text: Engaging Third Parties on Risk Management Specific controls that address cybersecurity risks include endpoint threat detection and response, identity and access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, conditional access, firewalls and intrusion detection and prevention, and vulnerability and patch management. We engage third-party security firms in different capacities to provide or operate some of these controls, such as vulnerability assessments, penetration testing and other procedures to identify potential weaknesses in our systems and processes. In addition, as a financial institution, we conduct appropriate due diligence and monitoring procedures to address potential cybersecurity threats related to the use of third-party technology and outsourced services, including pre-acquisition due diligence, imposition of contractual obligations, and performance monitoring.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: The Information Security organization is led by the CISO. The head of each of the four divisions of the Information Security team reports directly to the CISO. The CISO reports directly to LNC's Chief Information Officer ("CIO"), who is a member of LNC's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the LNC Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the company and cybersecurity developments generally. In addition, as discussed above, LNC's Internal Audit team reports to the LNC Audit Committee the results of its annual security audit focused on cybersecurity risks. LNC's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the LNC Audit Committee on a quarterly basis.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/

secItem: Item 1C


text: Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee our cybersecurity efforts and cyber related risks. The Audit Committee, which is comprised of entirely independent directors, oversees risk assessment, training programs, significant threat changes, and vulnerabilities as well as the effectiveness of any information security practices.

companyName: Harbor Custom Development, Inc.


text: Integrated Cybersecurity Risk Management Verizon's Senior Vice President and Chief Information Security Officer (CISO) has responsibility for the management of cybersecurity risks at Verizon. The CISO and their team are responsible for Verizon's information security strategy, policy, standards, architecture and processes.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: The Company's cybersecurity risk management processes are integrated into the Company's overall risk management program. In this regard, our Board of Directors has designated the Audit Committee as being primarily responsible for overseeing risk management at a board level, and has delegated certain specific categories of risk oversight matters to the Audit Committee as well as to the other standing committees of the Board, within their respective areas of responsibilities. Additionally, the Audit Committee makes periodic reports to the Board regarding briefing and reports provided by management and advisors regarding various risk oversight matters as well as the Audit Committee's own analysis and conclusions regarding the adequacy of the Company's risk management program.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: We recognize the importance of maintaining the safety and security of our critical systems, information, products, services and broader information technology environment (collectively, our "Information Systems and Data"), and we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability thereof.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Overseeing Third-Party Risk Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our Chief Technology Officer. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Strive, Inc.

ticker: ASST


text: We describe whether and how risks from cybersecurity threats have or are reasonably likely to affect our financial position, results of operations, and cash flows under the heading "Risk related to cybersecurity, intellectual property and regulatory compliance," which is included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: CVD EQUIPMENT CORP

ticker: CVV


text: Our Cybersecurity Risk Management Program is designed around the Center for Internet Security (CIS) Controls version 18. The CIS Controls offer a strategic framework that directs our implementation of effective cybersecurity defenses across 18 critical areas, ranging from asset management to data protection and network security.

companyName: Urgent.ly Inc.

ticker: ULY


text: The Board of Directors is committed to maintaining a strong cybersecurity and data protection framework intended to protect our customers, shareholders, employees, and other stakeholders, as well as the integrity of our operations. Our Board is involved in the oversight of the Company's cybersecurity risk management efforts. Our cybersecurity risk management consists of a set of processes designed to assess, identify and effectively manage material risks arising from cybersecurity and data protection threats. These processes are aligned with the Framework for Improving Critical Infrastructure Cybersecurity established by the National Institute of Standards and Technology. Our processes have been integrated into our overall risk management system, consistent with our commitment to safeguarding our operations and data on a Company-wide basis. Our cybersecurity risk management efforts are overseen by our Audit Committee in collaboration with individual members of our management team, specifically our Information Technology Leadership Team, Chief Legal Officer, and Vice President of Risk Management. Generally, our cybersecurity risk management efforts seek to address cybersecurity risks and incident response through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we collect by identifying, preventing and mitigating cybersecurity threats and effectively responding to incidents when they occur. Our efforts also emphasize continuity of systems to ensure minimal disruption and maintain operational integrity during cybersecurity threats and incidents. We regularly review and update our contingency plans, aiming to enhance the resilience of our operations and the consistent functionality of our systems in the face of potential disruptions.

companyName: WillScot Holdings Corp

ticker: WSC


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. We perform simulations and drills for responding to cybersecurity threats at both a technical and management level. We incorporate external expertise and reviews in all aspects of our cybersecurity program. All of our employees receive annual cybersecurity awareness training.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: We have experienced, and may experience in the future, either directly or through our supply chain or other channels, cybersecurity incidents. To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about risks associated with cybersecurity, refer to "Our business could be negatively affected by cyber or other security threats or other disruptions" in Item 1A. Risk Factors.

companyName: TRIUMPH GROUP INC


text: Our Board of Directors also has a dedicated Cybersecurity Special Committee that is empowered to manage the Company's response to major cybersecurity incidents and enable the integration of crisis management and business continuity processes. The Cybersecurity Special Committee, led by our Chief Information, Digital Innovation and Business Services Officer and two Board members (including the Chair of the AFC), consists of executive members from various corporate functions, including information technology, digital operations, corporate affairs, legal, compliance, human resources and finance. Outside cybersecurity experts periodically present to the Board on topics related to information security, data privacy and cyber risks and mitigation strategies.

companyName: COTY INC.

ticker: COTY


text: In an effort to protect our business against cybersecurity threats, we have implemented a cybersecurity risk management program that is integrated with our internal risk management processes and designed to identify and protect against cyber threats as well as to respond to and recover from cyber incidents, as applicable. Our cybersecurity risk management program is informed by industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and is supported by periodic internal and external information security assessments and testing.

companyName: RAPID MICRO BIOSYSTEMS, INC.

ticker: RPID


text: At least annually, we present a cybersecurity report to our full Board of Directors along with semiannual briefings. These sessions may cover, among other topics, the information security organization, material risks, technical threats, information technology security infrastructure, patching and vulnerability management, cybersecurity incidents, an annual cybersecurity tabletop exercise and incident preparedness, supplier management, security awareness training, cybersecurity personnel/staffing and a cybersecurity threat assessment.

