text: As of the date of this annual report, we are not aware of any cybersecurity incidents that have had, or are reasonably likely to have, a materially adverse effect on our operations, business, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—Security breaches or cybersecurity attacks may have a material adverse effect on Janel's ability to operate, could result in personal information being misappropriated and may cause Janel to be held liable or suffer harm to its reputation" and "—Our inability to successfully recover should we experience a catastrophic event, disaster or other business continuity problem could cause material financial loss, loss of human capital, regulatory actions, reputational harm or legal liability."

companyName: JANEL CORP

ticker: JANL


text: Federated Hermes' CISO has 20 years of technology experience, including deep experience in cybersecurity risk management. Prior to assuming his current role in 2020, Federated Hermes' CISO served as information security officer and director of technology for a large publicly traded travel center company and, prior to that, as information security officer for a leading retail chain. He holds a BS in Accounting and Finance and an MBA from Robert Morris University.

companyName: FEDERATED HERMES, INC.

ticker: FHI

secItem: Item 1C


text: Depending on the environment, we implement and maintain technical, physical, and organizational measures, processes, standards, practices, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures, processes, standards, practices, and policies address, for example: incident detection and response, risk assessments, security certifications, encryption, network security controls, data segregation, access controls, physical security, asset management (such as tracking and disposal), systems monitoring, employee cybersecurity awareness training, and systems monitoring. We also have cybersecurity insurance.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Cybersecurity Incident Response Infinera has implemented a cybersecurity incident response plan in line with industry standards. The plan defines roles and responsibilities regarding potential cybersecurity incidents, establishes processes regarding identification, containment, and eradication of, and recovery from, potential cybersecurity incidents and clarifies communication and notification policies regarding such potential cybersecurity incidents. The plan also captures lessons learned to drive continuous improvement. The plan is evaluated, tested, and enhanced through training, table-top exercises, and by engaging with third-party service providers.

companyName: Infinera Corp


text: Management considers cybersecurity risk as part of its overall risk oversight function and reviews policies and procedures relative to both the systems and facility to ensure all requirements are within the Company's purview to meet, and that appropriate resources have been dedicated or otherwise made available to accomplish, these requirements. Our management team, including our CISO and ISSO, are responsible for day-to-day implementation, assessment, and management our cybersecurity risk assessment and management processes. The CISO and ISO have primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders. Our CISO and ISO supervise both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CISO and ISSO have served in various roles in information technology and information security for over 25 years each.

companyName: Cycurion, Inc.

ticker: CYCU


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. Refer to the risk factor captioned An information security incident, including a cybersecurity breach, could have a negative impact to the Company's business or reputation in Part I, Item 1A. Risk factors for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: Assessing, identifying, and managing cybersecurity related risks are integrated into the Company-wide ERM process. On an annual basis, management assesses the top risks facing the enterprise through the Company's ERM process. Cybersecurity related risks are included in this annual function and to the extent the ERM process assigns a heightened risk to cybersecurity, risk owners are named to address the severity, likelihood, and controls in place to mitigate these risks. Upon the conclusion of the ERM process, management's assessment is then presented to the Board of Directors.

companyName: Andersons, Inc.

ticker: ANDE


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee regularly reports on its activities and findings with respect to risks from cybersecurity threats to the full Board of Directors.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: We recognize the critical importance of maintaining the trust and confidence of investors, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO"). In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TMC the metals Co Inc.

ticker: TMC


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and Operating Committee are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management Operating Committee, including the Chief Information Officer, Chief Financial Officer, Chief Accounting Officer, and General Counsel will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.

companyName: FMC CORP

ticker: FMC


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of our board of directors (Audit Committee). Our Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors, including the Audit Committee. The Company has strengthened its IT team with the hiring of an additional IT Manager.

companyName: BOXABL Inc.


text: The Board of Directors directly, and through its standing committees (particularly the Risk Committee and the Audit Committee of the Board of Directors) also engage in broader discussions regarding existing and emerging operational and technology risks with members of management across all lines of defense. To supplement the Board of Directors' regular engagement regarding the Company's information security program, the director education program includes cybersecurity-related training opportunities, which assists the directors in staying current on developments and maintaining appropriate knowledge regarding the evolving cybersecurity and threat landscape.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the risk factor titled, "Our business and operations may suffer in the event of information technology system failures, cyber attacks, or deficiencies in our cybersecurity." for additional information.

companyName: Ceribell, Inc.

ticker: CBLL


text: The Board of Directors is composed of members with diverse expertise including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.

companyName: Energy Services of America CORP

ticker: ESOA


text: Board of Directors' Oversight and Management's Role Our Board of Directors has delegated the responsibility for the oversight of risks from cybersecurity threats and our cybersecurity practices to the Audit Committee. Our Board of Directors and our Audit Committee receive regular updates on potential cybersecurity risks and mitigation strategies from the Company's Chief Technology Officer ("CTO").

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: In 2023, we did not identify risks from cybersecurity threats that have materially affected or are currently reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See Part I, Item 1A "Risk Factors—Risks Related to Our Cybersecurity and Technology" for more information.

companyName: R1 RCM Inc. /DE


text: Due to the utilization of technology, Atlanta Braves Holdings is subject to material risks from cybersecurity threats. Accordingly, we have committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: The ISO has been established by the Service Center's Chief Information Officer, with dedicated cyber security staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering and management of cyber security policies, standards and regulatory compliance. Like many organizations, we align to a Cyber Security Framework and take a risk-based approach during control assessment and implementation. We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls is comprised of five categories of defense – Identify, Protect, Detect, Respond and Recover. We are committed to the protection of our data, systems, network and continually invest in enhancements to mitigate or reduce the impact from a cyber security threat. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Profusa, Inc.

