text: The CISO/CIO has served in various roles in information technology and information security for over 20 years, including serving as the Chief Information Security Officer of another public company for over 6 years. The CISO/CIO holds undergraduate and graduate degrees in computer science and has attained the professional certification of Certified Chief Information Security Officer. Our CEO, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields. Collectively, they have several decades of experience managing risk at our company and in similar organizations or settings and assessing cybersecurity threats.

companyName: CareDx, Inc.

ticker: CDNA


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other risk areas. We have also implemented a specific cybersecurity program which adopts a risk management approach to information security, requiring the identification, assessment, and appropriate mitigation of vulnerabilities and threats that can adversely impact our information assets. Our cybersecurity program includes: • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • An information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for customers, service providers, suppliers, and vendors.

companyName: Oil-Dri Corp of America

ticker: ODC

secItem: Item 1C


text: Our SOC team members have over 35 years of combined work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and developing and overseeing programs and policies related to various areas, including incident response, eDiscovery, forensic investigations, log analysis, malware analysis, risk management, physical security, and enterprise security operations, as well as several relevant degrees and certifications, including Masters degrees in Cybersecurity and Information Assurance, Bachelors degrees in Information Technology, BS Information Systems and Cybersecurity, Certified Information Systems Security Professional, Certified Ethical Hacker, Computer Hacking Forensic Investigator, A+, Network+, Security+, MS Sentinel, a Degree in forensic science and others being worked on. Prior work experience, knowledge, skills, or background for the SOC team include: law enforcement, DoD contractor work in cybersecurity, heavy involvement in numerous large scale intrusion investigations, published author of an Intrusion Analysis book, presentations at numerous conferences focused on cybersecurity, hundreds of forensic analysis cases, prior employment by other companies as cybersecurity/SOC analysts, and continuous on the job training We have a cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our process to industry standards and best practices standards set by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO"), as well as by engaging experts to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from information and cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: a.closely monitor emerging data protection laws and implement changes to our processes designed to comply; b.conduct annual customer data handling and use requirements training for all our employees; c.conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

companyName: TruBridge, Inc.

ticker: TBRG


text: One of the key functions of our board of directors is oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers manage the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole and through the audit committee.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Given the nature and limited scale of our operations, we do not maintain a formal cybersecurity program, dedicated cybersecurity personnel, or standalone cybersecurity policies. Our business does not involve the development, storage, or processing of sensitive personal data, proprietary technology, or large volumes of confidential information.

companyName: Bodhi Tree Biotechnology Inc

ticker: BDTB


text: We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete a monthly computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users to identify information security threats and what actions should be taken. Additionally, the employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: Our Board is ultimately responsible for overseeing our risk management, including cybersecurity risk management. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Financial Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to our independent Audit Committee and ultimately to our Board. There were no such cybersecurity incidents or threats that have materially impacted our business or operations. Management presents an assessment of our cybersecurity processes, procedures, and testing results to the Audit Committee at least annually.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM


text: We maintain a cybersecurity risk management program that is designed to identify, assess, manage, and mitigate cybersecurity risks and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. To secure our technology environment, our organization leverages the latest software and security capabilities with a defense-in-depth and layered strategy. We deploy endpoint detection and response, network anomaly detection, and multi-factor authentication across most of our environment. We engage with various third-party consultants as well as utilize various threat intelligence services to assist in our oversight and to identify risks. We require employees with access to our information systems, including all corporate employees and consultants, to undertake annual data protection and cybersecurity training and ongoing phishing simulation exercises.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Valvoline has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. This program, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity and Privacy Frameworks, is an integrated part of the company's overall enterprise risk management process. The program applies, where appropriate, to Valvoline's internal and external information systems, applications, networks, and operations. It includes ongoing activities such as scanning, testing, and assessments intended to identify and manage risks arising from cybersecurity threats.

companyName: VALVOLINE INC

ticker: VVV


text: To determine the risk to Registrant's systems, it engages in a continuous vulnerability management lifecycle process to identify and remediate vulnerable systems and system configurations. In this regard, Registrant leverages the NIST cybersecurity frameworks. To supplement Registrant's internal process, the cybersecurity team regularly contracts consultants to assess system configurations, both passively through exercises such as configuration review and actively through penetration testing, and response procedures, such as tabletop exercises, to identify areas for improvement. In addition, Registrant supplements its day-to-day operations with around the clock identification, assessment and mitigation of cyber risks with third-party security services as well. Registrant is working on implementing across AWR and its subsidiaries a comprehensive, risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems and data, as well as the systems of third parties that could adversely impact Registrant's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Third-Party Service Provider Management – We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: Our cybersecurity and physical security controls are implemented through policies and procedures we utilize for planning, performing, managing, assessing, innovating, and improving our security controls. To protect our information and cyber assets, we implement practices for training and screening of personnel, access management, network defense, asset configuration management, vulnerability assessment (including penetration testing), third-party security, and privacy and information protection. Our defense-in-depth strategy to protect our cyber assets and sensitive information reduces the potential severity and duration of a cybersecurity incident by leveraging security measures across various layers of the enterprise. Cross-functional executive steering committees and peer groups, with business unit and technical stakeholder participation, are maintained to support oversight, security controls development, change management, implementation, evaluation, continuous improvement, and sustainment.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our enterprise operations, compliance, and legal teams, including our Chief Information Officer and Chief Legal Officer. Such individuals have extensive prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our management team updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The management team, led by one of our Vice Presidents for Information Security and our SVP of Information Technology is primarily responsible for assessing and managing risks from cybersecurity threats.

companyName: StandardAero, Inc.

ticker: SARO


text: Cybersecurity risk is an important and continuously evolving focus for us, EQT, and EQT's affiliates. EQT maintains a cybersecurity program as part of its and our Risk Management Framework, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by EQRT, from anticipated threats or hazards. EQT utilizes a variety of protective measures as a part of its and our cybersecurity program. These measures include:

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Our Senior Vice President of Technology reports to the Chief Financial Officer and leads our IT and cybersecurity functions and has primary responsibility for leading our overall cybersecurity risk management program, supervising both our internal cybersecurity personnel and our external cybersecurity service providers. Our cybersecurity function is responsible for assessing and managing our material risks from cybersecurity threats, as well as informing management about and monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers and alerts and reports produced by security tools deployed in the IT environment. Our Senior Vice President of Technology has significant global experience in managing and leading information systems and deploying cybersecurity technologies and holds a cybersecurity certification from a leading cybersecurity training and research institute.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: Board of Director Oversight The Board's Audit Committee is responsible for overseeing the Company's cyber risk. The CISO and other experts, as necessary provide the Audit Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current and emerging cybersecurity threat landscape; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers.

companyName: Arcosa, Inc.

ticker: ACA


text: Coastal engages third party assessors, consultants and auditors in connection with the Information Security Program, including to conduct external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners in order to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: Our chief security officer, who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience on the security team at Amazon and an extensive career in the technology and cybersecurity industries as a senior executive in the federal government, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Amazon and reports directly to the Chief Executive Officer.

companyName: AMAZON COM INC

ticker: AMZN


text: Our Information Technology Administrator, working with and through external vendors, including our outsourced Data Protection Officer, implements and administers our information security processes. Our Information Technology Administrator, in conjunction with the Data Protection Officer, provides regular reports to our Chief Financial Officer and General Counsel on cybersecurity risks and the implementation of risk management processes.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: To mitigate or address risks, Shentel leverages acceptable and well-known security tools and services allowing Shentel to maintain a robust security posture. Our Information Security Program addresses risks through a wide spectrum of measures, including enhanced monitoring, endpoint protection, multifactor authentication, privileged account security, web and email filtering and comprehensive internal employee training. Our security protocols are rooted in industry standards and guidelines issued by respected bodies such as the National Institute of Standards and Technology, the Department of Homeland Cybersecurity and Infrastructure Security Agency, and the Center for Internet Security. In addition, we regularly consult with external advisors regarding opportunities to enhance and strengthen our policies and practices.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are present and similar to other financial institutions. The Company, as well as our customers, colleagues, regulators, service providers and other third parties, have seen an increase in information security and cybersecurity risk in recent years. We continue to assess the risks and threats in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity collaboration and capabilities.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: The Board has delegated their oversight of cybersecurity to the Company's Audit and Compliance Committee which oversees the entire ERMP process. As detailed above, cybersecurity is a standing agenda topic for the Audit and Compliance Committee which receives regular presentations and reports from the Company's CIO on cybersecurity risks, detection protocols, disaster recovery readiness, the threat environment, recent developments in the cybersecurity space (including known incidents affecting the Company or key Company suppliers), evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. Under the current cybersecurity framework, the Audit and Compliance Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. The Audit and Compliance Committee will keep the full board informed, as may be appropriate, until any such threat has been addressed to their satisfaction. Additionally, cybersecurity is also a standing agenda topic for the Global Risk Committee, with periodic updates to the Executive Committee.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: The status of our cybersecurity is reported to senior management as needed, and formal incident reports are made for incidents with risk of significant impact to the Company. Such incidents are escalated to our Incident Response Team, led by the Business Continuity Coordinator ("BCC"), which follows our business continuity plan and includes executive summary for management, along with compliance reports to regulators within the required timeframes. The BCC is responsible for providing timely information to the CLO, who reports to the Audit Committee and the full board of directors.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: To our knowledge there has been no security breach or incident, unauthorized access or disclosure, or other compromise of or relating to the Company or its subsidiaries hard wallets, cold wallets, information technology and computer systems, networks, hardware, software, data and databases, equipment or technology. We have not been notified of, and have no knowledge of any event or condition that could result in, any security breach or incident, unauthorized access or disclosure or other compromise to their IT systems and data, and we have implemented appropriate controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.

companyName: LM FUNDING AMERICA, INC.

ticker: LMFA


text: In our asset management business, our board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the "AGM Audit Committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. Our board of directors, the AGM Audit Committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from the Company's risk management professionals, the Company's Chief Security Officer ("CSO"), CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Technology, Legal, Compliance, and ERM. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, the Board and/or the AGM Audit Committee receive quarterly risk updates from our risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board or the AGM Audit Committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: Apollo Global Management, Inc.

ticker: APO


text: Using our cybersecurity incident response plan, each incident receives a severity rating using a scale approved by Management. Based on that rating, we employ an escalation matrix that provides appropriate notifications to Management, as well as to our Board of Directors.

companyName: CENTENE CORP

ticker: CNC


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in, or is reasonably likely to result in, a material effect on our business strategy, results of operations, or financial condition. Like other companies, we are the target of cyberattacks. In 2020, for example, we publicly announced that we were the target of a systems intrusion in which a third party infected certain of the Company's systems with malware. Although we were able to resolve that matter without material impact, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, including the risk factor titled "We are increasingly dependent on sophisticated information technology systems; our business and results of operations are subject to adverse impacts due to the disruption, failure, or breaches of these systems."

companyName: EMCOR Group, Inc.