companyName: Enact Holdings, Inc.

ticker: ACT


text: Notwithstanding the vigorous approach we take to cybersecurity, we may not always be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, we have not identified cybersecurity risks, threats, or incidents that have materially affected us, including our operations, business strategy, results of operations, or financial conditions.

companyName: ICF International, Inc.

ticker: ICFI


text: We have sought to align our cybersecurity risk management program with our business strategy and integrate our cybersecurity risk management program into our overall risk management strategy and policies and throughout our operations. Our cybersecurity risk management program is comprised of technical and administrative controls, processes, policies and procedures based on applicable laws and industry standards and guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Related to Cybersecurity Risks Our Chief Information Officer ("CIO") is responsible for the strategic leadership and direction of the Company's information technology organization. Prior to joining BJ's in 2023, our current CIO served as global chief information officer at a public healthcare company, where she led information technology, privacy assurance, cyber, digital and data security across key business units. She has also held various chief information officer and technology leadership roles at several other healthcare companies and a multinational pharmaceutical corporation, along with other senior management positions during her career.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: Cybersecurity is integrated with our overall risk management program through cyber coverage as an important component of our insurance portfolio. We maintain cyber insurance to help protect against potential loss or expense arising from a cybersecurity incident or data breach. As part of our cyber insurance renewal, we coordinate with our insurance broker cyber experts to assess our cybersecurity program and align our coverages with our risk management framework. Our oversight processes for reviewing threats from third-parties that we allow to access or contribute to our information technology systems are also important to overall risk management. We subject such third-parties to a variety of cybersecurity analyses, which include our use of risk assessments or scorecards and receipt of third-party audit or other reports related to information security.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Audit and Finance Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit and Finance Committee receives an overview covering current and emerging cybersecurity threat risks and the Company's ability to mitigate those risks, and discusses these topics with our Chief Information Security Officer and Chief Technology and Digital Officer. Cybersecurity risk management is also considered at least annually during separate Board of Directors meeting discussions with management.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our Board of Directors and Audit Committee oversee risks from cybersecurity threats. Our Audit Committee of the board on a quarterly basis reviews cybersecurity risks and our board periodically reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. The board relies on management and its use of the third-party consultants for expertise for assessing and managing our risks from cybersecurity threats. In conjunction with management, the board considers the nature of the work provided by our operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: ORION ENERGY SYSTEMS, INC.

ticker: OESX


text: Our board of directors oversees our strategic and business risk management, with cybersecurity risk management oversight delegated to the Audit, Risk, and Compliance Committee (the "Committee"). The Committee also oversees risks related to privacy and data use and monitors our compliance with our privacy program. Management is responsible for the ongoing identification, assessment, and management of material cybersecurity risks, along with the implementation of processes for monitoring potential cybersecurity risk exposures, deploying appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to the Committee and to the board of directors.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: We believe Manhattan has appropriate processes for assessing, identifying, and managing material risks from cybersecurity threats. Those processes are embodied in our enterprise-wide Cyber Risk Management Program (the "Cyber Program"), which includes our cybersecurity governance structure and our cybersecurity strategy and processes.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: We leverage third-party service partners to expand the capabilities of our cybersecurity program. This may include testing of the program's protection measures as well as services for incident detection, investigation, and recovery. We also leverage third-party service providers to conduct tabletop exercises and perform assessments against cybersecurity frameworks.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: In October 2023, we made payments on three separate invoices which payments were later determined by management to have been made in error. Two of the payments were later recovered from the vendors, but it is unlikely that the third payment will be recovered. Our management has conducted a thorough investigation related to these events and has concluded there was a material weakness in our internal control over financial reporting related to our review and approval of cash disbursements.

companyName: ExcelFin Acquisition Corp.


text: Our management team, including our CIO and CISO, supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information systems environment.

companyName: AMGEN INC

ticker: AMGN


text: The Company's Board, which is responsible for oversight of risk management related to our business as a whole, has delegated responsibility to the Audit Committee for oversight of the Enterprise Risk Management ("ERM") program and cybersecurity risk, among other matters. Cybersecurity risk is among the risks monitored by the ERM program, which establishes an annual cadence for identifying material risks facing the Company, as well as quarterly reporting to the Audit Committee on the severity of each such risk and mitigation measures being implemented. The Audit Committee also receives an annual update from the information security function on the Company's current cybersecurity risks, recent enhancements to the Company's safeguards and related policies. The Company's Incident Response Plan provides for notification of and consultation with the Audit Committee in the event of a cybersecurity incident exceeding specified levels of severity.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: We manage cybersecurity incidents pursuant to a documented incident response plan executed by an incident response team consisting of senior leaders and their team members who are integral to effective incident response management, including but not limited to representatives from information security, legal, compliance, risk management, communications, facilities, operations, marketing and distribution, finance, and human resources, as well as external, nationally recognized legal and forensics resources who are familiar with our operations and incident response team, and who routinely participate in our tabletop training. We employ a formal incident escalation process based on the nature of the incident and its risk severity, for alerting and engaging with executive leadership and members of our Audit Committee and Board of Directors. The incident response plan includes processes integrated with our business continuity and emergency response plans.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: The Company understand that the effective management of cybersecurity risks requires continuous assessment and improvement. Security benchmarking is a critical component to assess how well our security investments and processes compare with internal and external standards and objectives.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: The program includes escalation and notification of potentially significant incidents to the Cybersecurity Disclosure Committee and the Audit Committee of the Board, as appropriate. Our Cybersecurity Disclosure Committee is comprised of senior leadership across multiple functional areas and is responsible for reviewing and evaluating potentially significant cybersecurity incidents and for determining whether any notification or disclosure is required under applicable laws, including the federal securities laws. In 2024, We have developed an AI Governance Council to address the cybersecurity, data privacy and data management of emerging technologies. The Council is a multidisciplinary group with representatives from the human resources, information technology, law, compliance and ethics, privacy, and research and development functions.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing, if deemed necessary. We utilize well-known cloud-based technologies and service providers such as Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.