ticker: PFSA


text: We maintain a centralized incident response process with a forensic partner on retainer. In addition, we have cybersecurity insurance policies in place. Roper maintains a Cybersecurity Incident Response Plan ("CSIRP"), which requires each Roper business to designate a Cybersecurity Incident Response Team ("CSIRT") that is responsible for receiving, reviewing, and responding to cybersecurity incident reports and activities. Cybersecurity incidents are required to be promptly reported to Roper, and such incidents and their resolution are then closely monitored by Roper's cybersecurity team. We work on security awareness with our employees throughout the year with cybersecurity training and simulated phishing campaigns to better identify and report unusual behavior and to mitigate the likelihood and impact of possible incidents.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: We continuously monitor the cybersecurity landscape and identify active and potential threats through a combination of tools and processes. Our Global Information Security ("GIS") team has day-to-day responsibility for Spirit's cybersecurity program. This group is led by a Chief Information Security Officer ("CISO") with more than twenty years of audit and cybersecurity experience. The CISO collaborates across the business, participates in internal audits, and is active in several leading industry groups to help benchmark our efforts with third parties. GIS receives and analyzes information from various resources to inform our cybersecurity program needs. An Enterprise Security Council comprised of GIS, Information Technology, Legal, Compliance, Internal Audit, and Enterprise Risk Management meets regularly to discuss emerging cyber risks and corresponding mitigations as part of our overall Enterprise Risk Management program. Significant risks are escalated to the Enterprise Risk Council which is chaired by our President and CEO, who was the Deputy Secretary of Defense during the development of the 2018 Department of Defense Cyber Strategy. We implement appropriate controls to protect our information or information we have control of on our systems, and our operations. We evaluate our controls and systems against industry-recognized standards, and contractual requirements, as applicable.

companyName: Spirit AeroSystems Holdings, Inc.


text: We also require key third-party service provider with access to our IT environment to certify on a contract-by-contract basis that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Complementing this arsenal is the deployment of an EDR (Endpoint Detection and Response) agent, a cutting-edge technology that places us at the forefront of cybersecurity innovation. This agent is not merely a passive observer; it is our vigilant sentinel, constantly scanning and analyzing our network for any aberrations or patterns indicative of cyber threats. Through real-time monitoring, it provides us with invaluable insights into our system's health, promptly flagging any deviations from the norm.

companyName: BeyondSpring Inc.

ticker: BYSI


text: Our Information Security team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including receiving regular briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: The Trust has no directors or executive officers. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"). As further described in its 2023 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: The Company's entire workforce receives mandatory cybersecurity training that includes quarterly social engineering exercises and informative online courses assigned based on assessed skill gaps. The Company also provides cyber risk awareness guidance to customers and promotes customer cyber hygiene through periodic communications. The Company conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world cybersecurity incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of the Company's incident response and management programs and provide the basis for continuous improvement.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: As part of the Company's enterprise risk management, we maintain a cyber risk program with established policies and procedures to detect, prevent, mitigate, and remediate cybersecurity incidents and related risks. The program is led by our Chief Information Security Officer ("CISO"), who has 30 years of experience in information security and is a Certified Information Systems Security Professional. Our CISO reports directly to our Chief Information Officer of Corporate IT, who has over 25 years of experience in all areas of information technology. Our cybersecurity team is comprised of experienced, educated, and certified professionals with decades of experience in cybersecurity leadership roles.

companyName: NOV Inc.

ticker: NOV


text: Spire's Board of Directors ("Board") recognizes the significance of cybersecurity risk and has therefore retained oversight of cybersecurity rather than delegating this risk to a committee of the Board. Every regular meeting of the Board includes a cybersecurity report provided by the Company's Chief Information Officer and the Managing Director of Information Security. These reports focus on developments within the Company's cybersecurity program and provide an update on any cybersecurity events or concerns. The Board recently added a new director with expertise in cybersecurity to assist the Board to appropriately oversee the Company's efforts.

companyName: SPIRE INC

ticker: SR


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: The Sub-Advisor's cybersecurity program provides a structured approach which serves to promote practices, procedures, and methodologies that seek to appropriately mitigate information security risks on behalf of its investment vehicles and its underlying investors. At all times, the Sub-Advisor seeks to proactively identify potential risks to its business and develop policies and procedures to minimize such risks. The Sub-Advisor has implemented data security policies, which include provisions to limit access to sensitive data only to those who require it; to follow a policy of least privilege; and an authorization process for those who otherwise request access to data. The Sub-Advisor has also implemented backup and recovery procedures, with backup occurring on a nightly basis and disaster recovery tests conducted on an annual basis. The Sub-Advisor's internal systems are protected by security measures, including hardening policies, firewalls, and disaster recovery tests. In addition, the Sub-Advisor makes use of encryption standards on its systems and requires multifactor authentication for remote access. The Sub-Advisor ensures company-related data is compartmentalized on its employees' personal mobile devices and ensures that its employees are trained on and subject to appropriate confidentiality obligations. The Sub-Advisor performs security risk assessments on a monthly basis and additionally conducts internal and external penetration tests on an annual basis.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: BKV employs a comprehensive cybersecurity strategy to protect against threats that could compromise sensitive information, disrupt data or systems, or jeopardize the security of facilities and infrastructure, including third-party processing plants and pipelines.

companyName: BKV Corp

ticker: BKV


text: We have developed an Information Security Program which is designed to, among other things, protect the confidentiality of our data, protect against threats or hazards to our IT systems, safeguard our data resources in a manner consistent with applicable laws and regulations, contractual obligations and industry standards, and maintain our IT systems to meet our operational needs. The Information Security Program is part of our risk management program, which is overseen by our Audit Committee (and our Board of Directors more generally), receives updates from our Chief Technology Officer on cybersecurity risks and related matters on a quarterly basis and as otherwise as may be needed.