ticker: EME


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to materially affect our Company, see the risk factor titled "A significant disruption in, or breach in security of, our information technology systems or violations of data protection laws could materially adversely affect our business and reputation" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: ROGERS CORP

ticker: ROG


text: All companies that maintain sensitive or confidential data or utilize technology are subject to the threat of unauthorized persons gaining unapproved access to systems or components of systems. In order to mitigate this threat to our business, we take a comprehensive approach to cybersecurity risk management. We have devoted significant resources to implement and maintain cybersecurity measures to meet regulatory requirements and the expectations of our clients, trading partners, and other stakeholders. We intend to continue to evolve our cybersecurity defenses and strategy and to make significant investments to maintain the security of our data and cybersecurity infrastructure.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We maintain a network and information security program that is reasonably designed to protect our information, and that of our customers, from unauthorized risks to their confidentiality, integrity or availability. Our program encompasses the CSO and its policies, platforms, procedures and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers. The program is integrated into our overall risk management framework and is generally designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution.

companyName: AT&T INC.

ticker: T


text: Interim Chief Executive/Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: Engagement of Third Party Advisors We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape. We refine and mature our cybersecurity roadmap and strategy based on findings and their risk standing.

companyName: Twist Bioscience Corp

ticker: TWST


text: We assess, identify and manage cybersecurity risks through a structured process. We rely on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to guide our approach; covering risk identification, analysis, prioritization and treatment. We continuously monitor and mitigate identified risks, particularly those deemed significant to the Company, including, but not limited to: operational risk (i.e., disruption of business operations); intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk, which are tracked through our enterprise risk management program.

companyName: KENNAMETAL INC

ticker: KMT


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes; (2) our security processes; and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; • a third-party risk management process for service providers.

companyName: PARSONS CORP

ticker: PSN


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 9 years of experience in cybersecurity and information technology risk managing, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategy and implementing effective information and cybersecurity programs.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Overseeing our cybersecurity initiatives is our Director of Information Technology who provides invaluable expertise in managing cybersecurity risks and leading our cybersecurity operations. The Director of Information Technology possesses good knowledge in information technology and program management, with contract resources available to help and supplement our security profile. Furthermore, the executive leadership team is active in security operations, overseeing implementation of policies, procedures, and policies related to cybersecurity, technology, and vendors. Both the Audit Committee of the Board as well as executive leadership team will be notified and updated in the event of an incident, with incident updates, mitigation efforts, and impact, as deemed appropriate.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: We utilize a third-party managed security service provider to support our information technology services, which include ongoing support for the management of cyber risks and protection of our information technology infrastructure. Our critical business applications are provided and managed by third party cloud software providers.

companyName: MYOMO, INC.

ticker: MYO


text: Our cybersecurity program is also supported by a cross-functional leadership team that contributes to our information security and privacy programs and practices, as well as identifies and mitigates security and privacy risks. This team includes our CIO, our Chief Privacy Officer, and our Chief Legal Counsel. This team contributes to the development of the company's cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions. This team is also informed about the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.

companyName: Workday, Inc.

ticker: WDAY


text: Our Board and Audit Committee oversee the Company's cybersecurity risk management. Management presents to, and discusses with, the Board the security of our systems and applications. Our Chief Digital Officer ("CDO") and our Information Security Senior Director provide strategic and technical leadership for the Company's cybersecurity program and lead teams across the Company that support the cybersecurity functions. Our CDO has 30 years of experience in IT, including being accountable for IT compliance and security, and previously served as Chief Information Officer for a publicly traded company for 5 years. Our Information Security Senior Director has nearly 30 years of experience in software development and IT, and, for 17 of those years, was responsible for security, compliance and privacy. These executives regularly report to the Chief Executive Officer and Chief Financial Officer with regards to our cybersecurity program and readiness.

companyName: FARO TECHNOLOGIES INC


text: Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk. This includes quarterly reports to the AFRC and SRC on cybersecurity matters. In addition, on an annual basis management prepares and provides to the Board and its committees a corporate risk assessment (CRA), which analyzes and prioritizes enterprise-wide risks (including cybersecurity), highlighting top risks and trends. The annual CRA is an integrated enterprise-wide process. We assess and rank risks based on impact and probability, and we strive to ensure that mitigation measures are appropriately designed, prioritized and resourced. The CRA report is reviewed by the Board committees with responsibility for the risk category relevant to their mandate and is provided to the Board, which coordinates Enbridge's overall risk management approach. Complementary to the CRA, management prepares and provides to the SRC an annual top operational risk report that highlights the highest consequence operational risks across Enbridge and includes further detail on the risks and their treatment. This information helps inform the Board about the potential impact of top operational risks and that appropriate treatments are in place to manage those risks.

companyName: ENBRIDGE INC

ticker: ENB


text: Our Information Security Management System ("ISMS"), the foundation of our security framework, is designed to protect critical assets (including our users' personal information) and assess, identify, manage and mitigate material risks from cybersecurity threats.

companyName: Bumble Inc.

ticker: BMBL


text: In the event of a cybersecurity breach Westwood management notifies our Board as soon as practicable, along with other affected parties including clients, regulatory bodies, third parties and employees, as necessary and required by applicable laws and regulations.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Our CISO provides regular reports to the Audit and Technology Committees, senior management, and relevant stakeholders, for the purpose of keeping them informed on evolving cyber threats, ongoing assessments, and any significant findings. This collaborative approach is intended to support informed decision-making, and timely response to potential risks, safeguarding our critical assets and valuable information.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: As such, we have invested in advanced technologies to identify and manage material cybersecurity risks that could impede our operations. We also engage reputable outsourced service providers to perform key operational functions, ensuring comprehensive protection of shared data and adherence to rigorous cybersecurity protocols.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: To assist with mitigating the risks of cybersecurity threats, periodic cybersecurity training is provided to employees, vendors, and members of the Board. Further, to mitigate risk arising from our relationships with third-parties, key vendors must be SOC 2 compliant, as determined in accordance with the framework developed by the American Institute of Certified Public Accountants, or undertake the Company's enhanced due diligence process. Periodic testing is performed, and all material incidents are reported to the Board.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If we fail to observe such regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties. In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings as necessary.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: The regulatory requirements referenced above recognize that, in the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. We face significant and persistent cybersecurity risks due to: the breadth of geographies, networks, and systems we must defend against cybersecurity attacks; the complexity, technical sophistication, value, and widespread use of our systems, products and processes; the attractiveness of our systems, products and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our customers; the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain significant for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See "Item 1A. – Risk Factors" in this Report for a further discussion of risks related to cybersecurity.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: The Board's Role in Overseeing Cybersecurity Risk The Board of Directors is acutely aware of the critical nature of managing cybersecurity risks. Given the potential significance of cybersecurity threats to our operational integrity and stakeholder confidence, the Board has established robust oversight mechanisms to ensure effective governance in managing our cybersecurity risks. The Board is comprised of directors with diverse backgrounds and expertise, including risk management, technology and finance equipping them to oversee cybersecurity risks effectively. In addition to our scheduled Board meetings, the Board, Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Vice-President of Information Technology ("VPIT") maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The Board conducts an annual review of our cybersecurity program and the effectiveness of our applicable risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of our cybersecurity efforts with our overall risk management framework.