companyName: Nordicus Partners Corp

ticker: NORD


text: cybersecurity awareness training of our employees and senior management; and business continuity, contingency, and recovery plans, including a cybersecurity incident response plan with procedures for responding to cybersecurity incidents.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: At QVC, the VP Information Security is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP Information Security provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.

companyName: QVC INC

ticker: QVCD


text: Our information security team is responsible for assessing and maintaining our cybersecurity risk management program. In addition, our information security team engages third-party security experts on an as-needed basis for risk assessment and system enhancements. Our information security team also facilitates training to all employees during the onboarding process and annually, with additional training as we deem appropriate. We review or update our cybersecurity policies annually, or more frequently on an as-needed basis, to account for changes in the evolving cybersecurity threat landscape as well as legal and regulatory developments. Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over critical third parties with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such third parties remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties. When we do become aware that a third-party vendor or service provider has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate.

companyName: Remitly Global, Inc.

ticker: RELY


text: Both the Bank's internal Risk Committee and the Company's Risk Committee review all risk assessments and remediations annually. The information security program includes policies and standards that define the risk assessment procedures, reporting and an incident response plan. The incident response plan defines escalations to senior management and the Board, as well as required notifications and timeframes to customers and regulatory authorities.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: responding to a cybersecurity incident, and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall enterprise risk management systems and processes. For example, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Board and Committee Oversight Our Board has oversight responsibility for our overall enterprise risk management and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee oversees Lucid's policies and practices with respect to risk assessment and risk management, including discussing with management (i) Lucid's major financial, cybersecurity, privacy and other information technology risk exposures; (ii) the steps that have been taken to monitor and control such exposures; and (iii) any material cybersecurity threats or incidents. The Audit Committee and the Board receive regular reporting from Lucid's management, including our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.

companyName: Lucid Group, Inc.

ticker: LCID


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls and (3) response to cybersecurity incidents; • policies, security technologies and safeguards to fulfill overall NIST CSF program goals and key controls established by the CIS; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security program; this includes penetration testing, and assisting internal audit in assessing the effectiveness of our controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors who have access to our critical systems and information.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee is responsible for reviewing our Manager's implementation of our cybersecurity risk management program and evaluating its adequacy.

companyName: Star Holdings

ticker: STHO


text: We have not experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Material Cybersecurity Risks and Threats Risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A—Risk Factors of this Report under the heading "Our business is subject to cybersecurity and information technology system disruption risks," which should be read in conjunction with the foregoing information.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Our cybersecurity risk management approach includes: (i) an enterprise risk management process, which includes cybersecurity risks and is periodically refreshed; (ii) system vulnerability scanning; (iii) cybersecurity training for employees; (iv) penetration testing, which simulates cyber threats; and (v) third-party risk management for suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that allow for periodic auditing. We work to continually improve each of these processes with the goal of ensuring our cybersecurity strategy remains consistent with industry best practices.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: The Head of Information Security utilizes various tools and resources to manage and monitor cybersecurity threats, vulnerabilities, and incidents, most of which are delivered through third-party solutions. Examples include, but are not limited to: • Endpoint and network device vulnerability identification and scanning • Internal and external penetration testing services with an emphasis on on-premise and cloud security • Security training and awareness, with an emphasis on phishing threats • Third-party security risk assessments • NIST CSF assessment tools • Security information and event management for monitoring infrastructure events.

companyName: NeueHealth, Inc.

ticker: NEUE


text: from Material Cybersecurity Threats we have taken steps to prevent and mitigate data security threats, there can be no assurance that our protective measures and those of our third-party service providers will prevent or detect security breaches that could have a significant impact on our business, reputation, operating results and financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems. As of the date of this filing, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by preventative, detective, and responsive measures we have put detail about the cybersecurity risks we face. Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Risks from Cybersecurity Threats We are not aware of any risks from any potential cybersecurity threat or from any previous cybersecurity incident that have materially affected or are likely to materially affect our business strategy, results of operations or financial condition. However, the risks from cybersecurity threats and incidents continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents. We describe whether and how cybersecurity-related risks could materially affect our business, results of operation and financial condition in Item 1A, "Risk Factors" under the heading "Our operations are subject to cyber-attacks and other information technology disruptions that could have a material adverse effect on our business, results of operations and financial condition."

companyName: Integer Holdings Corp

ticker: ITGR


text: The Company relies on our internal Technology Solutions team and third-party vendors to deliver effective and efficient services to our customers, process claims, and report information accurately and promptly to carriers. This often requires the secure handling of confidential, sensitive, proprietary, and other types of information. We actively monitor the risks associated with potential cybersecurity breaches of any of these systems. Therefore, we have made investments, and will continue to invest, in technology security initiatives, information technology policies, resources, and teammate training to mitigate the risk of unauthorized access to sensitive or personally identifiable information.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The Audit Committee reviews cybersecurity information technology risks in connection with its oversight of our enterprise risk management system, and reports to the Board on enterprise risk management matters on a quarterly basis. If a cybersecurity event is identified by the CISO, management and the Cyber Security Steering Committee report any material security instances to the Audit Committee and the Board as they occur. Additionally, our CISO meets regularly with our senior management team and the Board of Directors or the Audit Committee to brief them on technology and information security matters, including cybersecurity risk related matters.

companyName: JBT MAREL Corp

ticker: JBTM


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cyber security risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: DIGIASIA CORP.