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: Our cybersecurity program employs industry-standard methodologies to manage cybersecurity risks, including secure network infrastructure design, continuous security updates, and automated alerts for suspicious activities. We also conduct regular training for employees at all levels on cybersecurity awareness and the protection of confidential information.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: In 2020, Tronox established an IT Security Council to help set corporate risk tolerance and related policy. The council meets quarterly, is chaired by the General Counsel and managed by our Vice President, Cyber Security with senior level representation from key functions and business units. On an annual basis, the Tronox Cybersecurity team reviews and updates the core governance documents, including the Acceptable Use Policy, the Information Security Policy, and the Incident Response Plan. These are then subject to review and approval by the Tronox Security Council with a summary provided to the Audit Committee as a component of the annual cybersecurity Enterprise Risk Management.

companyName: Tronox Holdings plc

ticker: TROX


text: The Company's risk management program is designed to identify, assess, and mitigate risks across various areas and functions, including financial, operational, technological, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. The Company's Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Strategic Technology Committee of the Bank's board of directors.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Park's Audit Committee oversees its cybersecurity risk assessment, risk management and risk mitigation policies and programs. Park's Enterprise Risk Management ("ERM") Committee reports to the Audit Committee and is responsible for identifying Park's cybersecurity risks. Park also has a dedicated Risk Management team that reports to the ERM Committee, which includes representatives from several departments, external consultants and insurance professionals who interface with brand and management partners to assist with risk mitigation at our properties. Additionally, we have engaged third-party service providers to assist with risk mitigation activities, implementing security monitoring capabilities designed to alert us to suspicious activity, and developing an incident response program that is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident. Our cybersecurity incident response plan requires prompt notification of senior management in the event of a cybersecurity incident that has affected or is expected to affect the Company and prompt briefings on subsequent developments as appropriate. We have undertaken table-top risk exercises and employees participate in mandatory annual trainings and receive communications regarding the cybersecurity environment to increase awareness throughout the Company. The Company's cybersecurity program is informed by industry-recognized security frameworks such as the U.S. National Institute of Standards and Technology Cybersecurity Framework. We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: Theriva has not, to date, been subject to any cybersecurity incidents resulting in a material adverse effect on the Company; however, future cyber incidents may occur and the Company has implemented processes to manage, mitigate, and respond to cybersecurity threats. We maintain policies and controls over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our information technology ("IT") assets, data, and services from threats and vulnerabilities. We partner with third-party IT providers leveraging third-party technology and expertise. These partners, including consultants and other third-party service providers, are a key part of Theriva's cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, and cyber risk advisory, assessment and remediation.

companyName: Theriva Biologics, Inc.

ticker: TOVX


text: The Risk Committee of the Board of Directors is responsible for the oversight of risks from cybersecurity threats. As described below, where appropriate, strategic risk management decisions are escalated to the Risk Committee, and the Risk Committee receives periodic reports on cybersecurity matters from management.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Our cybersecurity program assesses our cybersecurity risk profile through inventories of physical devices, software, and information systems, evaluations of critical third-party systems, and a catalog of security risks. Periodic assessments are conducted to ensure the risk catalog is up to date.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Cybersecurity education is a priority for our employees and business partners. Employees complete cybersecurity training to help identify and respond to potential cybersecurity risks and reinforce safe behaviors. We also impose security requirements upon our third-party services and software providers, including: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident; however, we rely on such third parties to implement security programs commensurate with their risk, and their efforts may not be successful.

companyName: AVIENT CORP

ticker: AVNT


text: Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, any incident will be reported to our Board of Directors who will then formulate a plan for mitigation, recovery, and notification. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: Silo Pharma, Inc.

ticker: SILO


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; OPENDOOR TECHNOLOGIES INC.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Northfield Bank maintains a comprehensive Information and Cybersecurity Program led by our Chief Risk Officer, the Chief Information Officer, and the CISO. The program is designed to identify and mitigate information security risks, with timely Board oversight. The Chief Risk Officer briefs the Board of Directors on information security matters during every meeting, ensuring that cybersecurity risks and strategies align with Northfield Bank's risk profile.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: Risks from Cybersecurity Threats The Company has not encountered cybersecurity challenges that have materially impacted our operations or financial results. The Company has included the relevant potential risks from cybersecurity threats as part of the Company's Risk Factors in Item 1A herein.

companyName: CLEAN HARBORS INC

ticker: CLH


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. The audit committee of our board of directors bears primary responsibility for the board's oversight of our cybersecurity risk. Periodically management updates our audit committee about various risks facing the Company, of which cybersecurity may be included.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: We recognize the critical importance of maintaining the safety and security of our systems and data and we take a holistic approach to the oversight and management of cybersecurity and related risks. This approach is supported by our Board of Directors and management who are actively involved in the oversight of our risk management program.

companyName: Karman Holdings Inc.

ticker: KRMN


text: Cybersecurity threats could potentially result in slowed or halted business operations, such as shipping, closing sales, marketing engagement, and other communications. This would negatively impact the Company's financial condition until the issue is resolved. Such threats could impact customers of certain programs that rely on digital resources, but a majority of our products would no t be materially affected.

companyName: PCS Edventures!, Inc.

ticker: PCSV


text: The Audit Committee of our Board of Directors oversees the adequacy and effectiveness of our internal controls, policies and procedures regarding cybersecurity, information security and data protection, and compliance with applicable laws and regulations concerning privacy. Our Chief Information Officer ("CIO"), in turn, is responsible for managing the Company's cybersecurity risk management program and incident response procedures. On a quarterly basis, and more frequently as circumstances warrant, our CIO briefs the Audit Committee on our cybersecurity risks, our strategies for preventing, detecting, responding to and mitigating such risks, including the effectiveness of our incident response procedures, and our information security controls. Our CIO has extensive knowledge and expertise regarding our information systems and security, having served in a variety of senior information technology positions across our organization for more than thirty years, and as an executive officer of the Company since 2006.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: RemSleep Holdings Inc.

ticker: RMSL


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

companyName: GRI Bio, Inc.

ticker: GRI


text: We also use various security tools that are designed to help us identify risks from cybersecurity threats, and escalate, investigate, resolve, and recover from cybersecurity incidents in a timely manner.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Our cybersecurity and IT teams prepare for and respond to cybersecurity attacks and incidents, including defending against unauthorized access to our systems, and crafting response plans intended to significantly reduce impacts on operations and customers. We understand that cyber threats are unwavering and evolving in this digital age, and because of that we continue to increase investments in people and technology to help us mature our practices and maintain confidence in our ability to safeguard our assets. While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors.

