identification, protection, detection, response, and recovery. We deploy various tools to address these areas, including robust password requirements, firewalls, limiting access to sensitive information, multi-factor authentication requirements, and anti-malware, intrusion prevention and detection systems. We periodically review and update Davey's policies, standards, processes, and procedures regarding cybersecurity threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, and performing vulnerability and security testing. Recognizing the complexity and evolving nature of cyberattacks, we also engage with a range of third-party experts to help identify and manage cybersecurity risk, including monitoring and evaluating traffic on our network, assisting with penetration testing and tabletop exercises, and consulting on best practices.

companyName: DAVEY TREE EXPERT CO


text: The Audit Committee receives updates at least annually from the Chief Information Security Officer (CISO) on the design and progress of key information security initiatives in addition to regular briefings on cybersecurity and management of cybersecurity-related risks from relevant members of management, including the Head of ERM and our CISO. Recent updates from the CISO have focused on the Company's information security strategy, ongoing security assessments and ongoing projects. The Audit Committee is responsible for updating the Board on identified risks related to cybersecurity.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: We have not had any previous cybersecurity incidents, and we have not, at this time, identified or evaluated any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Legacy Education Alliance, Inc.

ticker: LEAI


text: Our CIO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CIO and CISO have served in their positions since joining the Company in June, 2022 and January, 2022, respectively. Our CIO, who reports directly to the Chief Operating Officer, has 30 years of experience in various technology and security leadership positions across multiple industries including banking, insurance services, utilities, technology service providers, and as a member of the US Air Force. Prior to joining us, our CIO served as a CIO for multiple banks leading both technology and cybersecurity. Our CISO, reporting directly to the CIO, has over 35 years of experience in various technology and security leadership positions across multiple industries including banking, healthcare, automotive, mining, education, engineering, construction, and dairy product production.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: We rely extensively and increasingly on information technologies and infrastructure to manage our business (including the digital storage of marketing strategies and client information), develop new business opportunities and digital products, and process business transactions. Digital services and products, advertising and marketing technology, e commerce services, data management and analytics and digital brand experience constitute a key part of our client offerings. Our business operations therefore depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Our Cybersecurity Program also includes a periodic risk assessment, which is based generally on frameworks established by the National Institute of Standards and Technology (NIST).

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Roper deploys cybersecurity practices and tools across all of its businesses designed to protect data, maintain resilient operations, and limit the impact of cybercrime. We deploy a Managed Detection and Response solution across all of our business units and our Corporate infrastructure designed to address the detection, response, and remediation effectiveness for cybersecurity threats. This solution is intended to provide real-time visibility of the endpoint footprint across the enterprise, including patch management and vulnerabilities, device encryption, and cybersecurity threats and detections. Additionally, this solution is designed to provide real-time monitoring of identity-based attacks, as well as monitoring of the deep, dark and social webs for cybersecurity threats targeting Roper's businesses.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: The Audit Committee has ultimate oversight of cybersecurity risks and our cybersecurity risk management program. Management provides cybersecurity program briefings to the Audit Committee on at least an annual basis, and more frequently if circumstances warrant. These briefings include assessments of cyber risks, the threat landscape, updates on any incidents, and reports on our investments in cybersecurity risk mitigation and governance. Management utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework as a guideline to manage our cybersecurity risks and inform the Audit Committee on the overall progress of our information security program.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: Role of Management Company management has established a Cybersecurity Governance Committee that is comprised of the Information Technology Manager and senior members of management. The Committee meets periodically to discuss cybersecurity program updates and challenges, watch for potential threats from both external and internal sources, monitor compliance in existing or emerging business practices, and respond to stakeholder inquiries. The Information Technology department is comprised of professionals with extensive expertise and led by its manager with over 20 years of experience in various aspects including cybersecurity. The manager is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: The Company's cybersecurity program focuses primarily on securing and safeguarding computer systems, networks, cloud services, business applications, and data and is integrated in the Company's overall risk management strategy and framework. The Company has implemented cyber defense capabilities and protocols to protect against cyber threats and ensure the containment and security of sensitive business data, including ongoing security reviews of critical systems, continuous monitoring of event data, and employee training programs, which processes are aligned with the Company's overall business and operational goals and strategies. The Company also actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.

companyName: Penumbra Inc

ticker: PEN


text: Our information security function, supported by members of our IT and Legal departments and our third-party IT service providers, helps identify, assess and manage the Company's cybersecurity threats and risks. This team helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats and analyzing such reports of threats and actors, conducting scans of our threat environment, evaluating threats reported to us, coordinating with law enforcement as appropriate about certain threats, having third parties conduct threat assessments, conducting vulnerability assessments, and working with third parties to conduct certain tests of our environment.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: individuals, including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our management team have prior work experience in supervising and implementing cybersecurity risk mitigation efforts. Our internal cybersecurity personnel and retained external cybersecurity consultants also have a breadth of expertise across core cybersecurity disciplines including governance, risk, compliance, and security architecture.

companyName: TAITRON COMPONENTS INC

ticker: TAIT


text: Risk Management Strategy We have implemented and maintain various information security processes. These processes are designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, strategic or competitive in nature, and proprietary or confidential information, including clinical trial data, personal and financial information, referred to collectively as Information Systems and Data.