text: We maintain a Data Security Incident Response Plan (the "Plan"), which outlines the processes and procedures that we should follow to respond to, remediate and resolve a security incident involving a potential or actual compromise of our proprietary information and/or personal information. It also describes the structure, roles and responsibilities of personnel involved in responding to such incidents and provides a process for alerting senior management of such incidents. The Plan is reviewed on an annual basis and revised as necessary.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: We regularly engage with auditors to review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading under Risk Factors titled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation", which disclosures are incorporated by reference herein.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Our cybersecurity incident response policies and procedures are designed to escalate certain cybersecurity incidents to members of management who are part of the Incident Management Team. The Incident Management Team works to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the cybersecurity incident response policy and security incident handling procedure include escalating certain cybersecurity incidents to our disclosure committee and, if appropriate, to the Audit Committee.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: The Company's Vice President of Information Technology, Director of Information Security, Director of Systems Engineering, and Director of Retail Platforms manage the Company's information security policies and have oversight of our cybersecurity systems and methodologies risks, as well as assessing and managing cybersecurity risk. The Director of Information Security holds cybersecurity certifications as a Certified Information Systems Security Professional and GIAC Penetration Tester. Risk is evaluated on an ongoing basis to determine the likelihood and magnitude of a potential impact. In addition, the Director of Internal Audit is a Certified Internal Auditor and is actively involved in the annual internal general IT controls audit and partners with a third party to assist. The results of all internal audits, including information technology issues, and updates on the Company's incident response program and results are shared with the Company's Audit Committee of the Board of Directors which reports to the full Board of Directors.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: The Risk Committee oversees the Company's approach to cybersecurity risk assessment and mitigation by, among other things, (i) reviewing the Company's cybersecurity insurance program, (ii) reviewing the Company's cybersecurity budget, (iii) discussing the results of various internal cybersecurity audits and periodic independent third-party assessments of the Company's cybersecurity programs, (iv) being briefed on cybersecurity matters by outside experts, and (v) receiving regular updates from the Company's Chief Information Security Officer ("CISO") and others on cybersecurity risks, operational metrics, compliance and regulatory developments, training programs, risk mitigation activities, key projects and industry developments. The Company's Chief Legal and Compliance Officer ("CLCO"), Chief Digital and Technology Officer ("CDTO"), CISO and Vice President of Compliance and Internal Audit participate in Risk Committee meetings and meet individually with the Risk Committee on a periodic basis to discuss and address relevant matters, including the Company's approach to cybersecurity risk assessment and mitigation. The CISO reports to the CDTO, who in turn reports to the Chief Executive Officer ("CEO"). The CISO has more than thirty years of IT experience, has served many years in various information security management roles and has multiple cybersecurity certifications.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: • Security Incident and Event Monitoring • Cloud alerting and monitoring • Disaster recovery and business continuity planning and backup strategy • Incident response process • Network segmentation • Data classification labeling and data loss prevention • Privileged access management • Secure builds • Multi-factor and adaptive authentication • Physical security • Internet filtering, email spam filtering and anti-phishing • Brand protection and phishing takedown service • Database security • Data transfer and encryption Additionally, we maintain cybersecurity insurance coverage to help mitigate risk in the event of a potential breach or attack. Although we maintain insurance coverage at levels we deem appropriate for our business, it is possible that such coverage could be insufficient to cover all losses or types of claims that may arise.

companyName: 1st FRANKLIN FINANCIAL CORP


text: We also maintain a cyber incident response plan with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect us, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents, and (3) managing internal and external communications and reporting.

companyName: GRIFFON CORP

ticker: GFF


text: Information Sharing and Collaboration - We subscribe to financial services cyber intelligence and collaboration services, and we work closely with cyber intelligence and managed security service providers to augment our own security program and controls. We investigate intelligence sharing platforms to assess potential risks as credible or emerging risks.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: Under the guidance of our CSO, we maintain a comprehensive CSP designed to protect our employees, customers, assets, premises, systems, and information against unauthorized access, misuse, alteration, or destruction that could result in substantial harm or inconvenience to our customers, and loss or reputational damage. The CSP incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, payment security, and training and awareness. Independent assessment and benchmarking of the CSP are regularly completed, and the CSP is reviewed and assessed by federal regulators. While we look to numerous frameworks to ensure the CSP is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology cybersecurity framework is the primary standard against which we benchmark ourselves.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: Our Board oversees risk management after receiving briefings from advisors and also based on its own analysis and conclusions regarding the adequacy of our risk management processes. The Board continuously evaluates and manages material risks including geopolitical and enterprise risks, financial risks, environmental risks, health and safety risks and cybersecurity risks.

companyName: GeoSolar Technologies, Inc.


text: Cohen & Steers' cybersecurity risk management function is led by its Chief Information Security Officer ("CISO") and Chief Technology Officer ("CTO") and includes members of its Information Technology ("IT") department and other personnel that oversee its information security and engineering operations. Input and guidance are also provided by members of its Legal and Compliance departments. Together, these employees (collectively referred to as members of the "Cybersecurity Management") are primarily responsible for developing, implementing and monitoring Cohen & Steers' cybersecurity program and reporting on cybersecurity matters to Cohen & Steers' senior management as well as our Audit Committee, on behalf of our Board.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Cybersecurity is part of Dime's overall risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Internal Audit actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. External audit results are reviewed and reported on in our annual filing. Additionally, Dime is a regulated entity and undergoes regulatory reviews to ensure the Bank remains in compliance with all appropriate standards.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: Our Senior Vice President of Information Technology (SVP, IT) is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current SVP, IT has over 25 years of experience in information technology and possesses the requisite education, skills and experience expected of an individual assigned to these duties. We also engage third-party consultants and auditors to assess the effectiveness of our cybersecurity prevention and response systems and processes. Where applicable, third-party service providers are contractually obligated to notify us of material incidents arising from cybersecurity events within their purview.

companyName: REGENXBIO Inc.

ticker: RGNX


text: Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as through external audits and certifications.

companyName: V2X, Inc.

ticker: VVX


text: We assess and identify security risk to the organization by: conducting assessments of risk, including likelihood and magnitude, from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored or transmitted;

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: We engage third-party service providers to assist us with our cybersecurity risk management system Third-party cybersecurity experts regularly supplement our cybersecurity risk management efforts, including those we engage to conduct periodic cybersecurity risk assessments. During 2023, Unisys engaged cybersecurity risk experts and external legal counsel to conduct a review of, and advise us on, our cybersecurity risk management processes, current cybersecurity risk environment, leading board governance practices, strategic cyber reporting and cyber resiliency. Following the review, we have further revised our processes for identifying material cybersecurity incidents and enhanced our written policy regarding identification, classification of severity and escalation of cybersecurity incidents.