companyName: WAFD INC

ticker: WAFD


text: Related to Cybersecurity Risks Our Head of Information Technology (“Head of IT”) is responsible for the strategic leadership and direction of the Company’s information technology organization. Our current Head of IT has over thirty years of experience leading information technology teams in the life sciences industry. The Head of IT reviews threat intelligence, and receives updates from the Company’s third-party providers, to help identify risks from cybersecurity threats.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: The information set forth under "Legal Contingencies" in Note 15 (Commitments and Contingencies) to our Consolidated Financial Statements under Part II, Item 8, "Financial Statements and Supplementary Data," is incorporated herein by reference.

companyName: Accenture plc

ticker: ACN


text: Through our incident response plan, we have designated a cybersecurity management team, or the Cybersecurity Management Team, composed of our executive officers and management representatives. Led by our Vice President of Information Technology & Corporate Facilities, our Cybersecurity Management Team is responsible for the management of the Cybersecurity Program and for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response plan, incidents meeting specified severity levels are required to be escalated to the Cybersecurity Management Team for review and response. The goals of the incident response plan are to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: To address cybersecurity risks and strengthen our defenses against potential threats, we employ a set of various measures. This involves staying up to date on emerging data protection laws and promptly adjusting our processes to ensure compliance. Our network is protected by regularly monitored firewalls with intrusion and malware protection. Our employees have also undergone training in customer data handling and usage requirements, proper internet usage, and secure email and social media training. Employees are encouraged to report all suspicious emails or communications to management. Regular phishing email simulations further enhance employee awareness and resilience against cyber threats. Alongside regularly updated endpoint protection provided by TrendMicro, Inc., multiple layers of redundancy are implemented through Microsoft365 and Datto, Inc., ensuring all company and employee data is safe from deletion, either accidental or deliberate.

companyName: Harbor Custom Development, Inc.


text: Alphabet Inc. senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Alphabet's independent public accounting firm of matters and any relevant developments.

companyName: Alphabet Inc.

ticker: GOOGL


text: TEGNA uses the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has clearly defined policies and standards for all employees and technical systems. TEGNA's internal Cybersecurity Council conducts quarterly meetings to discuss risks, processes, controls, strategy, and response. We use external subject matter experts to provide independent assessments of the cybersecurity program. Following the NIST Cybersecurity Framework, TEGNA utilizes internal reporting, policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion, detection and prevention systems, vulnerability and penetration testing and identity management systems. Our network is continuously monitored using prevailing industry tools, and our cybersecurity team promptly investigates any anomalies. TEGNA has an extensive patching and software update program, and performance metrics are reported to our Board. All new employees are required to take a cybersecurity training course, and we have mandatory quarterly training modules for all employees.

companyName: TEGNA INC

ticker: TGNA


text: We have not experienced any cybersecurity incidents over the past three years that have materially affected us, including our business strategy, results of operations, or financial condition. For certain risks from cybersecurity threats that may materially affect our business strategy, results of operations, or financial condition, see section titled "Risk Factors – Risks Related to Our Business and Industry - If we or the third parties we rely on experience a compromise to the confidentiality, integrity or availability of systems, or data of our customers, shoppers, partners', or Instacart, we may experience adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations; reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences."

companyName: Maplebear Inc.

ticker: CART


text: The CISO and the CRCO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of our information security department.

companyName: Federal Home Loan Bank of Indianapolis


text: We also utilize external expertise to perform annual assessments of our entire cybersecurity program, including the cybersecurity program maturity. The results of these annual assessments are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments. In addition, we have a Third Party Risk Management Program designed to assess risks associated with third party providers based on the services they provide and the data they have access to.

companyName: MGM Resorts International

ticker: MGM


text: Detection and Response Weatherford uses multiple internal and external resources to continuously monitor our information systems for evidence of a threat, breach or other incident.

companyName: Weatherford International plc

ticker: WFRD


text: As of December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" –"Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" in this Annual Report."

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: The Company, using CIS's guidance, approaches cybersecurity threats, through a cross-functional, multilayered approach, for purposes of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, consumers, patients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Revance Therapeutics, Inc.


text: Our cybersecurity efforts include the use of risk-based administrative, technical, and physical controls. Veea has implemented policies, procedures, systems and tools designed to help safeguard our systems and data, including firewalls, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, penetration testing, independent third-party control audits, and other systems and processes.

companyName: VEEA INC.

ticker: VEEA


text: The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives status updates on at least a semi-annual basis from our Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Audit Committee. In addition, all Board members have access to the materials for each Audit Committee meeting.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: Information security and cybersecurity risk is the risk that the security, confidentiality, integrity or availability of our information and critical information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification or destruction. Cybersecurity attacks and other security breaches can have material adverse impacts on our business. While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. The Bank devotes significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs. However, our facilities and systems, and those of third-party service providers, are still vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. The Company seeks to address cybersecurity risks through the implementation of a governance structure and processes to assess, identify, manage, remediate, and report cybersecurity risks.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Important to these programs is our Adviser's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.

companyName: Invesco Real Estate Income Trust Inc.


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats. including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. However, we and our third-party service providers continue to experience cyberattacks, including phishing, ransomware and other attempts to gain unauthorized access to our and their systems, that could materially affect us in the future. For additional information regarding the threats we face, see "Risk Factors—Business and Operational Risks—If we encounter problems with our distribution system, our ability to deliver our products to the market could be adversely affected"; "—We rely significantly on information technology and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business"; and "—Legal, Regulatory and Compliance Risks—Data security or privacy breaches could damage our reputation, cause us to incur additional expense, expose us to litigation and adversely affect our business and results of operations" included in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Under Armour, Inc.