companyName: Orion Group Holdings Inc

ticker: ORN


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our Manager's information technology team and a third-party security firm.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Our SIMT is responsible for preventing, detecting and responding to cybersecurity threats and incidents to the Company, and includes our Chief Executive Officer ("CEO"), SVP Security, Chief Financial Officer ("CFO"), Chief Marketing Officer, Chief Technology Officer ("CTO"), General Counsel, and other subject matter experts. The SIMT works collaboratively across the Company to implement a program designed to protect our information systems and offerings from cybersecurity threats and to promptly identify and respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the SVP, Security and the SIMT monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and report such threats and incidents to our Board and Audit Committee when appropriate.

companyName: PubMatic, Inc.

ticker: PUBM


text: In addition, our Chief Information Officer ("CIO") is responsible for leading the assessment and management of cybersecurity risks. Our CIO, who has held this position since 2021, has over 20 years of experience in information security and holds an MBA from The George B. Delaplaine School of Business and Economics. He was previously CIO at Autolus Therapeutics from 2018 to 2021, and CIO at Sucampo Pharmaceuticals from 2015 to 2018. Prior to that, he was a Director, IT at AstraZeneca from 2008 to 2015. Our CIO regularly receives reports from our Head of Enterprise Technology along with our cybersecurity partners on cybersecurity threats and incidents, as applicable.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: AGM's CISO, in coordination with the AGM Technology and ERM teams, works collaboratively across AGM to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of AGM's cybersecurity risk management program, multidisciplinary teams throughout AGM are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to AGM's audit committee or AGM's Board of Directors, as appropriate.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO, Director of Information Security and Compliance and the CFO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we aim to take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. intend to establish policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We intend to make investments to maintain the security of our data and cybersecurity infrastructure when feasible. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: GHST World Inc.

ticker: GHST


text: Our CISO regularly updates the Technology, Innovation and Cyber Committee and Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, as well as provides regular updates on enterprise cybersecurity incidents and key defenses and mitigation strategies. Our CISO regularly reviews enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation, and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Additionally, our CISO is regularly apprised of enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Following these risk assessments, we develop strategies, policies, standards, and action plans to minimize identified risks and reasonably address identified gaps in existing safeguards. These safeguards include vulnerability management, shift-left secure product design, data encryption, endpoint security, network security, limiting and authorizing access controls, and multi-factor authentication for access to systems with data. We also employ limited system monitoring, logging, and alerting to retain and analyze the security state of our corporate and production infrastructure. As part of our overall risk management system, all employees are required to complete annual cybersecurity training and relevant employees are trained at least annually on applicable safeguards.

companyName: Marqeta, Inc.

ticker: MQ


text: Insurance Coverage. We maintain insurance coverage relating to cybersecurity risks. As described in " Risk Factors — Operational and Model Risk," our insurance may not be sufficient to provide adequate loss coverage in all circumstances.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Our Chief Information Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The process by which our Chief Information Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the review of weekly reports provided by our security team highlighting metrics that relate to potential threats and vulnerabilities as well as status updates on our security initiatives and mitigations. The updates also include a review of emerging cyber risks and other relevant issues identified in our cyber threat intelligence reporting.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Notwithstanding the approach we take to cybersecurity, we may not successfully prevent or mitigate cybersecurity incidents that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be covered or, if covered, fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: As of December 31, 2024, we are not aware of any cybersecurity incidents or identified risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition. There is no guarantee that cybersecurity incidents or risks from cybersecurity incidents may not be material in the future. We maintain cyber insurance coverage to supplement our cybersecurity program given the complex and evolving nature of global cyber threats; however, the insurance may not be sufficient to cover all losses from any breaches of our systems and does not extend to reputational damage or costs incurred to improve or strengthen systems against future threats or activity. Given the increasing sophisticated threats, a disruption from a cybersecurity incident is possible to occur and we are actively taking actions to minimize the likelihood and impact of such incidents. In the event of such an incident, our information security team is continuously engaged to investigate and respond, including isolating systems, performing forensics, containing and eradicating malicious activity, and recovering systems in-line with business expectations and operations.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the Chief Information Officer ("CIO"); reviews our cybersecurity program with the Chief Information Security Officer ("CISO") and the Chief Technology Risk Officer ("CTRO"); and approves our cybersecurity policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: As of the date of this report, other than the foregoing, the Company is no t aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.

companyName: MDWerks, Inc.