companyName: UNISYS CORP

ticker: UIS


text: We manage cybersecurity risk through three core teams: cybersecurity engineering, data privacy, and a security operation center. These teams are responsible for overseeing data safety during new system and infrastructure deployments, maintaining appropriate cybersecurity controls, and monitoring, documenting and investigating any anomalies affecting employees, suppliers, and customers. Our IT security controls are designed to align with the NIST (National Institute of Standards and Technology) standard and are tested on an ongoing basis. These controls and procedures include cybersecurity risks associated with third-party service providers. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets. To support our internal risk management structure, we use third-party specialists to monitor for emerging threats, conduct vulnerability scans and analysis including simulated hacker attacks, and audit our cybersecurity framework. We also maintain an information security risk insurance policy in the event of a security breach. Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity programs and the supporting control frameworks.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Ongoing Monitoring and Reporting of Cybersecurity Incidents The Company has an internal security team, supplemented with third-party security partners, to regularly monitor, detect and respond to potential cybersecurity incidents. The Company has a cybersecurity incident reporting protocol that provides a mechanism for the appropriate members of management and the Board to be made aware of cybersecurity incidents. The Company also requires security awareness training for all internal employees to enable employees to understand their role in preventing and reporting cybersecurity incidents.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: The Board and Senior Management are charged with the ultimate responsibility for understanding the company's risk environment. A Management Risk Committee, chaired by our Chief Risk Officer (CRO), is responsible to oversee the Company's risk management program on an enterprise-wide basis.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our processes and resources are also designed to help enable us to actively identify, protect, detect, respond to, and recover from risks and threats. Nevertheless, we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. As of the date of this report, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition.

companyName: FITLIFE BRANDS, INC.

ticker: FTLF


text: In the ordinary course of our business, we and our third-party service providers, such as contract research organizations, contract manufacturing organizations, and managed service providers collect, maintain and transmit sensitive data on our networks and systems, including our intellectual property and proprietary or confidential business information (such as research and development data and personal information). The secure maintenance of this confidentiality, availability and integrity of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology applications and services to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Verastem, Inc.

ticker: VSTM


text: Depending on the environment, systems, and data, we employ various technical, physical, and organizational measures designed to mitigate material cybersecurity risks, including an incident response plan, incident detection and response processes, a vulnerability management program, disaster recovery/business continuity plans, risk assessments, data encryption, network and access controls, a vendor risk management program, physical security, employee training, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: At the management level, the head of the global cybersecurity team is responsible for overseeing and implementing a cybersecurity strategy aligned with the Company's goals and needs. Our head of global cybersecurity has extensive experience with respect to cybersecurity matters as a result of over 10 years of relevant work experience and holds multiple industry certifications. Our cybersecurity function is supported by cybersecurity personnel with substantial industry experience as well as our network of regional IT leaders and our global IT infrastructure team. The head of the global cybersecurity receives ongoing updates from such individuals regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: ESAB Corp

ticker: ESAB


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Please read Item 1A. "Risk Factors—Risks Related to Our Business—A breach of information security or the failure of one or more key IT or operational (OT) systems, or those of third parties, may adversely affect our business, results of operations or business reputation." and " Attacks, including acts of terrorism or cyber sabotage, or the threat of such attacks, may adversely affect our business or reputation." for discussions of risks from cybersecurity threats we face.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our management team, including our Chief Financial Officer, and our external information technology services providers are responsible for assessing and managing our material risks from cybersecurity threats. We have outsourced implementation and day-to-day function of our overall cybersecurity risk management program to our third-party information technology service providers. Our management team supervises both our internal personnel and our retained external cybersecurity consultants.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: We evaluate our cybersecurity strategy annually, including our processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein, within our overall enterprise risk management framework. Our cybersecurity strategy takes a multi-faceted approach, one which focuses on the following key areas: (i) the human element within the Company; (ii) perimeter security; (iii) network security; (iv) application security; (v) endpoint security; and (vi) data security. We use a wide array of processes, mechanisms, controls, technologies, systems, strategies and tools to address these areas, including but not limited to: routine security awareness training, formal evaluations of third-party applications, password strength policies, antivirus software, firewalls, routine patch management, encryption software, data backups and data redundancies, email security software, multi-factor authentication tools, network security monitoring, and web vulnerability scanning.

companyName: XOMA Royalty Corp

ticker: XOMA


text: The Company's cybersecurity programs are supported by experienced and knowledgeable leaders. The CISO has served in various roles related to information technology and information security for over 20 years. The CISO maintains relevant certifications, including Certified Information Systems Security Manager ("CISM") and Certified Information Systems Auditor ("CISA"). Additionally, several cybersecurity team members reporting directly to the CISO maintain certifications, including CISM, CISA and Certified Information System Security Professionals ("CISSP"). The Company's Chief Digital & Information Officer has over 30 years of experience with information technology and digital strategy. The Company's CEO, CFO and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies, including risks arising from cybersecurity threats.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: CACI's cybersecurity program is integrated into our overall risk management program and is primarily managed by our Chief Information Security Officer ("CISO") who is responsible for coordinating cross-functional internal and external resources to establish processes and procedures to monitor potential cybersecurity risks, identify cybersecurity incidents, implement appropriate mitigation measures, report cybersecurity breaches and maintain our cybersecurity program. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from experienced cybersecurity professionals in the information security team, and with technological tools and software. We continuously monitor cybersecurity threats and assess the robustness of our mitigation and prevention measures through routine internal and independent audits, threat simulations, vulnerability and penetration testing and employee cybersecurity training. Our cybersecurity program is designed to be aligned with applicable industry standards and we continue to invest in capabilities to protect all information assets in our possession.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: The Company has implemented a Third-Party Risk Management ("TPRM") framework that evaluates cybersecurity controls in vendor contracts, ensuring compliance with security policies.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Day-to-day management of our information security strategy and operations is currently the responsibility of our CISO, who reports to our Chief Information and Data Officer and our Chief Security Officer, both of whom report to our Chief Financial Officer. Our CISO has approximately 15 years of experience working in information security positions, including having served as CISO for publicly traded companies. That experience is supplemented by the collective experience and expertise of our dedicated internal teams of cybersecurity personnel.