ticker: UAA


text: We conduct third-party penetration testing on both a routine and ad-hoc basis. Routine penetration testing occurs at least annually and focuses on specific elements within our system, usually without notification to any of the Company's employees involved in those systems. Ad-hoc penetration testing occurs when we learn of a specific vulnerability of concern or when we resolve an alert from an imposing threat.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: Our management team, including our Data Protection Officer and external counsel, are responsible along with the Company's Board of Directors for assessing and managing our material risks from cybersecurity threats. Our Data Protection Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Data Protection Officer has extensive experience in overseeing information technology and cybersecurity programs. Collectively, has approximately twenty years of experience in information technology, including more than eight years with direct responsibility for cybersecurity oversight and implementation. This experience included developing and implementing a cybersecurity incident response playbook and leading initiatives to achieve compliance with the NIST CSF 2.0 cybersecurity regulatory framework. Other experience included expanding and maintaining cybersecurity program in response to evolving state regulatory requirements, implementing automated playbooks to prevent and mitigate cyber threats, and overseeing compliance efforts related to NYDFS and CCPA. This backgrounds equips management with practical cybersecurity knowledge, and includes direct experience in cybersecurity program development, incident response readiness, automation of threat prevention, and compliance with applicable cybersecurity and data privacy regulations.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: The Nominating and Corporate Governance Committee of the Board of Directors oversees our cybersecurity programs and cybersecurity team, which are led by our Vice President of Information Technology. At least semi-annual reviews are presented by the Vice President of Information Technology to the Nominating and Corporate Governance Committee demonstrating the cybersecurity practices and controls, mitigation activities, current threat levels, emerging cybersecurity threats, training initiatives, breaches, and results from any penetration testing. In addition, cybersecurity risk management is part of the enterprise risk management program and is reviewed by the Audit Committee at least annually.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: The information set forth under "Risk Factors" (Part I, Item 1A of this Form 10-K) — "We have been and could be vulnerable to disruption in our IT systems, cyber incidents, security breaches and loss of data (associate and client) that have occurred, and may continue to occur, and have resulted in and could continue to result in the incurrence of significant costs and harm to our business and reputation." — on page 15 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December 31, 2024, our financial condition, results of operations or business strategy have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: UNISYS CORP

ticker: UIS


text: ACNB recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats and is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data. Governance of cybersecurity risk is based on the Corporation's Information Security Program and related policies and procedures, which are designed in conformance with industry standards and compliance with Section 39 of the Federal Deposit Insurance act and sections 501 and 505(b) of GLBA, and to protect the confidentiality, integrity and availability of its information assets. The Corporation's Board of Directors is responsible for overseeing the development, implementation and maintenance of the Corporation's overall information security standards. The Audit Committee of the Board of Directors has enterprise risk management oversight responsibilities, which includes information security. Information Security-related functions are performed by both ACNB Bank Risk Management and Technology Services personnel. The Information Security Committee is an ACNB Bank management committee which is responsible for providing oversight and direction for information security matters and standards and meets periodically throughout the year with minutes of their meetings provided to the Corporation's Board of Directors. ACNB Bank's Information Security Officer is responsible for managing and monitoring the Information Security Program, and is a part of the Risk Management department, which ultimately reports to the Chief Risk Officer. Additionally, the Information Security Program is supported by ACNB Bank's Technology Services Department which is led by the Technology Services Manager who reports to the Chief Credit and Operations Officer.

companyName: ACNB CORP

ticker: ACNB


text: In addition, the Audit Committee, with the assistance and advice of Company management and third-party consultants, oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The Audit Committee receives quarterly reports from Company management, which includes cybersecurity risk factors.

companyName: BATTALION OIL CORP

ticker: BATL


text: See "Item 1A. Risk Factors— Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of its confidential information and/or damage to its business relationships"

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: We maintain a comprehensive cybersecurity risk management program modeled by relevant standards provided by organizations such as the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization (27001 - Information Security Standard). Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Our cybersecurity risk management is integrated in our overall risk management program and is based on recognized cybersecurity industry frameworks and standards, including those from the National Institute of Standards and Technology, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies and defined procedures for use of our information assets, access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication, malware defenses and zero trust principles. We work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we regularly train our employees on cybersecurity awareness and, confidential information protection. We routinely test our employees using simulated phishing attacks. Risks from cybersecurity threats have not materially affected our company, business strategy, results of operations or financial condition; however, we remain subject to cybersecurity risks in the future. See Item 1A. Risk Factors – "Our systems, networks and business activities and those of third parties that we utilize in our operations are subject to cybersecurity and stability risks, including information technology system failures, and security breaches."

companyName: Adeia Inc.

ticker: ADEA


text: Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.

companyName: Viewbix Inc.

ticker: VBIX


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Facilities, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Our cybersecurity risk management program includes: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents to our critical systems, information and our enterprise information technology environment. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third Party Risk Management: We use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third party systems, including any service providers, suppliers, and vendors that have access to our critical systems and information. • Education and Training: We provide annual cybersecurity awareness training and on-going phishing simulation testing for our employees, incident response personnel and senior management in order to communicate evolving information security policies, standards, processes and practices and to provide them with the tools to make them aware of processes on addressing cybersecurity threats. • Incident Response and Recovery Planning: We maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: The Company maintains a cybersecurity program designed to detect, identify, classify and mitigate cyber security and other data security threats, as part of its efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, and non-public information about the Company. Our cyber security program is led by the Company's SVP, Head of Legal and Compliance.

companyName: Talis Biomedical Corp

ticker: TLIS


text: We are subject to numerous cybersecurity threats which could result in equipment or network failures, loss of information (including sensitive personal information of customers or employees or proprietary information) as well as disruptions to our or our customers', suppliers' or vendors' operations. Cybersecurity risks we face include threats from entities and persons that may seek to target our information technology ("IT") infrastructure or use malware, computer viruses, denial of services attacks, ransomware attacks, credential harvesting, social engineering and other means to obtain unauthorized access to or disrupt the operation of our networks, systems and those of our suppliers, vendors and other service providers. In addition, we may face cyber threats from parties that seek to target us through our customers, suppliers, and other stakeholders with whom we do business. Cybersecurity threats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of detecting and successfully defending against them.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: Risk oversight and management is a key role for the Board and its committees. The Board is responsible for identifying and understanding the Company's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.

companyName: Progressive Care Inc.


text: Cybersecurity Incidents. To protect our information systems from cybersecurity incidents and threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding materiality of the incident and any necessary public disclosure and reporting of such incidents can be made in a timely manner. In the last three fiscal years, we have not experienced any material cybersecurity incident and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially impacted our results of operations and financial condition. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our CTO leads our Business Technology organization and our cybersecurity risk management program in coordination with our CRO. The Business Technology team is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our CTO and CRO regularly receive briefings on cybersecurity matters, and in turn our CTO regularly reports to the Audit Committee on such matters. Our CRO regularly reports on enterprise risks facing the Company to the ERMC. Our CTO has more than 20 years of experience in leading, managing, and transforming information technology systems for large, global organizations, and our CRO has several years of experience in leading and managing risk oversight for global organizations.

companyName: Bunge Global SA

ticker: BG


text: In order to further protect ourselves financially, we maintain insurance coverage of up to $5 million with respect to losses from business interruption, data recovery, cyber-extortion and ransomware, data breach response and crisis management as a result of a cybersecurity incident.

companyName: FTC Solar, Inc.

ticker: FTCI


text: The Board of Directors has overall oversight responsibility for the Company's risk management function, and primarily relies on the Audit Committee to administer this oversight. With respect to cybersecurity, the Board and Audit Committee are responsible for confirming that the Company's management maintains appropriate cybersecurity policies and has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed, to manage cybersecurity risks and to mitigate any cybersecurity incidents. The Vice President of Information Technology is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes for monitoring and mitigating potential cybersecurity risks, exposures, implementing appropriate mitigation measures and maintaining our cybersecurity program. The Company's dedicated personnel, who report to the Vice President of Information Technology, are certified and experienced information systems security professionals and information security managers with many years of experience. The Vice President of Information Technology has managed this team for over five years after having progressed through various roles of increasing responsibility in both operations and technology at the Company. The Vice President of Information Technology and other members of management report to either the Board of Directors or the Audit Committee at least annually on, among other topics, updates to the Company's cybersecurity program and mitigation strategies, developments in cybersecurity practices generally, and third-party assessments of the Company's cybersecurity program. Management also provides general program updates and industry trends to the Board and Audit Committee on a more ad hoc basis.

companyName: TIMKEN CO

ticker: TKR


text: Additionally, we regularly provide employees with information security awareness training covering the recognition and appropriate handling of potential phishing emails, which can introduce malware to our network, result in the theft of user credentials, and place sensitive data at risk. We regularly test employees to determine their susceptibility to phishing emails and require those more susceptible employees to take additional training.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: As part of our cybersecurity incident response framework, our incident response team focuses on responding to, containing, and recovering from a cybersecurity threat and minimizing any business impact. In the event of a cybersecurity incident, the cybersecurity team assesses, among other factors, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from business stakeholders and external technical, legal and law enforcement support.

companyName: VSE CORP

ticker: VSEC


text: Our strategy to mitigate cybersecurity risks includes monitoring and detection efforts, and the deployment of the anti-malware application ESET on all workstations and servers. The management of our Anti-Virus and Anti-Malware is performed by an experienced third party provider. Regarding third parties that manage or utilize our information technology or data, we conduct continuous monitoring of all third-party providers to ensure they adhere to our cybersecurity standards. To date, we have not experienced cybersecurity threats or incidents that have significantly impacted our business.

companyName: Lowell Farms Inc.

ticker: LOWLF


text: The underlying controls of our cyber risk management program are based on recognized best practices and standards for cyber security and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. Our approach to cybersecurity risk management includes the following key elements: • Defense and On-going Monitoring – Our SOC is responsible for the on-going monitoring and analysis of cyber threats to the Company. The SOC evaluates cyber security incidents according to the Company's cyber incident response plan, appropriate cyber incident playbook, and crisis communications cyber incident plan. The Company also utilizes endpoint detection and response services as well as data forensic investigation services for additional detection capability and timely assistance with potential cyber security incidents. • Technical Safeguards – The Company utilizes various tactics for cyber threat prevention. We periodically perform vulnerability assessments, remediate vulnerabilities, review log and access, perform system maintenance, manage network perimeter protection, and implement and manage disaster recovery testing. Further, Zebra relies on its information security management system supported by a comprehensive set of policies that directly align with ISO 27001 and are supported by System and Organization Controls 2 (SOC2) reports and external ISO 27001:2013 certification for certain parts of our business. • Education and Awareness – To foster employee awareness of cyber threats, we provide periodic educational sessions to our employees, including annual training on general cybersecurity concepts and educational opportunities that include real-life simulation and "tabletop exercises." We also regularly conduct privacy and security summits that involve training and information sessions conducted by employees and by third parties. • Third-Party Risk Management ("TPRM") – Our TPRM function focuses on mitigating cyber risk from specific third-party vendor categories. This function performs initial TPRM assessments as part of the vendor selection process and regularly reassess vendors based on vendor type and risk factors.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: We use third-party service providers to perform a variety of functions throughout our business, such as electronic communications service providers, cloud-based file storage service providers, and contract manufacturing and research organizations.

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Financial Officer, our VP of regulatory affairs as well as an external IT company, who collectively share risk management, compliance and technical experience. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.

companyName: Ayala Pharmaceuticals, Inc.

ticker: ADXS


text: The Company's risk management program is headed by its Chief Information Officer, Vice President of Cybersecurity and its Cybersecurity Architect. Collectively, they possess a diverse portfolio of highly regarded cybersecurity certifications, including certifications with a focus on risk management, and are able to leverage their extensive cybersecurity experience to effectively manage risk. The Company's information technology ("IT") team is led by the Company's Chief Information Officer, and employs dedicated security staff who hold well-established cybersecurity certifications. The Company's IT team meets on a recurring basis, and at least quarterly, with senior members of the Information Technology, Compliance, and Internal Audit departments to assess cybersecurity risks. Additionally, our employees and certain consultants are required to complete cybersecurity training on an annual basis to reinforce awareness of cybersecurity threats and risks to the organization. In addition to internal resources, the Company engages third parties to help test and evaluate the effectiveness and resiliency of the Company's IT environment, provide recommendations to strengthen the program, and provide updates on leading cybersecurity protections and practices. The Company also works with a global strategic risk advisory firm on risks related the portfolio companies of our funds.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: We have also adopted a robust cybersecurity risk governance model, including the formation of the Cybersecurity Governance Committee composed of key leaders from stakeholder groups throughout the Company including our CISO, Chief Operating Officer, Chief Legal Officer, and the head of Internal Audit, along with other senior members of management.