ticker: MDWK


text: In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition; however, cybersecurity threats are pervasive. Despite the capabilities, processes and security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, cybersecurity threats are continuously evolving, which may cause cybersecurity threats to be more difficult to detect in the future. See "Risk Factors - Risks Related to Cybersecurity and Information Technology" in Part I, Item 1A of this Form 10-K, for additional information about these and other risks related to cybersecurity and information technology.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: The Company's cybersecurity approach comprises a holistic strategy that includes comprehensive security policies and standards, a robust security awareness and education program, and the implementation of advanced and layered defenses, which is integrated into the Company's overall risk management processes. Our cybersecurity program is aligned with generally accepted principles and practices for securing information systems and data. The program is designed to comply with applicable laws and regulations and is based on many industry best practices. For instance, our cybersecurity program, policies and controls align to those of the National Institute of Standards and Technology's Cybersecurity Framework.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: In our Risk Factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: ENTERPRISE BANCORP INC /MA/


text: The Chief Operating Officer (COO) along with the ISO are responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our COO and ISO have over 25 years of combined related experience. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises and incorporate external resources and advisors as needed. The Program is overseen by the Information Security Committee, Board of Directors, and Compliance Committee.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: Our cybersecurity risk management program aims to identify risks from cybersecurity threats. Our cybersecurity risk management program includes a number of components, including informal self-assessments. Our managed security services provider helps us implement additional security controls, including malware protection and network security tools. We take a risk-based approach to the evaluation of third-party vendors.

companyName: ORAGENICS INC

ticker: OGEN


text: Our cybersecurity risk governance model consists of three lines of defense. Our Chief Technology Officer, supported by the experts in our Technology Leadership Centre and IT and cybersecurity teams at our subsidiaries represent the first line. Our Chief Risk Officer, supported by corporate and subsidiary risk teams, and Risk Committee of the board of directors represent the second line. The third line consists of our Controlling Department, subsidiary internal audit functions and Audit Committee of the board of directors.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Before engaging third-party service providers, the Company carries out a due diligence process. This process is led by the Enterprise Risk Management team and Information Security performs due diligence through the process. Risk assessments are reviewed using Service Organization Controls (SOC) reports, self- attestation questionnaires, and other tools.

companyName: FIRST BANCSHARES INC /MS/


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: Members of our Global IT Leadership Team and appropriate members of Senior Management, supervise efforts to identify, assess, manage and mitigate cybersecurity risks and incidents through various means, including briefings from internal personnel and other information obtained from governmental, public, or private sources, including external consultants engaged by us.

companyName: BERRY GLOBAL GROUP, INC.


text: The Company's cybersecurity protections are based on layered technologies supporting trained employees. Periodic testing of networks, systems, and personnel is performed to validate implementation and effectiveness of controls. Penetration testing, internal and external audit and annual review of policies and response plans are designed to provide a cybersecurity governance framework and independent verification that the Company maintains effective cybersecurity controls. Our information security team regularly monitors our network for anomalous activity and indications that track threat advisories from government security services, such as the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Administration as well as commercial cybersecurity companies and information technology vendors. Automated tools and our third-party Security Operations Center provide alerts to our information security staff regarding potential threats.

companyName: KAMAN Corp


text: Our Cybersecurity Program is aligned with our company strategy and governance processes and is designed to deploy and monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents through various means, including: • A security team responsible for monitoring our infrastructure and managing our cybersecurity risk assessment processes, our security controls, and response to cybersecurity incidents; • Periodic use of outside independent advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests, and to monitor and help identify potential cybersecurity incidents; • An incident response plan that includes procedures for identifying, evaluating and responding to cybersecurity incidents; • A training and awareness communication series addressed to our employees to help them identify potential cybersecurity threats and attacks; • A risk management process using independent third-party service providers that process and store data. We assess the risks from cybersecurity threats posed by such services; and • An AI committee to set Company-wide policy and drive the safe use of AI technologies.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: Our CTO's background includes more than 20 years of experience in the technology domain, with 15 years in the retail industry, leading e-commerce implementations and large scale transformation projects such as adopting cybersecurity best practices. Our VP, IT has more than 30 years of experience implementing security in complex manufacturing and retail environments. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.

companyName: Childrens Place, Inc.

ticker: PLCE


text: On a regular reporting schedule, the CISO provides updates on cybersecurity risk and mitigation efforts to senior leadership, board, and members of the Audit Committee. The Audit Committee, which is tasked with oversight of certain risk issues, including information security risk, receives two to four reports annually from the Company's senior leadership, including the CISO, that includes an information security dashboard and discussion of emerging risks and trends. The Audit Committee then briefs the Board on these matters. Crown Holdings, Inc.

companyName: CROWN HOLDINGS, INC.

ticker: CCK


text: As a function of its oversight role, the Board is responsible for ensuring that material risks are identified and managed appropriately. While the Board of Directors has the ultimate responsibility for risk oversight, the Board of Directors has delegated responsibility for the oversight of data privacy and cybersecurity to the Audit Committee. Senior management of Mullen regularly report to the full Board regarding risks we face, however, there has been no specific reports of risks related to cybersecurity threats that have been discussed with the Board.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: Each quarter, our Chief Information Security Officer ("CISO") presents an overview of the Company's cybersecurity risk landscape to our Enterprise Risk Management Committee, which includes our Executive Leadership Team and Vice President, Internal Audit. In addition, our CISO Council, which includes our CISO and our Chief Information and Digital Officer ("CIDO"), holds meetings with our Executive Leadership Team on a quarterly basis to review these cybersecurity risks and mitigation measures in further detail.

companyName: ENTEGRIS INC

ticker: ENTG


text: We are a blank check company with no business operations. Since our initial public offering ("IPO"), our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We do not engage any assessors, consultants, auditors, or other third parties in connection with any processes for accessing, identifying, and managing material risks from cybersecurity threats. Our board of directors (the "Board") is generally responsible for the oversight of risks from cybersecurity threats, if there are any. If management determined that there was a cybersecurity incident, management would bring the incident to the Board. Management has no formal committee relating to cybersecurity, nor does any personnel have any specific experience relating to cybersecurity. We have not encountered any cybersecurity incidents since our IPO.