companyName: Walt Disney Co

ticker: DIS


text: As discussed in more detail under the heading "Governance" below, the Board receives presentations and interacts with management on cybersecurity readiness.

companyName: FARO TECHNOLOGIES INC


text: The Company deploys measures which it believes leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats. The Company has invested and continues to invest in risk management and information security and data privacy measures it believes are appropriate to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses. Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations. Refer to Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K, which should be read in conjunction with the foregoing information, for additional information on cybersecurity risks the Company faces.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and access controls, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, and vulnerability and security testing,. The Company has a process to report material results of such testing and assessments to the board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to conduct part of such testing The Company identifies and oversees cybersecurity risks presented by third parties and their systems from a risk-based perspective The Company also conducts cybersecurity training for employees (including mandatory training programs for system users).

companyName: SKYX Platforms Corp.

ticker: SKYX


text: Managing Material Risks & Integrated Overall Risk Management As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, and manage cybersecurity risks. It starts with our internal Cybersecurity Operations Center (CSOC), which routinely analyzes threat information from external sources, monitors network activity, and responds to potential security incidents. In addition, our cybersecurity and privacy policies encompass incident response procedures and information security governance. As part of our ongoing assessment of our cybersecurity program, we monitor and make adjustments, as necessary, in support of compliance with current and emerging cybersecurity and privacy laws, regulations and guidance applicable to us in jurisdictions where we do business (including NERC CIP reliability standards and TSA security directives), as further described in Item 1A "Risk Factors." Our internal audit team conducts regular internal security audits and vulnerability assessments of CenterPoint Energy's systems and user data security practices.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: Incident Response and Reporting The Company has a cybersecurity policy that governs the corporate response to and communication of security incidents affecting the Company's information technology system and stresses the need for fast response times and continuous improvement in security measures. The policy requires immediate reporting of any observed security incident to the CCPO, the Company's third-party IT services provider, Chief Financial Officer, and Chief Executive Officer. The CCPO, working with our IT services provider and any other third parties required, is responsible for taking steps to minimize loss and destruction, identify and correct any weakness that was exploited, restoring IT services and continuing to communicate to senior management and the Board on the event. The CCPO is authorized to employ any third-party service providers as necessary. The policy also requires the conduct of post-incident analyses, reporting on the incident, identification of lessons learned and a close-out report.

companyName: AGILE THERAPEUTICS INC


text: We have established an Information Security team led by our Chief Information Officer, who has over 30 years of experience in information technology and cloud operations. Our Information Security team is responsible for assessing, identifying and managing risks from cybersecurity threats. Managing cybersecurity risk has been integrated into our overall risk management system and is a priority that we monitor and review regularly with our board of directors. The Information Security team works closely with our Legal team to make determinations whether a cybersecurity incident has occurred and whether the incident has materially impacted or is reasonably likely to materially impact us. If a cybersecurity incident is deemed material, the incident would be communicated to various members of the Alarm.com leadership team and with the board of directors. The board of directors oversees our overall risk management system, including cybersecurity risks. The Chief Information Officer presents at quarterly Board meetings and discusses specific risk areas, including those relating to cybersecurity.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM


text: GE Vernova's CISO reports to GE Vernova's Chief Information Officer and leads our overall cybersecurity function. The CISO has over 20 years of experience in managing and leading IT or cybersecurity teams and participates in various cyber security organizations. The CISO collaborates with business unit CISOs to identify and analyze cybersecurity risks to GE Vernova; consider industry trends; implement controls, as appropriate and feasible, to mitigate these risks; and enable business leaders to make risk-based business decisions that implicate cybersecurity considerations. The CISO meets with senior leadership to review and discuss GE Vernova's cybersecurity program, including emerging cyber risks, threats, and industry trends. The CISO also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with internal security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to inform our cybersecurity technologies and processes.

companyName: GE Vernova Inc.

ticker: GEV


text: Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology ("NIST") Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company's risk management framework. As part of the Company's cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response. The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center ("SOC") as well as a cybersecurity incident response team ("CSIRT"), to further escalate to senior management and the Board, as appropriate. While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of cybersecurity incidents to law enforcement and regulatory bodies, as appropriate.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Poseida Therapeutics, Inc.


text: Material Impact on Company The Company has not been materially affected by, and is not likely to be materially affected by, any significant cybersecurity incidents.

companyName: CAMBER ENERGY, INC.

ticker: CEIN


text: Consequence Mitigation We also test the Company's InfoSec's Incident Response control effectiveness through tabletop exercises facilitated by a third party. These exercises test the Company's ability to detect and respond to cybersecurity incidents in a timely manner with a goal to reduce the impact of cybersecurity incidents. Our InfoSec policies, processes and procedures are tested for completion and accuracy through these exercises. We use the results of these exercises to identify, evaluate, and prioritize potential areas of improvement identified through the InfoSec Roadmap.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As we grow, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: We have implemented incident response and breach management processes. Notifications are made based on the level of threat of the incident. Incidents are evaluated to determine materiality as well as operational and business impact. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.

companyName: OOMA INC

ticker: OOMA


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents.

companyName: Atlantis Glory Inc.

ticker: AGLY


text: For additional discussion of certain risks associated with cybersecurity, see Item 1A, "Risk Factors" under the heading "Cybersecurity risks could adversely affect our operating effectiveness and operating results."

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: Strategy and Governance The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO"), together with Crescent's Head of Information Technology, oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Crescent Private Credit Income Corp


text: Our Board of Directors takes an active role in overseeing the management of cybersecurity risks to the Company. The information security team provides periodic reports to the Cybersecurity and Technology Committee of the Board, as well as to the full Board, the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the cybersecurity program and the emerging threat landscape. The cybersecurity program is periodically evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors.

companyName: LIVEPERSON INC

ticker: LPSN


text: Our CSO reports to our President – Artificial Intelligence, Technology and Sustainability, who has been a Chief Information Officer or Chief Technology Officer of two other large publicly traded companies. He provides overall leadership and guidance for the company's technology department, including the cybersecurity team. He holds a Master of Business Administration in international business from The Ohio State University, a Master of Computer Applications in computer science from the University of Mumbai, a Bachelor of Science in physics from the University of Madras and has been with us since 2021.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: Enterprise Risk Management: Our enterprise risk management program includes management of material risks from cybersecurity threats alongside other Company risks as part of our overall risk assessment process. In 2024, as part of our Enterprise Risk Management Program, our Internal Audit team identified and prioritized the most critical risks that could impact our ability to achieve our business priorities and make risk-informed strategic decisions. With management's input, our Board and Internal Audit team have identified cybersecurity as one of the risks that merits the highest level of prioritization. Informed by this designation, our Internal Audit team tracks cybersecurity key indicators and engages in discussions on the status, priorities and impact of cybersecurity risk response plans; reports key information to management throughout the year to inform decision making; and reports to the Audit Committee on a quarterly basis and to the full Board on the results and progress of the risk mitigation process.

companyName: TheRealReal, Inc.

ticker: REAL


text: However, as of the date of this Annual Report on Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect Elite's business strategy, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against Company IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to Company service delivery; however, potential vulnerabilities to known or unknown threats will still remain.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: Internal Cybersecurity Team The TSO, led by the CISO, is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Southern Company system. The Southern Company system also relies on a Data Privacy and Protection team in the compliance organization, as well as the internal audit organization, to work with the TSO on data protection policies and practices. Multiple experienced information security leaders with internal and external security experience responsible for various parts of the business report to the CISO, each of whom is supported by a team of trained cybersecurity professionals. In addition to these internal cybersecurity capabilities, external auditors and security companies are regularly engaged to assist with assessing, testing, identifying, and managing cybersecurity, including through penetration testing, vulnerability testing, and other technical evaluations.

companyName: SOUTHERN CO GAS


text: Our Board of Directors, with assistance from our Audit Committee, oversees our risk management program, which includes technology and cybersecurity risks. Our management team, including our Vice President - Information Technology ("VP - IT"), provides periodic updates on risk management to the Audit Committee and to the Board of Directors. Such periodic updates include presentations regarding cybersecurity matters, including any new cybersecurity threats, events, incidents, risks, risk management solutions, trainings or education, strategy pivots, or governance changes. The Audit Committee regularly reports its actions, findings and recommendations to the Board of Directors. The Audit Committee relies in large part on such periodic updates and presentations from our management team in developing its reports to the Board of Directors.

companyName: Coterra Energy Inc.

ticker: CTRA


text: We have established an Information Security Management Committee to manage information security in accordance with the ISO 27001:2013 standard to ensure the consistent application of security principles, policy statements, and controls. In adhering to this industry standard, we manage and mitigate material risks from threats to our systems and data by partnering with reputable, recognized security firms, and conducting ongoing internal and external information security audits, risk assessments, anti-phishing campaigns, penetration testing exercises, systems monitoring activities, employee training, and cyber incident response exercises. Our policies include standards and procedures for vulnerability management, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, mobile device management and system monitoring. SUN COMMUNITIES, INC.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: We design and assess our program based on the NIST Special Publication 800-171 and the Cybersecurity Maturity Model Certification (CMMC) levels 1. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and CMMC maturity models as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Marpai, Inc.

ticker: MRAI


text: Our CISO and our steering committee on information security oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO and our steering committee on information security are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness.

companyName: Cricut, Inc.

ticker: CRCT


text: Honda, including AHFC and HCFI, have been targeted by cyberattacks in the past; however, no risks from cybersecurity threats have been identified that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the past three fiscal years. See "Item 1A. Risk Factors—General Risk Factors—A security breach or a cyber attack may adversely affect our business, results of operations and financial condition."

companyName: AMERICAN HONDA FINANCE CORP


text: We conduct tests of our cybersecurity program on a regular basis that are designed to identify our cybersecurity risks. We use third-party security service providers and cybersecurity consultants to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats and review our cybersecurity program. The results of such reviews are reported to certain members of our senior management, who evaluate material risks from cybersecurity threats against our overall business objectives and report to the Board of Directors (Board), which evaluates our overall enterprise risk. Within our senior management our Chief Financial Officer and Chief Technology Officer (CTO) review our cybersecurity program at least quarterly. Our CTO is one of our founders and has been in technology since 1996.

companyName: INTELLINETICS, INC.

ticker: INLX


text: Our Information Security Department and Security Management functions, led by our Chief Information Officer ("CIO") and supported by our Director of Information Security and Compliance, (collectively, "Security Team"), help identify, assess and manage the Company's cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry's risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems..

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Ball faces risks from cybersecurity threats that could have a material adverse effect on the company, including its business strategy, results of operations, financial condition and reputation. Refer to Item 1A, Risk Factors – Technological Risks, for additional details on cybersecurity risks that could potentially materially affect the company, including its business strategy, results of operations, financial condition and reputation. To date, we have not identified any cybersecurity incidents that have affected, or are reasonably likely to affect, our business, operations, or financial condition.

companyName: BALL Corp

ticker: BALL


text: The audit committee receives periodic reports from our IT Director concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners. In addition, cybersecurity incidents could have material adverse effects on our business strategy, financial condition, and results of operations (e.g., a significant breach could result in direct financial losses due to fraud, system downtime impacting revenue generation, increased compliance costs or contractual liabilities with third-party vendors and customers).