companyName: Invitation Homes Inc.

ticker: INVH


text: Cybersecurity is a vital aspect of maintaining the trust of our customers and employees. We have instituted a comprehensive cybersecurity risk management program that employs various methods to monitor and assess our threat environment and risk profile. These methods include the use of manual and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us and conducting vulnerabilities assessments. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risks. Our employees receive ongoing training under our security policies.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: Currently, we rely on an established major incident management and communication process to address any potential cybersecurity incidents. This established process includes the use of third party partnerships to make available the distinct skill sets needed to assist in properly responding to any cybersecurity threat. We are in process of establishing defined response procedures to effectively address any cyber threat that may occur regardless of the safeguards in place that minimize the chance of a successful cyberattack. The response procedures will be designed to identify, analyze, contain and remediate such cyber incidents expeditiously. These procedures and approach to safeguard our information and assets will be continuously monitored by management and updated to evolve with the current cyber landscape in alignment with the ISO 27001 standard mentioned above.

companyName: JOINT Corp

ticker: JYNT


text: • Education and Awareness: The Company provides annual, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. If an employee fails a bi-weekly phishing campaign they are re-enrolled in the Company's cybersecurity awareness training.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: During the period covered by this Annual Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Risks Related to Market Events and Regulatory Developments— Cybersecurity and data protection risks could result in the loss of data, exposure of confidential information, interruptions in our business, and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations." for a discussion of risks related to cybersecurity.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: If a threat is detected, our system automatically notifies our internal information systems management ("ISM") team of all activities and ranks those activities based on their level of threat to the system and/or deviation of behavior from normal. Severe threats notify the ISM team via text message, regardless of hours of operation. In addition to the notification, the system will automatically take action to secure the system, up to and including blocking user accounts and access. The ISM team will then review the notification, assess the action that was taken against the actual threat, and then clear the condition or take further action.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Cyber criminals do, however, target TPG and our employees and vendors. Ongoing or future attacks such as these could have impacts on TPG's operations. For additional information on these ongoing risks please refer to "Part 1. Item 1A. Risk Factors—Failure to maintain the security of our information and technology networks or data security breaches could harm our reputation and have a material adverse effect on our results of operations, financial condition, and cash flow".

companyName: TPG Inc.

ticker: TPG


text: Our risk management program also assesses third-party risks to identify and mitigate risks from vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition, we strive to have the appropriate cybersecurity clauses in our agreements and where necessary we have Data Processing Agreements ("DPAs") put in place for privacy of data.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Attacks on our assets or security breaches in our systems or infrastructure could lead to the corruption, loss or unauthorized use of such data, delays in production or delivery of our production to customers, difficulty in completing and settling transactions, challenges in maintaining our books and records, environmental damage, communication interruptions or other operational disruptions. We seek to address these risks by safeguarding assets, data and operations through the cybersecurity risk management processes described below:

companyName: Antero Midstream Corp

ticker: AM


text: Our Head of IT is responsible for strategic leadership of our cybersecurity risk management program. The Head of IT role is currently held by an individual who has approximately eighteen years of professional IT management experience. Our Head of IT also provides regular updates on our cybersecurity risk to our executive leadership team and other management committees responsible for IT and cybersecurity risk management.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: There can be no assurances that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or are effective in protecting our systems and information.

companyName: Beachbody Company, Inc.

ticker: BODI


text: The Company's information security program is comprised of three primary components that guide the activities of employees and advisors tasked with managing the program: • Information Security Policy: The Company maintains an Information Security Policy that aligns with the National Institute of Standards and Technology and ISO 27001 cybersecurity guidelines and frameworks. This policy is reviewed at least annually by the Company's IT Security & Risk team, with updates approved by the Board of Directors. The Information Security Policy addresses the standards, design, scope, testing, and operation of the Company's cybersecurity program. All Company employees are trained both initially and on an annual basis on the information security requirements set by the policy. Employees whose work is more pertinent to cybersecurity management and risk, such as software development, receive additional and more specialized training. • Incident Management Policy: The Company's Incident Management Policy provides the structure and guidance for the Company's cyber incident response operations to ensure the quick detection of security events and vulnerabilities, as well as promote a rapid response to security incidents and mitigation measures. A dedicated security incident response team is tasked with addressing security incidents and driving the Company's response. • Cyber Risk Management Program: The Company performs a comprehensive risk assessment on an annual basis to identify and prioritize potential threats and vulnerabilities, then uses the results to implement and revise policies, assign responsibilities, and deploy security controls to address them on an ongoing, 24-7 basis.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: We annually contract with a well-known third-party to conduct a comprehensive, enterprise-wide risk assessment. In addition to other mandates, this assessment evaluates Cooper Standard's cybersecurity program from a risk perspective and assesses our IT controls for alignment with the ISO/IEC 27001:2022 information security framework. Based on the assessment results, we refresh the roadmap for our cybersecurity program, focusing on the highest-risk vulnerabilities first and monitoring for significant changes and emerging risks, continuously adjusting the roadmap as needed.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: Management is also responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT and Chief Operating Officer are responsible for helping prepare the company for cybersecurity incidents, training personnel, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Equillium, Inc.

ticker: EQ


text: We also work with third parties, such as independent assessors (for example, for industry maturity assessments, penetration testing, application security reviews, and independent audits), external legal counsel and other consultants as part of the design and implementation of the Program. The Program is periodically evaluated by external experts, and the results of those reviews are reported to the Board of Directors.

companyName: METLIFE INC

ticker: MET


text: The Company, through its information technology partner, provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Longeveron Inc.