companyName: NGM BIOPHARMACEUTICALS INC


text: Our information technology providers regularly inform the COO and CFO about matters related to cybersecurity risks and incidents. Together, our COO and CFO then update our Board on significant cybersecurity matters, and strategic risk management.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: Our board of directors receives at least annual reports from our Sponsor's CISO and other members of our Advisor's management on our information security program including top cybersecurity risks, cybersecurity strategy, information system controls and related security measures and improvements, cyber incident response plan, cyber incidents and cyber defense metrics, and cyber security protocols and trainings.

companyName: JLL Income Property Trust, Inc.


text: Our cybersecurity risk management program includes a number of components, including but not limited to a Cybersecurity Incident Response Plan ("CSIRP"), annual cybersecurity awareness training for our employees, security assessments, vendor risk management, regular system maintenance including application of security patches as appropriate, regular penetration testing and implementation of enhancements to security measures used to protect our systems and data. We employ third parties, including assessors, consultants and auditors, in our cyber risk management program as appropriate, e.g., training, assessment, auditing, benchmarking, and penetration testing.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: In the event of a suspected incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the CIO and functional areas (e.g. legal) as appropriate. The CIO will make any required communications to the Chief Executive Officer (CEO) and other senior leadership, with the CIO making any required communications to the Board and Audit Committee. Our CEO, Chief Financial Officer, General Counsel and CIO are responsible for assessing such incidents for materiality, ensuring that any required notification, disclosure or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. The Treasurer has primary oversight of material risks from cybersecurity threats and works primarily with third parties to identify, assess, and manage cybersecurity risks. The Treasurer meets with the Audit Committee periodically to review the Company's information technology systems and discuss key cybersecurity risks.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: Management of the Company is responsible for overseeing our enterprise risk management. In that regard, management receives periodic updates, as appropriate (and no less frequently than annually), regarding the Company's cybersecurity risk management processes and the risk trends related to cybersecurity. Our Board of Directors, in coordination with the Audit Committee, shall review and discuss with management the Company's risks related to information security, including cybersecurity.

companyName: Legacy Education Inc.

ticker: LGCY


text: The Company employs a multi-faceted cybersecurity risk management framework, which is integrated into its enterprise risk management system. The Company aligns its security policies and practices with the ISO 27001 framework and manages its cybersecurity risks through a dedicated information security team, reporting to the Head of Information Security. The information security team is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. The Company's cybersecurity risk management includes, but is not limited to, the following elements.

companyName: IMAX CORP

ticker: IMAX


text: As necessary, but not less than once per year, the Senior Director of Information Technology makes a presentation on cyber threats and the Company's efforts to mitigate them to the Company's Chief Executive Officer, Chief Financial Officer, and the Audit Committee. In addition, the results of annual internal audits of the effectiveness of internal control over financial reporting, including relevant information systems, are reviewed by the Audit Committee.

companyName: SURMODICS INC

ticker: SRDX


text: Our board of directors is responsible for overseeing our strategy and risk management process and discharges its duties both as a full board and through its committees. As reflected in the audit committee charter, our board has delegated to the audit committee oversight of our risk assessment and management process, including processes related to cybersecurity. The audit committee meets at least annually with management, our internal auditor and our contracted Chief Technology Officer to discuss our cybersecurity program in regards to potential significant financial or operational risk exposures and the measures implemented to monitor and address those risks, including those that may result from cybersecurity threats. As necessary or appropriate, these discussions may include our risk assessment and risk management policies. In addition to our multidisciplinary management team, we rely on our internal audit function in collaboration with a third-party information security service provider to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance. We have a longstanding relationship with our third-party information security service provider, which includes services from our contracted Chief Technology Officer. The contracted Chief Technology Officer has approximately 15 years of information technology experience, including nine years in the finance and real estate sectors, and our Head of Internal Audit, has approximately 30 years of audit experience, including 20 years in the real estate and financial services sectors.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: To implement risk management and protective strategies, management implements a "Layered Security Strategy" that aligns with National Institute of Standards and Technology Cybersecurity Framework. We consider the various factors that can play a role in the occurrence of a cybersecurity incident, such as: Unauthorized system access User errors Undetected system vulnerabilities Mobile device risks Vulnerabilities in software applications and specific hardware Third party cybersecurity risks Insider threats

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors and Audit Committee has responsibility for the oversight of risk management, including risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Members of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: CapForce Inc.

ticker: OPGN


text: As of June 30, 2025, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: The audit committee receives periodic reports from Data Management, Analytics and Integration and General Counsel concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk identification will be managed through Information Technology ("IT") programs and service providers that specialize in identifying such risks, employee training, and information security policies. The cybersecurity team will conduct internal and external penetration testing with outside third-party cybersecurity experts. Employee training programs will be used to reinforce our information security policies, standards and practices, as well as the expectation that employees comply with these policies and to train employees on how to identify potential cybersecurity risks and protect our resources and information.

companyName: Revelyst, Inc.


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023 and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.

companyName: Bancorp 34, Inc.

ticker: BCTF