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board of Directors. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.

companyName: TRANSCAT INC

ticker: TRNS


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages in coordination with the Risk Committee of our board of directors as part of our enterprise risk management program. The Risk Committee regularly reviews the Company's enterprise risk management program and Information Security Program with management and reports to the board of directors. The Chief Information Security Officer reports directly to our Chief Digital Officer and presents at least annually to the Company's full board of directors about the overall effectiveness of the Information Security Program, as well as quarterly to the Risk Committee. Radian's board of directors approves the written Information Security Policy and Information Security Program documents annually. Collectively, these documents describe the structure, scope, organization and requirements of the Information Security Program, as well as the responsibility and authority of the Chief Information Security Officer.

companyName: RADIAN GROUP INC

ticker: RDN


text: While we have not, as of the date of this Report, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For information regarding cybersecurity risks that may materially affect our Company, see "Item 1A. Risk Factors" included in this Report.

companyName: WisdomTree, Inc.

ticker: WT


text: Our processes include assessing cybersecurity risks associated with our use of third-party service providers in the normal course of business, including those in our supply chain or who have access to our customer and employee data or our systems. Additionally, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: We have limited exposure to cybersecurity threats. We have established policies and processes, identifying and managing material risk from cyber security threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: Our enterprise (the holding company and its operating subsidiaries) is using technology in virtually all aspects of the business. Much like many other businesses, certain of our subsidiaries' information systems have been subject to computer viruses, malicious codes, unauthorized access, and other cyberattacks. We expect to be subject to similar attacks in the future as such attacks become more sophisticated. A significant disruption or failure of our technology systems could result in service interruptions, safety failures, security events, regulatory compliance failures, an inability to protect information and assets against unauthorized users, and other operational difficulties. Attacks perpetrated against our systems could result in loss of assets and critical information and expose us to remediation costs and reputational damage.

companyName: Biglari Holdings Inc.

ticker: BH-A


text: We have a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls and enhanced security with ransomware defense. The framework leverages International Organization for Standardization 27001/27002 standards for general information technology controls, the National Institute of Standards and Technology Cyber Security Framework for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley Act for assessment in internal controls. Our cybersecurity processes are integrated into our overall risk management system, and include a comprehensive cyber crisis management program that would apply if a cybersecurity related incident were to occur.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: The ITCC meets at least quarterly to discuss its oversight of our cybersecurity policies and procedures, risk-management practices and controls, and efforts to mitigate and prevent cybersecurity risks. The ITCC may meet more frequently if required by our Incident Response Plan to facilitate timely response, monitoring, risk-management, and recovery efforts. The ITCC is also charged with periodically reporting to management, the Board, and the Risk Committee, the status and results of our compliance with our security program, results of security assessments, and effectiveness of remediation activities.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: We maintain a robust Cybersecurity Incident Response Program intended to help us respond to an incident, prevent or minimize system disruption or the loss of data, recover business-critical services and facilitate compliance with any applicable legal obligations. Our program includes a written response plan that provides a framework for handling cybersecurity incidents based on the severity of the incident and the formation of a cross-functional incident response team staffed in accordance with the relevant severity level. The plan also sets out a coordinated approach to assessing the severity of potential and actual incidents and their impacts, containing, investigating, documenting, mitigating and remediating incidents, including reporting findings and keeping senior management, the Board of Directors and other key stakeholders and third parties (such as insurance providers and incident response professionals) informed and involved as appropriate. Our cybersecurity team regularly tests our cybersecurity controls through penetration testing, vulnerability scanning, and attack simulation.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework and contractual, industry and regulatory best practices and requirements.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and deprovisioning of users' access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments.

companyName: FNB CORP/PA/

ticker: FNB


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures; when appropriate, training and awareness programs for team members to drive adoption and awareness of cybersecurity processes and procedures;

companyName: Namliong SkyCosmos, Inc.

ticker: NLSC


text: Engaging Third Parties on Risk Management We collaborate with vendors, service providers, assessors, auditors, consultants, and other third parties on an as-needed basis to develop secure informational and operational technology systems and protect against cybersecurity threats. For example, we engage third-party security experts to conduct risk assessments and program enhancements, including vulnerability assessments, cybersecurity tabletop exercises, and internal and external penetration tests.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: Cybersecurity is also a responsibility of all LiveRamp employees. All employees must undergo annual security awareness training, which covers topics including, but not limited to, phishing, incident reporting, insider threat, and LiveRamp's Security and Acceptable Use policies.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: As of December 31, 2024, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments, and conducting periodic reassessments during their engagement.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: Employees, contractors, and third parties are required to immediately report any suspected cybersecurity threats to the Corporate Information Security team for triaging. Any threat assessed by the Corporate Information Security team that could impact the safety of customers or personnel, cause damage to, or threaten the confidentiality, integrity, or availability of information assets, or bring about significant business interruption, are escalated for further assessment. In the event that the CISO, in consultation with the Company's Legal and Compliance teams, determines that a material cybersecurity incident has occurred, a dedicated Crisis Incident Response team comprised of individuals from various departments across the organization is assigned to coordinate all planned cybersecurity incident-related response activities. The Company will engage third party specialists to assist in any cybersecurity incident investigation, as needed.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: We maintain a Chief Security Office (CSO), which is charged with management-level responsibility for all aspects of network and information security within the Company. Led by our CISO and comprised of a large team of highly trained security professionals across multiple countries, the CSO is responsible for: a.establishing the policies, standards and requirements for the security of AT&T's computing and network environments;

companyName: AT&T INC.

ticker: T


text: We use a risk-based approach that is aligned with the National Institute of Standards and Technology. We maintain policies and standards that provide the framework for assessing risk. We conduct an annual information security focused risk assessment, which leverages the process and control areas provided by the International Organization for Standardization ("ISO") 27001. In September 2021, we received our ISO 27001 Information Security Management certification. In fiscal 2022 and 2023, management performed procedures to validate our continued conformity with the ISO 27001 standard and concluded that existing controls continued to operate effectively. In addition, we assess our cybersecurity threat risks by conducting periodic internal and external risk assessments and annual external penetration testing, as well as maintaining an active vulnerability management program to assess threats at the network, systems and application levels.

companyName: TrueBlue, Inc.

ticker: TBI


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, which includes a rigorous vetting process and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.

companyName: ALEXANDERS INC

ticker: ALX