companyName: Plum Acquisition Corp. III

ticker: PLMJF


text: Cyber Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our SVP of IS, with support from the information security team, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include leveraging external third parties for security testing.

companyName: Blueprint Medicines Corp


text: In designing our Information Security Program, we refer to established industry frameworks – in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance from the International Organization for Standardization (ISO). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. ISO/IEC 27001 is an international standard developed by the ISO specifically for Information Security, Cybersecurity and Privacy Protection (ISCPP). The ISO/IEC 27001 requirements provide a systematic and risk-based approach to managing sensitive information, ensuring its confidentiality, integrity, and availability. The requirements reflect best practices that organizations can use to guide an information security program. The Company considers these frameworks to be aspirational benchmarks to help inform the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and the Company's cybersecurity risk management and strategy may be insufficient and may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.

companyName: BANNER CORP

ticker: BANR


text: Impact of Cybersecurity Threats We are regularly subject to cybersecurity attacks. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not, to date, materially affected or are reasonably likely to affect Valley, including our business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information, see Item 1A. Risk Factors for further information about these risks.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: Additionally, we invest in firewall protection through Symantec Corporation, which is a provider of Internet-security technology and business-management solutions. Our Symantec firewall protection is designed to monitor and secure our computers from malicious inbound and outbound traffic and to provide an additional layer of protection to our network and data, which helps mitigate the risks of unauthorized access and cybersecurity threats. In addition to relying on the advice and knowledge of our IT Consultant, our IT Consultant maintains our firewall protection through Symantec.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: Rithm's dedicated cybersecurity personnel supervise and monitor our controls, technologies, systems and other processes utilized to mitigate any data loss, theft, exploitation, unauthorized access or other vulnerabilities that may affect our information or data. Specifically, Rithm's cybersecurity program consists of incident response procedures, information security and vendor management due diligence, as well as participation in industry consortiums, ongoing monitoring, internal and independent testing of information systems and continuous employee education and simulations. Rithm's independent testing includes both (i) periodic testing and evaluations performed by its internal audit team and (ii) annual network penetration testing conducted through independent third parties. Rithm's processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into its overall risk management system and processes. As part of these processes, Rithm monitors the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Developing a mature cybersecurity culture which ensures that all employees understand they are stakeholders in cybersecurity. Employees not only engage with cybersecurity controls but must be proactive in risk mitigation and remediation.

companyName: Zedge, Inc.

ticker: ZDGE


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Vice President, Information Technology. Our Vice President, Information Technology leverages his over 30 years of experience as CIO/CTO/CISO in companies such as Therakos, Healthtronics IT Solutions, Endo Pharmaceuticals, Johnson and Johnson, and Animas. Our Vice President, Information Technology is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The Vice President, Information Technology is a member of our senior management team and provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.

companyName: OptiNose, Inc.


text: An annual cybersecurity risk assessment as part of our Enterprise Risk Management (ERM) program, which reviews and evaluates the potential impact and likelihood of various cyber risks and defines a framework for mitigating measures and residual risk.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: We provide our Board of Directors with a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the President also will report to the Board of Directors on various metrics on threat management, incident response and recovery planning, along with industry benchmarks.

companyName: EACO CORP

ticker: EACO


text: As part of our cybersecurity risk management program, we will work with our subsidiaries to develop a cyber training curriculum for their employees. While some have already implemented their programs, others are in the developmental phase. This training may encompass topics such as phishing, cybersecurity awareness, and email security best practices.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: We utilize our risk management processes to prioritize our annual Cyber workplans, including monitoring and internal audit and external assurance reviews, such as our SOC 2, Type 2 Independent Service Auditor's Report on controls relevant to security, availability, and confidentiality, and our participation in the TRUSTe Data Privacy Framework verification program. We have engaged an industry-leading cybersecurity firm to conduct a cyber threat profile that addresses not only our immediate environment, but also the broader cyber threat landscape and threat actors that may be targeting our industry or the geographic locations in which we operate. We actively participate in several global and regional trade and policy associations, think tanks, and professional organizations related to cybersecurity, information policy, privacy, and artificial intelligence to maintain timely insights on rapidly evolving cybersecurity and data risks affecting our business.

companyName: Dun & Bradstreet Holdings, Inc.


text: Our Vice President, Information Systems and Technology meets regularly with the Audit Committee to review our information technology systems and discuss key cybersecurity risks. Additionally, the Director, Internal Audit and Chief Financial Officer presents an overview of our global enterprise risk management program, including cybersecurity risks, to the Audit Committee, which is subsequently reported to the Board of Directors.

companyName: NORDSON CORP

ticker: NDSN


text: The Company leverages both internal resources and third-party suppliers as needed for technology assets, systems, and development to support its information technology security program. The Company uses third-party rather than internal resources when the Company determines that using a third-party better meets the needs of the business. Before contracting with a third-party supplier, the Company determines if the vended resource is compliant with Company policies. Formal approval for a third-party supplier is obtained through the appropriate Company processes according to the type of resource provided by the third-party supplier.

companyName: Finance of America Companies Inc.

ticker: FOA


text: The day-to-day management of cybersecurity is the responsibility of our Senior Vice President, Chief Information Officer, who oversees our Information Technology ("IT") team. The Chief Information Officer reports directly to the Chief Financial Officer. Our Senior Vice President, Chief Information Officer ("CIO") has served in this role for over eight years, and has more than 20 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations, and developing cybersecurity strategy. Together with his IT team and external consultants, our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management processes described below, including the operation of our cybersecurity incident response plan.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: These processes include analyzing potential risks from the use of IT components and our use of third-party service providers, engaging third-party service providers to identify potential cybersecurity threats, conducting penetration tests to detect vulnerabilities, conducting employee trainings, monitoring network activities, ensuring patches are applied timely, analyzing and reacting to threat intelligence, and layering controls to prevent unauthorized access to IT assets. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. See "Risk Factors – Information system failures, cyber incidents or breaches in security could adversely affect us" for further information on how cybersecurity threats could harm our business, financial condition, and results of operations.

