text: Acknowledging the dynamic and complex landscape of cybersecurity threats, we engage with various external specialists to evaluate and strengthen our cybersecurity risk management practices. Such engagements differ across our subsidiaries, as they are tailored to the specific risk profile of each subsidiary, ensuring that each entity works with experts most suited to their specific cybersecurity needs. These engagements, which may encompass regular audits, threat assessments, vulnerability testing, and consultations on security enhancements, help us tap into specialized knowledge and stay aligned with industry best practices. Significant results of these assessments are reported to the audit committee and, when necessary, the board of directors, leading to adjustments in our cybersecurity approach based on their findings to ensure our defenses remain robust and effective.

companyName: ARGAN INC

ticker: AGX


text: As of June 30, 2024, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" -"A cyber-attack or security breach could result in the compromise of our facilities, confidential data or critical data systems and give rise to potential harm to patients, remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, common law or other theories, subject us to litigation and Federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business" in this Annual Report.

companyName: SUNLINK HEALTH SYSTEMS INC

secItem: Item 1C


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," "We depend on our information technology systems and those of our third-party collaborators, service providers, contractors or consultants. Our internal computer systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, disruptions, or incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations" in this Annual Report on Form 10-K.

companyName: 89bio, Inc.


text: Our CIO receives reports on cybersecurity threats from experienced information security personnel and third-party consultants and resources, and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. Additionally, we have a set of Company-wide policies and procedures regarding cybersecurity matters, which include an Information Security best practices intranet site, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to email usage, remote network access, internet usage, passphrase usage, information technology acceptable use, data governance and privacy, and information security. These policies go through an internal review process and are approved by appropriate members of management. We periodically conduct penetration and vulnerability testing, data recovery testing, and security audits. We also conduct regular employee training on cybersecurity. With respect to our incident response, we have adopted a plan that applies in the event of a cybersecurity threat or incident to provide a framework for responding to such threats and incidents. Our plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. We also employ processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: NPK International Inc.

ticker: NPKI


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • We conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K. Disaster Recovery is tested using various methods such as recovery exercises to simulate a response to a cybersecurity incident, and we use the findings to improve our security, processes, procedures and technologies. • Regular cybersecurity training programs are in place for employees, management and directors. In addition, we conduct annual customer data handling and use requirements training for all employees. • We compare our processes to standards set by the NIST. • Incident handling incorporates the NIST incident handling framework to develop our cybersecurity response procedures and to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident. • We routinely identify and filter out potential threats through threat intelligence processes, attack signatures, and geographic IP filtering. • We closely monitor emerging data protection laws such as GDPR and carefully implement changes to our processes when required for compliance. • We conduct regular phishing email simulations for all employees to enhance awareness and responsiveness to such possible threats. • Through policy, practice and contract (as applicable), we require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care. • We maintain cybersecurity insurance coverage.

companyName: DURECT CORP


text: We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by our assessments, audits and reviews. Such processes include (i) procedural and technical safeguards, (ii) response plans, (iii) annual tests on our systems, (iv) incident simulations and (v) routine review of our cybersecurity policies and procedures to identify risks and improve our practices. We engage certain external cybersecurity firms to enhance our cybersecurity oversight. We include confidentiality provisions in all contracts with third-party service providers, and data protection provisions in certain contracts with third-party service providers where applicable, to help protect us and our employees and patients from any related vulnerabilities.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: Corporate Governance Our information security program is managed by a dedicated Vice President of Information Technology, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Vice President of Information Technology also provides quarterly reports to the Audit Committee of our Board of Directors (the "Audit Committee"). The Vice President of Information Technology also provides reports to our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the current threat landscape. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported quarterly to the Audit Committee and senior management. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Thryv Holdings, Inc.

ticker: THRY


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to help manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a corporate security incident response plan, a vulnerability management policy, a vendor risk management program, incident detection and response processes, IT systems disaster recovery procedures, risk assessments, reasonable implementation of security controls in accordance with applicable security standards/certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer. We also rely on third-party vendor backup/restore, disaster recovery and business continuity procedures as stated in the respective SOC 1 and SOC 2 reports if provided by such vendors as they pertain to certain of our managed services.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Cybersecurity risks with long-term resolutions are evaluated and added to our risk register, which is reviewed and updated by a corporate committee quarterly. This corporate committee, consisting of senior executives and support staff, meets regularly to assess enterprise, including cybersecurity, and energy commodity risks. Our Chief Administrative Officer/CHRO manages our information technology department and has executive oversight of our cybersecurity program. Our Chief Information and Technology Officer and Chief Information Security Officer that report directly or indirectly to our Chief Administrative Officer/CHRO are responsible for implementation of our cybersecurity program. As of December 31, 2024, o ur Chief Information and Technology Officer and Chief Information Security Officer maintained multiple cyber-related certifications from nationally recognized organizations.

companyName: Tri-State Generation & Transmission Association, Inc.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the International Organization for Standardization ("ISO") 27001 Framework and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including the ISO 27001 Framework, as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: FuboTV Inc.

ticker: FUBO


text: The Audit Committee of the Board is charged with overseeing our cybersecurity risk management program. The CRC Chair and the CISO provide the Audit Committee with regular updates. These updates cover the overall status of the Company's cybersecurity program, as well as developments and potential new risks and trends. In the event of a significant cybersecurity threat or incident, the CRC would escalate communication frequency and intensity with the Audit Committee, Board, and the Company's Executive Committee (discussed below).