ticker: LGVN


text: We maintain an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This Playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of the Board of Directors. These escalation provisions, together with our Disclosure Controls and Procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Monitoring Cybersecurity Incidents. On a daily basis, our information security team monitors, identifies and classifies potential cybersecurity events and is responsible for notifying the CTO and CISO of such events as appropriate based on risk to our organization. Our CTO and CISO are responsible for notifying executive leadership, other functional teams and our audit committee, as appropriate.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Management regularly performs risk assessments relating to cybersecurity risks. We have a risk-based cybersecurity program, dedicated to protecting our data and data that may be collected from patient monitoring devices. We utilize a defense-in-depth strategy with multiple layers of security controls to protect our data and systems. We mitigate cybersecurity risks by employing a number of measures, including employee training, systems monitoring and testing and maintenance of protective systems and contingency plans. As part of our cybersecurity risk management processes, management engages external auditors and consultants to assess our program and controls. We evaluate ourselves for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests. We also install and regularly update antivirus software on all of our Company-managed systems to detect malicious code and prevent it from impacting our systems. We require cybersecurity awareness training for all staff members with access to our network. We also maintain cyber liability insurance coverage to further reduce our risk profile. Security of our financial data and other sensitive information remains a high priority for us, led by our global information security team. We employ an appropriate encryption and tokenization platform for all online and direct-to-consumer sales from our websites, ensuring no credit card data is stored in our internal systems. For more information on risks related to cybersecurity and data security, see Item 1A. "Risk Factors - Risks Related to Our Regulatory Environment" and "Risk Factors - General Risk Factors". Except as disclosed therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: MASIMO CORP

ticker: MASI


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff and/or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Our critical business systems are fully redundant and backed up. Our security systems correlate security events from our SIEM and aggregate security-related incident data, such as malware activity, malicious activities, and ransomware. Security functionality is continuously monitored by our IT security team and our third party comanaged vendor soc team, and our network traffic is analyzed for signs of malicious activity through the Cyber security systems. Anti-virus solutions are deployed throughout our organization on servers, laptops and workstations in our data centers, headquarters, and remote sites.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, and our broader enterprise IT environment; • an enterprise-wide security team principally responsible for managing our cybersecurity risk assessment processes, implementing and maintaining our security controls, and responding to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including incident response personnel, product development personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, including, among others, vetting, periodic monitoring, and the implementation of contractual safeguards to ensure adherence to our cybersecurity standards.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy processes are led by our SVP of Information Technology and Assistant Vice President (AVP) of IT Infrastructure and Security. Such individuals have collectiv ely over 50 years of work experience in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: The Audit Committee of the Board is responsible for oversight of risk management related to cybersecurity, policies and procedures related to the protection of Company proprietary and customer information, and compliance with data privacy requirements. It receives quarterly updates from our CIO on trends, threats, and technologies used to prevent, detect and respond to risks; reviews and provides feedback on employee education initiatives, crisis response strategies, and remediation measures; and reports to the Board on fulfillment of its cybersecurity risk management oversight.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: Cybersecurity related risks have been identified as material business risks, and identifying, assessing and managing these risks is integrated into our Enterprise Risk Management (ERM) process, which is designed to identify, assess and guide in managing material risks throughout Textron at both the business segment and enterprise levels. We maintain cyber risk/network protection mitigation plans through our ERM process to assist in management of these risks. Our full Board oversees our ERM process through discussions at our Board of Directors' Annual Strategic Business and Risk Review and at an annual dedicated ERM Review. In addition, high risk areas, including cybersecurity matters, are reviewed and discussed with the full Board or other Board Committees, as appropriate. The Audit Committee, as reflected in its charter, has been designated to assist the Board in its oversight of our ERM process, including with respect to cybersecurity risk.

companyName: TEXTRON INC

ticker: TXT


text: Currently, the Company has not been materially impacted from an operational or financial perspective from cybersecurity threats. Cybersecurity is a rapidly evolving area that the Company takes great efforts to mitigate any adverse impacts; however, the Company cannot guarantee that it will not be subject to cybersecurity attacks. See Item 1A, Risk Factors, for more information.

companyName: ICC Holdings, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program; and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: measures that are taken to ensure proper protection include: computers are protected using a cloud-powered endpoint security solution that helps enterprises prevent, detect, investigate, and respond to advanced threats on their networks. It offers endpoint protection, endpoint detection and response, mobile threat defense, and integrated vulnerability management. It also provides, among other things, malware and spyware detection and remediation, rootkit detection and remediation and network vulnerability detection. Company computer hard drives are automatically encrypted.

companyName: Microbot Medical Inc.

ticker: MBOT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management members, including our CSO and CCPO, whom each has extensive cybersecurity experience in their respective areas of responsibility and expertise. Our CSO, who reports to the Chief Financial Officer, has primary responsibility for hiring appropriate information security personnel and managing workloads of information security personnel, engaging and overseeing third-party cybersecurity consultants, approving budgets and cybersecurity processes, preparing for incident response, reviewing security assessments and other security-related reports, communicating key priorities to relevant personnel, including the security incident response team, assessing and managing Adobe's overall cybersecurity strategy, standards, risk management (in consultation with the cybersecurity risk steering committee) and processes. Our CCPO, who reports to the General Counsel, has primary responsibility for the legal aspects of the cybersecurity program, including assessing and providing advice on our cybersecurity strategy, standards, risk management, policies, processes and legal obligations. Our CSO and CCPO are supported by a cybersecurity team comprised of cybersecurity, information security, information technology, operations and legal executives and professionals.

companyName: ADOBE INC.

ticker: ADBE


text: The Information Security department is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Information Officer and the Board of Directors with dotted-line reporting to the Chief Risk Officer. The Company's CISO has over 20 years of experience in cybersecurity across the financial services industry as well as experience working in a leading managed security services provider. Prior to joining the Company, the Company's CISO served as leader of the Global Threat Management Center for a major global financial institution. The Information Risk department, led by the Head of Information Risk who reports directly to the Chief Risk Officer, is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the firm. Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the Board. The risk committees include the Operational Risk Management Committee, the Executive Risk Management Committee and the Risk Committee of the Board of Directors. These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: Board is actively involved in overseeing risks from cybersecurity threats. At least once a year, our Board discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of our business strategy. Our Audit Committee has the authority to oversee and review the adequacy of our cybersecurity, information and technology security, and data privacy programs, procedures, and policies.

companyName: Expion360 Inc.

ticker: XPON