companyName: Excelerate Energy, Inc.

ticker: EE


text: The Information Security Program is based on regulation and guidance established by agencies, including but not limited to, the Federal Financial Institutions Counsel ("FFIEC") and the Federal Deposit Insurance Corporation ("FDIC"). The Information Security Program begins with risk assessment. At least annually, the Company's Information Security team completes an information security risk assessment in accordance with regulatory guidance. While cyber threats are included in the overall information security risk assessment, a targeted cybersecurity risk assessment is also completed, utilizing the FFIEC Cybersecurity Assessment Tool ("FFIEC CAT"). The FFIEC CAT specifically assesses the maturity and effectiveness of the Bank's cybersecurity programs. In addition to the FFIEC CAT, the Bank partners with internal and external auditors to conduct various assessments throughout the year to identify, manage, and mitigate cybersecurity risks. The assessments conducted include but are not limited to: vulnerability assessments, penetration testing, social engineering, and onsite security assessments. Risk assessments consider size and complexity, are formally documented, and adapt to changes in the technology and organizational environment. Management and the Board of Directors use risk assessment data to make informed risk management decisions based on a full understanding of the risks. Management and the Board also consider the results of these assessments when overseeing operations. A strong, high-level risk assessment process provides the foundation for more detailed assessments within the functional risk management areas, as well as improves policy and internal control decisions across the organization.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Company maintains a Cybersecurity Incident Response Plan (the "CSIRP"), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Cambridge Trust Company's assets. The CSIRP outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and an escalation framework, including processes for informing legal counsel and the Board of Directors of material cybersecurity incidents. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO, the Director of Information Technology as well as the Director of Information Security primarily lead these efforts. The CIO, who reports directly to CEO, is responsible for the oversight of the Company's entire information technology operations. The Director of Information Security reports directly to the Risk Committee and has responsibility for leadership of the Company's cybersecurity program.

companyName: CAMBRIDGE BANCORP


text: We regularly monitor, defend against, and respond to cyber and other security threats to our networks and other information security incidents. Despite our information security efforts, our facilities, systems, servers, platforms and data, as well as those of our third-party cloud and other service providers and Tablo's two-way wireless communication system, may be vulnerable to privacy and information security incidents and may be breached due to the actions of outside parties, employee error or misconduct, malfeasance, or a combination of these and, as a result, an unauthorized party may obtain access to our data or the personal information maintained by us or on our behalf. These include data breaches, viruses or other malicious code, exploitation of known or unknown vulnerabilities, coordinated attacks, data loss, phishing attacks, ransomware, denial of service attacks, insider threats or other security or IT incidents caused by threat actors, technological vulnerabilities, or human error. Additionally, outside parties may attempt to fraudulently induce employees to disclose sensitive information to gain access to the data and personal information we maintain. As of the date of this Annual Report, we are not aware of any material adverse impact to our business or operations from cybersecurity threats or incidents. We do, however, recognize that the cybersecurity landscape evolves rapidly and that we are not immune to such incidents. If we, or any of our third-party service providers, fail to comply with laws requiring the protection of sensitive personal information, or fail to safeguard and defend personal information or other critical data assets or IT systems, or if our incident response, containment or mitigation measures are inadequate in the face of a particular data security incident, we may face significant business interruptions, incur reputational damage, and be subject to regulatory enforcement and fines as well as private civil actions. We may be required to expend significant resources in the response, containment, mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations. In addition, to the extent that our cloud and other service providers experience security breaches that result in the unauthorized or improper use of confidential information, employee information or personal information, we may not be indemnified for any losses resulting from such breaches. If we are unable to prevent or mitigate the impact of such security breaches or other cyber events that impact our operations, our ability to attract and retain new customers, patients, and other partners could be harmed, as they may be reluctant to entrust us with their data, and we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business or other adverse consequences.

companyName: Outset Medical, Inc.

ticker: OM


text: In order to respond to the threat of security breaches and cyber-attacks, we have developed an information security program designed to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. This information security program provides for the coordination of various corporate functions and governance groups, including global technology, risk, legal, compliance and corporate audit, and serves as a framework for the execution of responsibilities across businesses and operational roles. Among other things, the information security program establishes security standards for our technological resources and includes training for employees, contractors and third parties. Employees with access to our Company's systems are subject to comprehensive annual training on responsible information security, data security, and cybersecurity practices and how to protect data against cyber threats.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: The Bank actively monitors cybersecurity developments and is involved in various industry groups and cybersecurity professional organizations. While the Bank continues to make investments in the cybersecurity program, including personnel, technologies and training of Bank personnel, there can be no assurance that these systems or their expected functionality will be implemented, maintained, or expanded effectively; nor can security measures completely eliminate the possibility of a cybersecurity breach.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our audit committee oversees our ERM program, including the management of risks arising from cybersecurity threats, and are supported by the Information Security Steering Committee (the "ISSC"), the Cybersecurity Incident Response Team (the "CSIRT"), and our information security ("InfoSec") team. Our audit committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The ISSC oversees the frameworks the InfoSec team uses to benchmark the controls and maturity of our security program. The ISSC is a cross-functional group that has oversight and input into the roadmap and projects reflecting the maturity benchmarks of the frameworks upon which we base our program, and receives monthly updates as to the status of the roadmap projects. The CSIRT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the ISSC, who then reports up to our audit committee when appropriate. The audit committee is responsible for escalating cybersecurity threats and incidents to the Board if and when appropriate. We have established frameworks so that our ISSC, audit committee, and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Redfin Corp


text: Our CIO and CISO provide regular reports to management regarding risks from cybersecurity threats and the prevention, detection, mitigation and remediation of cybersecurity incidents. Within our information technology organization, our CISO and other key members of our information security team provide regular reports to our CIO.