companyName: REGENCY CENTERS LP


text: Company senior leadership has top-level responsibility for management of information security risk. The Company has established a dedicated, globally focused cybersecurity team led by its Chief Information Security Officer (CISO), who brings over 20 years of experience in the field of cybersecurity and IT operations. The CISO is responsible for overseeing the entire global cybersecurity program, which encompasses cyber risk management, operations, strategic planning, and compliance with cybersecurity policies and regulations. Crown's cybersecurity team maintains collaboration with other cross functional teams to assess and manage cybersecurity risks. This approach enables the Company to align cybersecurity efforts with broader business objectives and respond to emerging threats. Additionally, Crown's Board of Directors, along with the Crown Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, and General Counsel oversee the identification, assessment, and management of cybersecurity risks.

companyName: CROWN HOLDINGS, INC.

ticker: CCK


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, property management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.

companyName: MACERICH CO

ticker: MAC


text: Integration with ERM Processes The Company maintains an ERM program with a governance structure that is designed to identify, assess, prioritize, and mitigate risks across the organization. The ERM Executive Committee, comprised of the Company's senior leadership team, has the ultimate responsibility for managing the identification of the key risks facing the Company and meets regularly to discuss the Company's approach to mitigating those risks. Through the ERM process, cybersecurity has been identified as an important risk facing the Company. As a result, the cybersecurity program is an important component of the Company's ERM processes. In addition to discussing the cybersecurity program at ERM Executive Committee meetings, members of the ERM Executive Committee participate in the cybersecurity incident response process. This process includes a governance model and procedures for identifying, categorizing, containing, and responding to cybersecurity incidents. As a component of the cybersecurity incident response process, the Company periodically conducts attack simulations and exercises and has used third parties to support this work. The Company also maintains business continuity and disaster recovery plans to prepare for potential technology disruptions and to better position the Company to recover from any cybersecurity incident. The Company's Disclosure Committee also includes members of the ERM Executive Committee, helping to ensure timely analysis of potential disclosure obligations relating to cybersecurity events.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Director of IT, HR & Administration, and our Chief Financial Officer, Treasurer and Secretary (CFO).

companyName: Y-mAbs Therapeutics, Inc.


text: Our Senior Vice President of Technology and Chief Technology Officer, in coordination with other members of AIR Operating Partnership's management, is responsible for leading the assessment and management of cybersecurity threats. AIR Operating Partnership has implemented a governance program for its cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents, as well as identifying responsible teammates to facilitate the implementation of cybersecurity priorities. These teammates report regularly to senior management on risk identification, safeguards, and mitigation steps. AIR Operating Partnership has developed and implemented policies to identify and mitigate cybersecurity risks and provides training to teammates at onboarding and annually thereafter. Updates are communicated to all teammates, and actionable guidance is provided when new risks arise. Our Board of Directors (i.e., the Board of Directors of AIR, with AIR as the sole member of the sole member of the General Partner) will receive updates on the AIR Operating Partnership's cybersecurity profile risk assessment and technology environment and the broader technology landscape as and when appropriate.

companyName: Apartment Income REIT, L.P.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon. For further discussion of these risks, see "Risk Factors—Risks Related to Our Intellectual Property and Technology—Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."

companyName: WK Kellogg Co


text: Our CISO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CISO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other Pfizer colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.

companyName: PFIZER INC

ticker: PFE


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants we engage; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Callaway Golf Co

ticker: CALY


text: Board of Directors Our board of directors exercises its oversight role through its Audit Committee, which has primary responsibility for overseeing risks related to cybersecurity matters. Our Audit Committee regularly receives reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as customers, service providers, and suppliers, and the current threat environment. These reports and presentations are provided by senior personnel with responsibility for IT security, including our Security, Risk and Compliance Director ( SRC Director) and our Chief Information Officer. Our board, through its interactions with our Audit Committee chair and our SRC Director and Chief Information Officer receives periodic updates regarding cybersecurity risk matters and prompt and timely information regarding significant cybersecurity incidents and our response to such incidents.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: We engage external consultants and computer security firms to enhance our cybersecurity oversight. Included within our cybersecurity program is the use of computer security firms to provide annual training to our employees to help them identify and report cybersecurity threats. While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, we have not experienced any material cybersecurity incidents for the year ended December 31, 2023. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: YIELD10 BIOSCIENCE, INC.


text: As of December 31, 2024, cybersecurity risks have not materially affected our business strategy, results of operations, or financial condition.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: One of our strategies to mitigate cybersecurity risks is to utilize expert third-party software-as-a-service, human resource, and clinical providers to store and manage personally identifiable information, rather than maintaining and processing such data within our enterprise. We select reliable, reputable service providers that maintain cybersecurity programs of their own and other measures to comply with privacy and security requirements, including when applicable Canada's Personal Information Protection and Electronic Document Act (PIPEDA) and the U.S. Health Insurance Portability and Accountability Act (HIPAA). Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, we may also contractually impose certain security obligations on the provider.

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: The safeguarding of our digital and physical assets against cybersecurity threats is a cornerstone of our operational integrity and reliability. Recognizing the sophisticated and ever-evolving nature of cyber threats, we have instituted a robust cybersecurity framework that not only aims to protect our systems and data but also ensures the resilience of our operations against potential cyber-attacks.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Information security risks have been deemed by our Board to be of critical importance to Equinix, and thus the Nominating and Governance Committee receives quarterly updates on cybersecurity and the full Board receives a briefing on cybersecurity at least annually. These briefings are conducted by our CISO and members of the InfoSec leadership team, and cover topics such as key risk indicators, the status of strategic programs, operational updates and key initiatives, past and future action plans, and InfoSec functional updates.

companyName: EQUINIX INC

ticker: EQIX


text: As discussed in more detail above under the heading, "Governance," our board of directors' oversight of cybersecurity risk management is supported by the Cybersecurity Committee, which regularly interacts with executives with responsibility for cybersecurity, our Chief Executive Officer, Chief Technology Officer and President, Chief Financial Officer, Chief Operating Officer/General Counsel, our CISO, and other members of management. Our CISO is primarily responsible for our cybersecurity risk management program and partners with our legal team on data privacy matters at the management level. Our CISO, Dr. Carl Windsor, has over 25 years of experience in various technology and cybersecurity leadership positions, including over 18 years at our company driving product security and strategy and reports to the board Cybersecurity Committee. The CISO's leadership team members are all seasoned information security professionals, covering a wide range of security disciplines, who have worked at some of the largest well-known brand names and are experts in their fields. Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status.

companyName: Fortinet, Inc.

ticker: FTNT


text: The cybersecurity program at Cars Commerce is part of our enterprise risk management program. At Cars Commerce, we believe cybersecurity risk management is of the utmost importance. As a result, Cars Commerce has implemented an information security management system (the "ISMS") designed to protect our infrastructure from potential threats and is designed to allow us to assess, identify and manage material risks from cybersecurity threats as described in more detail below. The ISMS supports the security safeguards that are designed to protect the confidentiality, integrity, availability, and contractual compliance of the Cars.com Inc. (d/b/a Cars Commerce, Inc.) entities, which include Cars.com LLC, Accu-Trade, LLC, CreditIQ, LLC, DealerRater.com LLC and Dealer Inspire Inc. which is inclusive of the In-Market Video and NewCars brands. In addition, we engage with external resources to contribute to, and provide independent evaluation of, our existing cybersecurity practices. As a result, in 2023, Cars Commerce engaged an independent auditor to conduct an audit of the ISMS. As a result of the independent audit, in December 2023, Cars Commerce completed the certification to meet International Organization for Standardization 27001 requirements for the above-stated entities. In October 2023, Cars Commerce, through its subsidiary, completed the acquisition of D2C Media Inc. ("D2C Media"). During the due diligence, Cars Commerce completed a robust evaluation of its cybersecurity risk management process and plans to integrate D2C Media into the ISO Certification Process.

companyName: Cars.com Inc.

ticker: CARS


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to Endeavor's Cybersecurity Executive Steering Committee, which includes Endeavor's Chief Administrative Officer, General Counsel, Chief Financial Officer, Chief Accounting Officer, Chief Compliance Officer, Chief Information Officer, Corporate Communications, Corporate Secretary, Senior Vice President ("SVP"), Internal Audit, SVP, Privacy & Cybersecurity, SVP, Cybersecurity, and SVP, Head of Corporate Security. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.

companyName: Endeavor Group Holdings, Inc.


text: a third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents; engagement with external service providers to evaluate, enhance, or support our security measures;

companyName: Onconetix, Inc.

ticker: ONCO


text: Our Board devotes significant time and attention to our cybersecurity and information technology risks. Our Board executes its cybersecurity risk oversight as a whole and by delegating responsibility to our Audit Committee. Our CISO and Chief Information Officer present to our Board annually and to our Audit Committee at least twice each year on a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments and management's ongoing efforts to prevent, detect and address internal and external cybersecurity threats specific to us. These briefings also include reporting on periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented in an IT Risk Dashboard, which is shared with our Audit Committee for awareness several times each year. Our full Board also has access to these materials. Finally, we provide periodic cybersecurity training to our Audit Committee and Board to further cybersecurity awareness and risk oversight.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: The framework for our overall process for managing risk encompasses the management of risks posed by cybersecurity threats. Management's role, responsibilities and processes for identifying, assessing, monitoring, reporting and managing risks, which includes cybersecurity risks, is discussed further in Item 1. "Business — Risk Management." As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Corporation's Board of Directors has delegated primary responsibility for oversight of cybersecurity risk to its Risk and Credit Policy Committee, with its Audit Committee also considering cyber risk as part of financial oversight. The Information Security Department provides an annual update to the Risk and Credit Policy Committee of the Board on the state of the Information Security Program. This cybersecurity "deep dive" includes review of key security incidents and review of the Information Security Policy, Information Security Program, the Incident Response Plan, and the Acceptable Use Policy. The Board is then presented with the update by the Chair of the Risk and Credit Policy Committee.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: The Information Security Team leverages a variety of processes and controls to stay informed of and manage cybersecurity risk. It partners with a variety of business units, including our engineering, legal, compliance, internal audit, technology, and product teams to identify and control emerging risks. We also from time to time engage third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing risk assessments based on industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our Information Governance Committee, whose members include representatives from the Information Security Team and key senior leaders from relevant stakeholder groups, meets quarterly to review and discuss, among other topics, the implementation and management of these cybersecurity processes. The Information Security Team additionally has adopted security control principles based on ISO 27002:2022 and uses various formalized incident management and monitoring standards and incident response plans and playbooks, which define immediate steps in the event of a cybersecurity incident, roles and responsibilities, as well as materiality criteria to allow for efficient and effective incident management. This includes a third-party vendor management procedure, under which we conduct vendor risk assessments and, when appropriate, ongoing threat monitoring. In implementing these policies, the Information Security Team utilizes a layered approach, aided by industry leading technology, to detect, respond, and prevent cybersecurity risks and exposures.

companyName: CARVANA CO.

ticker: CVNA


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader technology environment; • the use of external service providers with specific expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management, as well as periodic experiential learning through "phishing simulations"; • segmentation of, and back-ups for, certain of our sensitive systems and data; • third-party cyber risk management process for vendors including, among other things, a security assessment, contracting program, and ongoing monitoring for vendors based on their risk profile; • physical security around our sensitive infrastructure and cybersystems.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Our cybersecurity risk management program is led by our Director of Information Technology, who is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination, and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: McKESSON CORPORATION We have implemented cybersecurity controls designed to protect our systems, data and operations from cybersecurity risks. Enterprise-wide cybersecurity and privacy training continue to serve an important role in risk reduction and protection of the Company and our stakeholders. We require periodic access-based and role-based privacy and cybersecurity training, which is updated to reflect changes in the threat environment, audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns. Our Cybersecurity Incident Response Plan ("Response Plan") provides a framework for responding to cybersecurity incidents. The Response Plan governs activities such as preparation, detection, coordination, eradication, recovery, and appropriate escalations to the Company's senior management, disclosure committee, Board, and relevant Board committees. The Response Plan is routinely tested, reviewed and updated as appropriate under the leadership of our Chief Information Officer and Chief Technology Officer ("CIO/CTO") with the assistance of the Company's Chief Information Security Officer ("CISO").

companyName: MCKESSON CORP

ticker: MCK


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and meets with the IOC, without other members of management present, during each meeting's executive session. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity, risk and compliance team, who are tasked with these responsibilities on a day-to-day basis.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: The audit committee, pursuant to its charter, is responsible for overseeing risk management processes related to cybersecurity. The audit committee assists the board in fulfilling its risk oversight responsibilities by periodically reviewing our enterprise risk management program. Through its meetings with management, including the compliance and information technology functions, the audit committee reviews and discusses significant areas of our business and summarizes the key areas of risk and relevant mitigating factors for the board.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: We are executing on a multi-year roadmap to, among other things, further improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. We are also required to maintain strong cyber defense protocols in the states where we are authorized or licensed to write business. A number of states where our insurance companies are domiciled, including Connecticut, have adopted the NAIC Insurance Data Security Model Law. Our legal team monitors the status of new cybersecurity regulations, including notification requirements.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: While the Company experiences minor data and cybersecurity incidents from time to time, to the Company's knowledge, the risks posed by cybersecurity threats (including from such prior incidents) have not materially affected and are not reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. A successful cybersecurity attack may expose the Company and the Company's employees, customers, dealers, and suppliers to misuse of information or systems, the compromising of confidential information, manipulation or destruction of data, production downtimes, and operations disruptions. For example, the Company frequently operates in potentially dangerous environments with heavy machinery, such as steel mills, where a cybersecurity incident could cause a machinery malfunction that results in disruptions to operations or serious injury to employees. For more information, see risk factor related to the imposed risks from increased information technology security threats and computer crime under Strategic and Operational Risks in Part I. Item 1A. Risk Factors.

companyName: ENVIRI Corp

ticker: NVRI


text: While our Board of Directors (the "Board") has overall responsibility for risk oversight, the Audit Committee of the Board (the "Audit Committee") oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, monitoring, reporting and, where appropriate, providing recommendations to the Board regarding compliance with our internal policies and its progress in remedying any material deficiencies, including those related to our security policies, including the physical safeguarding of corporate assets and security of our networks and information systems. The Audit Committee receives quarterly updates regarding the cybersecurity program, including top threats and risks, and updates on the cybersecurity roadmap.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: We have not formally developed and implemented a cybersecurity risk management program. However, we generally follow operating practices designed to help prevent cybersecurity risk to protect the confidentiality, integrity, and availability of our data and systems and any personal health information ("PHI") that we maintain.

companyName: INVO Fertility, Inc.

ticker: IVF


text: Our business is highly dependent on information technology. In the ordinary course of our business, we store sensitive data, including our proprietary business information and that of our business partners, and non-public personally identifiable information of mortgage borrowers, on our networks. The secure maintenance and transmission of this information is critical to our operations. Computer malware, viruses, ransomware and phishing attacks remain widespread and are increasingly sophisticated. We are frequently the target of attempted cyber threats. We continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. Despite these security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations or trading activities or damage to our reputation, all of which could have a material adverse effect on our business, results of operations and financial condition.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition during the fiscal year ended December 31, 2023, they may in the future, and we continue to closely monitor risks from cybersecurity threats. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected the Company, including our business strategy, results of operations, or financial condition, in the prior fiscal period. For additional information on the impact of cybersecurity matters on us, see Item 1A, "Risk Factors—We face cybersecurity risks, which could result in a loss of customers, cause disclosure of confidential information, adversely affect our operations, cause reputational damage and create significant legal and financial exposure."

companyName: Bancorp, Inc.

ticker: TBBK


text: Based on the resolution of Honda's Board of Directors, the Board of Directors has appointed the Senior Managing Executive Officer and Chief Officer for Automobile Operations as Honda's Risk Management Officer, who monitors and supervises the response status of significant risks, including risks from cybersecurity threats.

companyName: AMERICAN HONDA FINANCE CORP


text: The Company has a written incident response plan ("IRP") and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Certain employees, including those with access to Company-provided e-mail accounts, undergo security awareness training when hired and annually.

companyName: LA-Z-BOY INC

ticker: LZB


text: We engage various third parties to assess, test, or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including but not limited to: consultants who assist with assessing risks, support our PCI compliance assessments, assess our systems alignment with the NIST Cybersecurity Framework, and test and/or scan for vulnerabilities.

companyName: FARMER BROTHERS CO

ticker: FARM


text: Our board-level Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Risk Committee actively engages with our risk group and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Risk Committee is engaged, as needed, in accordance with our Cybersecurity Incident Response Plan.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: Management, including the CIO, regularly reviews with the Board of Directors the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Board of Directors outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: Cybersecurity risk was classified as a Tier 1 enterprise risk for our company by our Enterprise Risk Committee for 2023. Our Manager Enterprise Risk, with oversight by our Enterprise Risk Committee, facilitates the monitoring of all Tier 1 enterprise risks within our digital work environment for changes in risk drivers and supports the evaluation of the potential impacts of each Tier 1 enterprise risk on our company, taking into consideration the effectiveness of our identified risk mitigants.

companyName: EQT Corp

ticker: EQT


text: The cybersecurity component of our ERM program consists of several elements including: • A risk assessment process that identifies and prioritizes material cybersecurity risks, defines and evaluates the effectiveness of controls to mitigate the risks, and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A dedicated information security team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation, and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: Given the importance of cybersecurity to our business, we maintain a comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; continuous monitoring and alerting systems for internal and external threats using industry leading platform; regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response simulations; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors. Our program leverages industry frameworks, including the NIST Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: NEXTNAV INC.

ticker: NN


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, to date, management has determined that none of the cybersecurity attacks the Company experienced have resulted in a material impact to its financial condition, results of operations or business strategy. In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all technology companies, we face a risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "System security risks, data protection breaches, cyber-attacks and other related cybersecurity issues could disrupt our internal operations, and any such disruption could reduce our expected net sales, increase our expenses, damage our reputation and adversely affect our stock price," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.

companyName: DIODES INC /DEL/

ticker: DIOD


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in Fidelity's Enterprise Cybersecurity organization and the Fund's management, including Fidelity's Chief Information Security Officer ("CISO"), members of the CISO's staff and the Fund's CCO. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.

companyName: Fidelity Private Credit Co LLC


text: As of September 30, 2025, we have not identified any material weaknesses in our cybersecurity controls. Our ability to protect our business from cybersecurity risks is subject to uncertainty, and there can be no assurance that our cybersecurity measures will prevent all potential attacks.

companyName: GEE Group Inc.

ticker: JOB


text: Managing Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund and the Advisers in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Fund, the Advisers and their respective third-party service providers.

companyName: Nuveen Churchill Private Capital Income Fund


text: Management's Role Managing Risk The Chief Information Officer, as well as other members of Management, plays a pivotal role in informing the Board on cybersecurity risks by providing comprehensive briefings to the Board on a regular basis. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Overall security posture and layers of defense; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to regularly scheduled meetings, the Board and the Chief Information Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state, confirming that the affected systems are functioning normally and implementing, as necessary, additional monitoring to look for future related activity.

companyName: W. P. Carey Inc.

ticker: WPC


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function. The board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Fastly, Inc.

ticker: FSLY


text: Based on an assessment using the previously described cybersecurity risk management program, we do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: The Company also engages with third parties on an as-needed basis to advise and assist in managing cybersecurity risks. When the Company utilizes third-party services that include web-based platforms or data collection stored on third-party servers, it reviews the service provider's SOC1 attestation reports on internal controls and inquires regarding controls and procedures utilized by such third parties with respect to cybersecurity of the Company's data.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: Our security framework provides guidance for the organization, governance and implementation of security across the company. Logitech and its infrastructure have been certified for compliance with ISO 27001, an international standard for information security management.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: In order to Recover systems or assets affected by a cybersecurity incident, full backups of our business systems data are created, tested and kept at multiple locations in online and offline formats.

companyName: FIRST INDUSTRIAL LP


text: Third-party service providers are integral to our business operations and are incorporated into our enterprise-wide risk management program, which subjects the providers to rigorous vetting processes and ongoing oversight. We use specialized monitoring tools that evaluate the cybersecurity posture of our third-party providers using a cybersecurity scorecard. This allows us to continually assess the cybersecurity risk levels associated with these external partners.

companyName: NEWMARKET CORP

ticker: NEU


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property and proprietary business information theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; physical damage to utility and transmission infrastructure; and reputational harm. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks. As part of our enterprise risk management program, we consider cybersecurity risks alongside other risks in our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying material cybersecurity threats, assessing their severity, and deploying potential mitigations.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Our Senior Vice President of Technology and Innovation and Vice President of Network Infrastructure and Cyber Strategy oversee our cybersecurity program. They hold degrees in industrial engineering and computer science and information systems and decision science, respectively. The team responsible with administering our cyber security program has a combined 37 years of experience in cybersecurity, information security and information technology risk management, governance, risk, and compliance. Our board of directors and our audit committee are regularly updated on cyber security as part of their oversight of relevant cybersecurity risks. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: We use computers in substantially all aspects of our business operations. We also use mobile devices, social networking and other online activities to connect with our employees and our customers. Such uses give rise to cybersecurity risks, including security breach, espionage, system disruption, theft and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' personal information, private information about employees, and financial and strategic information about the Company and its business partners. We also rely on a Payment Card Industry compliant third party to protect our customers' credit card information. While we have implemented measures to prevent security breaches and cyber incidents, our preventative measures and incident response efforts may not be entirely effective. The theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information or intellectual property, or interference with our information technology systems or the technology systems of third parties on which we rely, could result in business disruption, negative publicity, brand damage, violation of privacy laws, loss of customers, potential litigation and liability and competitive disadvantage.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: Identified risks are evaluated and assessed by the Company's security review council, comprised of various security, technology, legal and privacy staff members and management. A member of management is assigned as the risk owner and takes an active role in managing the risk, including approving the risk response and risk treatment plan, as well as participating in assessing any residual risk after implementation of the treatment plan. Our Chief Information Security Officer oversees our cybersecurity risk management program.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We model our cybersecurity program to align with practices and standards referenced within the National Institute of Standards and Technology cybersecurity framework. Our information security program is integrated within our larger enterprise risk management program and includes, but is not limited to: Following the methodology of Identify, Protect, Detect, Respond, and Recover; Mandatory annual cybersecurity awareness training for all teammates accessing our network; Monthly Company-wide phishing prevention and awareness exercises;

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: We work with third-parties from time to time to assist us to identify, assess, and manage risks from cybersecurity threats, including, for example, professional services firms, including outside legal counsel, cybersecurity consultants, and cybersecurity software providers.

companyName: Pulmonx Corp

ticker: LUNG


text: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents to management and the Board of Directors. Once an incident meets certain criteria, the Company's Cybersecurity Incident Command or, in the most severe cases that impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident. The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident's materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.

companyName: ARIZONA PUBLIC SERVICE CO


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Technology & Information Security Officer is responsible for information security and cybersecurity risk management. He has over 25+ years of experience in financial services, including 15+ years in information technology, and among other duties, is responsible for the security and integrity of systems, applications and databases and coordinates security implementations, monitoring, and enforcement.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: The Board of Directors' Technology Committee governs and oversees HHH's cybersecurity program. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform the Board of Directors on important matters. Furthermore, the Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: The board of directors' oversight of cybersecurity risk management is led by the Audit Committee of the board of directors, which regularly interacts with our Chief Compliance Officer, our Chief Financial Officer, and other members of management.

companyName: Passage BIO, Inc.

ticker: PASG


text: Cybersecurity risk management is overseen as a critical component of SilverBow's overall enterprise risk management. Our cybersecurity strategy is intended to mitigate the cybersecurity threats identified in the risk management process, and ensure that we have appropriate administrative, technical, and physical safeguards to protect our systems and data and respond effectively to cybersecurity threats. Our cybersecurity leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner.

companyName: SILVERBOW RESOURCES, INC.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We also regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Cybersecurity Officer ("CCO"), who reports to our Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process.

companyName: HARMONIC INC.

ticker: HLIT


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools, processes, and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are integrated into our decision-making processes to monitor and manage risk.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cyber-attacks, data breaches or malware may disrupt our operations and trigger significant liability for us, which could harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business."

companyName: Cipher Digital Inc.

ticker: CIFR


text: Cybersecurity processes have been integrated into the Company's broader framework of risk management. The Company's Board of Directors exercises oversight of cybersecurity risks. T he Board of Directors entrusts the Audit Committee with responsibility for regularly reviewing and assessing cybersecurity risks to ensure a proactive approach to safeguarding the Company's digital assets. The Audit Committee's primary role is to provide an independent and objective assessment of the Company's cybersecurity risk management practices to confirm that they are both effective and aligned with the Company's strategic objectives. The Audit Committee also reports its findings and recommendations to the Board of Directors, helping the Board of Directors to make informed decisions regarding cybersecurity strategy, investments, and risk. Notwithstanding the Company's efforts, the Company is aware that preventative measures cannot prevent all cybersecurity incidents. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."

companyName: SAUL CENTERS, INC.

ticker: BFS


text: We have a dedicated unit, led by the Senior Vice President ("SVP") of IT Enterprise Strategy and Execution, to implement cybersecurity controls, assess and report on cybersecurity risks, and consult with our ERM unit, which is responsible for identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: The Company has complex information systems used for a variety of functions by customers, employees, and vendors. In addition, third parties with which the Company does business or that facilitate business activities (e.g., vendors, exchanges, clearing houses, central depositories and financial intermediaries) could also be sources of cybersecurity risk to the Company, including breakdowns or failures of their systems, misconduct by the employees of such parties, or cyberattacks which could affect their ability to deliver a product or service to the Company.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We partner with a third-party information technology company to address and manage each of the critical aspects of cybersecurity risk mitigation. The user aspect is addressed by deploying endpoint detection and response software on all endpoints, as well as extensive phishing testing and training for every user. This is further reinforced with additional monitoring to identify any aberrant activity within our network or software as a service ("SaaS") tools. A 3-2-1 backup strategy is used, resulting in a copy of all backup data offsite in the unlikely event that the disaster recovery plan is required. Our backup system is regularly confirmed through occasional data recoveries, test recoveries and monitoring that alert to any unexpected errors or failures with the system.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, computer hardware and software, and our critical data, which includes proprietary, confidential and sensitive data, including, without limitation, personal data (such as health-related data), intellectual property and trade secrets, referred to collectively as Information Assets. Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: We use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. For third parties that we rely upon for certain IT systems, we seek to use only reputable providers, to use the most recently reliable versions of such systems, and monitor and address alerts for potential vulnerabilities to any such systems. We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition.

companyName: Sphere 3D Corp.

ticker: ANY


text: Device Scanning, Alerts, and Reporting. We reserve the right to monitor, scan, screen, and quarantine/confiscate all Computer Equipment that accesses our network, in compliance with applicable laws and government regulations. We also reserve the right to scan information systems, monitor or screen content and traffic patterns, block e-mail, quarantine and/or confiscate any Information Systems that may post a threat to us, and if such activities reveal possible evidence of criminal activity, to take any appropriate action which may include providing evidence to law enforcement officials.

companyName: Clene Inc.

ticker: CLNN


text: Cybersecurity is a key component of BlackLine's overall cross-functional approach to risk management. Our cybersecurity risk management practices are integrated into our overall risk management practices, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board through our annual enterprise risk assessment. Our cybersecurity policies and practices are designed with the cybersecurity framework of the National Institute of Standards and Technology and certain other applicable industry standards in mind, and BlackLine maintains an information security management system, which is certified against certain international standards, such as ISO 27001 and ISO 27017.

companyName: BLACKLINE, INC.

ticker: BL


text: (5) Third-Party Risk Assessments. We maintain a comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks presented by third parties, including our vendors and service providers. We have a dedicated information technology vendor management team that reports to our Chief Information Officer ("CIO"). We conduct initial and regular cybersecurity assessments of third-party vendors that we engage with in our operations and their information security policies and systems in order to identify, evaluate, and address potential vulnerabilities.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: As part of our cybersecurity procedures, we leverage a number of security tools, including but not limited to email filters, firewalls, and antivirus protection. As part of the assessment of the protections we have in place to mitigate risks from cybersecurity threats, we have also in the past engaged a third-party consultant to conduct a risk assessment of our systems. In addition, we test certain of our applications for vulnerabilities. In an effort to raise cybersecurity awareness, we work with an external partner to send email notices to our employees regarding cybersecurity best practices.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with our CIDO and CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. In addition, the ethics and compliance committee supports the audit committee and board in oversight of legal and regulatory compliance. Our board of directors also regularly participates in presentations on cybersecurity and information technology. In addition to regular presentations, management promptly updates our board of directors regarding significant threats and incidents as they arise.

companyName: ELI LILLY & Co

ticker: LLY


text: Our management team, including our Chief Financial Officer and EVP, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: Reporting to the Board of Directors The Directors of Information Technology and Internal Audit regularly inform executive management of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Partnership. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: The cybersecurity team implements, monitors and maintains controls leveraging the National Institute of Standards and Technology ("NIST") CyberSecurity Framework. These controls are designed to protect the confidentiality, availability and integrity of information systems. Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We view cybersecurity as a responsibility shared by all of our associates. As an organization committed to continuous improvement, we periodically conduct incident response tabletop exercises with key members of our leadership team, including our Chief Executive Officer, perform internal and external assessments and engage consultants to help assess the design and effectiveness of our program. In addition, we expect all of our associates as well as our third-party vendors to help protect against cybersecurity risks, and we conduct periodic awareness campaigns, emerging threats communications and specific trainings.

companyName: ESAB Corp

ticker: ESAB


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-virus and anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Our CISO, who manages our cybersecurity program, reports to our CIO regularly on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats. The CIO and CISO discuss these matters with our Audit Committee who reports to the Board on the substance of its reviews and discussions. In addition to these discussions, each year our CIO and CISO present to our Board on cybersecurity related trends and program updates. Our CIO and CISO are also responsible for prioritizing risk mitigation activities and developing a culture of risk-aware practices with strong support from management. Both our CIO and CISO have extensive background and expertise in information security, having served in senior leadership positions in the information and information security spaces, respectively, for many years prior to joining Whirlpool.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: The Company recognizes the increasing threats posed by cyber incidents and is dedicated to implementing robust cybersecurity practices. We have a comprehensive cybersecurity program designed to protect sensitive information, ensure the integrity of financial transactions, and maintain the confidentiality of our customers' data.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: Each operating company assesses its own cybersecurity risk profile and designs and implements technical safeguards and other risk management policies; however, as one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program to which all operating companies are a part, includes: • Collaboration: Through ongoing communications with management and the Company's IT department, each operating company's IT department monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents applicable to the particular operating company in real time, and reports such threats and incidents to the Data Breach Response Team, who will then report to the Audit Committee when appropriate. • Technical Safeguards: Although each operating company assesses and implements its appropriate technical safeguards for its business, generally the Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats such safeguards are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident. The Company has adopted a Cybersecurity Incident Policy and has established a Data Breach Response Team to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. • Outside Consultants: The Company engages various outside consultants, including forensic specialists, public relations and data breach resolutions firms, outside attorneys and other third parties, to among other things, obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans. • Education and Awareness: The Company provides awareness training to its personnel regarding cybersecurity threats to help identify, avoid and mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: Our VP IT and Senior ISM will provide periodic briefings to the audit committee and to the board of directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Chief Compliance Officer and to our audit committee chair.

companyName: IMPINJ INC

ticker: PI


text: Third-party service providers play a key role in Cohen & Steers' cybersecurity program. Cohen & Steers uses third-party service providers to assist in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and monitoring Cohen & Steers' environment 24 hours a day and seven days a week. Cohen & Steers has currently engaged with professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring firms and cyber insurance brokers and providers. Members of the Advisor's management report key findings of such assessments to our Audit Committee and Cohen & Steers adjusts its cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Depending on the particular environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: network security controls, system monitoring, incident detection and response, incident response policy, disaster recovery and business continuity plans, vulnerability management policy, penetration testing, encryption of data, data segregation controls, employee training, physical security cyber insurance, vendor risk management program, risk assessments, implementation of security standards/certifications, access controls, dedicated cybersecurity staff, and asset management, tracking and disposal.

companyName: Confluent, Inc.

ticker: CFLT


text: The CISO provides regular security updates to key members of our management team, quarterly Audit Committee briefings, and ad-hoc security updates if a situation requires. Security Risk Assessment results are provided to both the Enterprise Risk Council as well as the Audit Committee as part of the quarterly briefings. The Board of Directors has delegated oversight of the information security program to the Audit Committee.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: The General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.

companyName: NESTOR PARTNERS


text: We have in place a Cybersecurity Incident Response plan that dictates the process for responding to incidents and remediation of events. We have relationships with third-party business partners to assist with cybersecurity as well as assess their cybersecurity risks.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Team members who support our cybersecurity governance program have relevant education and industry experience. This team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: Titan Machinery Inc.

ticker: TITN


text: Our cybersecurity risk management program is designed to be integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: We are a blank check company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for an initial business combination. Therefore, we do not believe that we face significant cybersecurity risks and have not adopted any cybersecurity risk management programs or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Relativity Acquisition Corp

ticker: ACQC


text: Management's role in assessing and managing material risks from cybersecurity threats The Company's Enterprise Risk Committee, described above, includes our Chief Executive Officer, Chief Financial Officer, General Counsel and our Chief Technology Officer. Depending on the nature of the risk at issue, other managers and employees of the Company may participate in the work of the Enterprise Risk Committee. As to cybersecurity threat risks, the following individuals play a role: • Chief Financial Officer and Executive Vice President Information, Technology & Risk – The Company's information security and information technology team reports to our Chief Financial Officer ("CFO"). For example, our EVP Information, Technology & Risk reports to our CFO ("EVP, IT & Risk"). Our Chief Financial Officer and EVP, IT & Risk have familiarity with cybersecurity matters, appropriate for their position. Our EVP, IT & Risk is a member of our Enterprise Risk Committee as to cybersecurity threat risks and also participates in Board discussions regarding those risks. • Manager, Information Security – Our Manager, Information Security identifies, assesses and manages our day to day cybersecurity threats and related risks on a daily basis. He reports to the EVP, IT & Risk and is a member of our Enterprise Risk Committee as to cybersecurity threat risks and has eight years of experience as an information security professional. • General Counsel – Our General Counsel has experience advising on cybersecurity-related matters, including cybersecurity incidents, cybersecurity risk program design and execution. He is also experienced in other related cybersecurity risk management practices, such as engaging with outside advisors and risk managers, among other examples.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: NEE, including FPL, operates U.S. critical infrastructure. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets in the past and there may be such attacks in the future. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor FPL's business strategy, results of operations, or financial condition, NEE's or FPL's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and FPL to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Part I, Item 1A.

companyName: FLORIDA POWER & LIGHT CO


text: We also rely on information technology and third -party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all of the information systems we use. Incidents may lead to reputational harm, revenue and client loss, legal actions, or statutory penalties, among other consequences. For a more detailed discussion of these risks, see our discussion in the Risk Factors in Item 1A of this report.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.

companyName: New Mountain Finance Corp

ticker: NMFC


text: Given the complexity and evolving nature of cybersecurity threats, the Company engages external experts, such as cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. These engagements include audits, threat assessments, and consultations on security enhancements. Such collaboration ensures the Company leverages specialized knowledge to maintain cybersecurity practices aligned with industry standards. Utilizes advanced technology solutions, such as proactive detection tools, to safeguard its assets and identify threats within its environment.

companyName: Energy Services of America CORP

ticker: ESOA


text: We rely on our information technology ("IT") systems and networks in connection with our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. We have implemented processes to manage the cybersecurity risks associated with our use of third-party service providers through our vendor risk management program and an application governance policy.

companyName: Crocs, Inc.

ticker: CROX


text: Our Vice President of Finance and our management committee on cybersecurity, which includes our Chief Financial Officer and outside consultants, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks, are primarily responsible to assess and manage our material risks from cybersecurity threats.

companyName: Cyclo Therapeutics, Inc.


text: We consider cyber risks among the top risks for us within our enterprise risk management framework. This framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, and that are required to be reported in this Form 10-K. We do not believe we have experienced any risks from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy or our results of operations or financial condition, including for any of the three years ended July 31, 2025, 2024 or 2023. For further discussion of the risks associated with cybersecurity incidents, refer to the cybersecurity risk factors in Item 1A, "Risk Factors" in this Form 10-K.

companyName: DONALDSON Co INC

ticker: DCI


text: Premier's risk management program is designed to identify, measure, prioritize, and manage risk, including information security and cybersecurity risk, in relation to the Company's desired risk appetite established by its Board of Directors. Premier uses a risk-based approach to manage and mitigate threats to information technology resources. Periodic risks assessments are conducted to identify, assess, and reduce information security and cybersecurity risks to acceptable levels.

companyName: PREMIER FINANCIAL CORP


text: The board of directors oversees risks from cybersecurity threats as part of its risk oversight function. However, there are no specific processes or committees by which the board of directors may be informed about such risks.

companyName: DEEP FISSION, INC.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on the Trust's service providers, including the Trustee and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor reviews and reports to the Board of Directors, the results of this annual review and any incidents or perceived risks.

companyName: SPDR GOLD TRUST

ticker: GLD


text: We engage third party consultants to conduct cybersecurity assessments and help mature the information security program. We regularly review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the board of directors, and we may adjust our cybersecurity program and practices as necessary based on the information provided by these assessments, audits and reviews. We review and test our information security systems, including regular penetration tests of our network. We also use third-party systems to monitor our information security continually.

companyName: Cottonwood Communities, Inc.