companyName: MKS INC

ticker: MKSI


text: Our management and senior IT team, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Global Head of Technology, and SVP, People & Culture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global Head of Technology's experience includes over 20 years in system engineering, risk management, data privacy and compliance monitoring. We also engage an external Data Protection Officer to monitor data collection and security in the European Union.

companyName: Funko, Inc.

ticker: FNKO


text: In 2022, we expanded our Security Champions Program to identify a resource on our various application teams who proactively operationalizes security best practices on their team. This program helps to ensure that security measures are built into our programs from development to deployment. We have over 100 security champions who can collaboratively advocate security tools throughout the lifecycle of our applications.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: The Audit Committee and the full board of directors periodically participate in discussions with management and amongst themselves regarding cybersecurity risks. As of 2023 the Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap.

companyName: Nuwellis, Inc.

ticker: NUWE


text: Terminated employees must return all records containing personal information, in any form, that may at the time of such termination be in the former employee's possession.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—If our information technology systems are breached or there is otherwise unauthorized disclosure of or access to customer data, our data, or our platform, our platform may be perceived as insecure, we may lose customers or fail to attract new customers, our reputation and brand may be harmed, and we may incur significant liabilities."

companyName: Amplitude, Inc.

ticker: AMPL


text: We have implemented technical solutions designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware and endpoint protection functionality, and access and identity controls. We regularly evaluate, monitor, and improve these solutions.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a dedicated cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we operate a Cyber Fusion Center ("CFC") to monitor both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.

companyName: Baker Hughes Co

ticker: BKR


text: Aspects of the information systems of our Homebuilding operations and our Financial Services operations are separate and distinct, and, prior to the third quarter of 2024, each operation had a separate CIO and CISO. In August of 2024, our information technology operations were centralized under a single CIO and a single CISO, each with enterprise-wide responsibilities. Our CISO reports to our CIO and is responsible for managing the information security team and working to ensure the team is assessing and managing cybersecurity risks in accordance with our processes and procedures. Our CIO has over 30 years' experience managing enterprise information technology systems. Our CISO has over 25 years' experience working in information technology and cybersecurity roles and is a certified information security manager as certified by the Information Systems Audit and Control Association (ISACA). Pursuant to our Cybersecurity Incident Response Plan ("CIRP"), when a cybersecurity event has been identified through our detection processes, it is assessed in order to determine whether the event is a cybersecurity incident. Our CIRP designates the primary manager of a cybersecurity incident, describes the parties who should be informed about the incident, and outlines the processes for containment, eradication, recovery, and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, members of our senior management team and Board of Directors are notified of an incident and kept informed of the mitigation and remediation of the incident. We are not aware of any material cybersecurity incidents in the last three years.

companyName: PULTEGROUP INC/MI/

ticker: PHM


text: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Our cybersecurity policies and procedures include incident response plans which guide our employees, senior management, the Audit Committee and the Board on our response to cybersecurity incidents, including escalation processes, as appropriate.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: The Company's internal Incident Response Policy sets forth specific protocols for cyber or data incident identification, detection, response and recovery. This process includes the assembly of a response team consisting of internal and external technical and legal experts immediately upon the event of a cyberattack or incident. The Company reviews and updates this process regularly, including by engaging in tabletop exercises to simulate cybersecurity and data breach incidents. The Company maintains global cybersecurity insurance coverage that is reviewed annually for adequacy against operations and information systems.

companyName: IDEX CORP /DE/

ticker: IEX


text: Our management team views cybersecurity risk management as an important strategic topic. Our cybersecurity strategy utilizes the cybersecurity framework developed by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF is a voluntary framework of practices to identify, protect, detect, respond to, and recover from cybersecurity risks. Using the NIST CSF does not mean that we meet any particular technical standards or certifications, but rather that we use the NIST CSF to help us identify, assess, and manage cybersecurity risks relevant to our business. Using the NIST CSF, we form our cybersecurity plans and prioritize our activities using a risk-based approach which begins with the identification and evaluation of cybersecurity risks and threats that could disrupt our operations, safety procedures and regulatory compliance. Cybersecurity risks and related mitigation efforts are prioritized based on their potential impact severity, likelihood and vulnerability. Risk mitigation strategies include the application of cybersecurity policies and procedures, implementation of technology-based tools and controls, as well as employee training, education, and awareness initiatives. Our cybersecurity risk management includes ongoing monitoring of networks and systems for potential signs of suspicious activity. We track key performance indicators and cybersecurity metrics to evaluate the effectiveness of our cybersecurity safeguards and practices. We have established an incident response plan designed to promptly contain and remediate cybersecurity incidents.

companyName: Air Transport Services Group, Inc.


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. Our incident response plans coordinate the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs periodically.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or patients, and violation of data privacy or security laws. We employ multiple levels of protection designed to minimize the risks associated with cybersecurity, ransomware and data breaches, including firewalls, data loss prevention, email filtering for ransomware, proactive threat-hunting, cloud-based backups, multifactor authentication, encryption software, intrusion testing and SIEM networking monitoring to ensure the integrity of our data and systems. In addition, we maintain recovery and other business continuity procedures.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain, our CROs or those who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company's plan and to facilitate group discussions regarding the effectiveness of the Company's cybersecurity incident response strategies and tactics. We use a third-party SEIM to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents. Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as the FS-ISAC, InfraGard, InspireCIO and SANS Internet Storm Center cybersecurity collaboration organizations.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK