text: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, among others. We also regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties. We use the outcome of these assessments to align our cybersecurity program and technical safeguards with the evolving cybersecurity threat landscape and adjust and augment our security controls environment as required.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The Board's Audit and Compliance Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Compliance Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our CTO, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives updates from management and the Audit and Compliance Committee on cybersecurity risks on at least an annual basis. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board and Audit and Compliance Committee.

companyName: DocGo Inc.

ticker: DCGO

secItem: Item 1C


text: To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have implemented an incident response policy ("IRP"), which includes our cybersecurity policy, plan, and associated playbooks. The IRP is a component of our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. The IRP is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as unauthorized occurrences, or a series of related unauthorized occurrences, on or conducted through our information systems that jeopardize the confidentiality, integrity, or availability of those systems or any information residing therein) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.

companyName: CapStar Financial Holdings, Inc.


text: We maintain a security awareness training program for employees, which is provided through digital microlearning assignments. We also provide additional mandatory trainings, including phishing training, throughout the year.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Risk Management and Strategy QVC Group's corporate level IT and cybersecurity functions are provided by LMC as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in LMC's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate level, as detailed below. QVC operates its own cybersecurity function with oversight from QVC Group.

companyName: QVC Group, Inc.

ticker: QVCGA


text: The board has created a dedicated cybersecurity subcommittee of the enterprise risk committee to oversee Farmer Mac's cybersecurity programs and practices, including the identification and mitigation of security and privacy risks. The cybersecurity subcommittee consists of three members of the enterprise risk committee. The cybersecurity subcommittee typically meets on a monthly basis with the CISO and other members of Farmer Mac's management team to discuss the performance and effectiveness of Farmer Mac's cyber program and to receive updates on cybersecurity risks, any cybersecurity incidents, and major cybersecurity initiatives. The materials provided to Farmer Mac's cybersecurity subcommittee and discussed in the meetings may include updates about cybersecurity risks, controls, and assessments, including those from third parties. At each regular quarterly meeting of the board enterprise risk committee, the cybersecurity subcommittee reviews a summary of the information discussed in the most recent cybersecurity subcommittee meetings.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Tripadvisor also has executive oversight committees responsible for assessing and managing cybersecurity risk as part of their enterprise risk management and compliance programs. Tripadvisor has designated the Compliance Committee and Chief Compliance Officer ("CCO") with day-to-day management and oversight of corporate compliance initiatives, including cybersecurity. The Tripadvisor Compliance Committee consists of, among others, the Chief Financial Officer, Chief Legal Officer and CCO. The CCO has further established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of senior members of Tripadvisor's Information Security Team and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with Tripadvisor's information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.

companyName: Liberty TripAdvisor Holdings, Inc.


text: DTE Energy's Chief Information Officer leads the cybersecurity team and has responsibility for assessing and managing cybersecurity risks. The Chief Information Officer has held this position for over 10 years and has decades of experience in IT, including oversight of information protection security (IPS). The IPS cybersecurity team is also led by two full-time directors with over 40 combined years of industry experience, including (1) the director of cybersecurity operations responsible for the CSDC, identity and access assurance, and cloud security and (2) the IPS director of cybersecurity governance, risk, and compliance who is also responsible for engagement and outreach to internal and external stakeholders.

companyName: DTE Electric Co


text: First Guaranty assesses cybersecurity risk by identifying reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information, information systems, or bank records. These risks are then classified and prioritized based on their residual risk level. The organization has a board-approved risk appetite of "low." Any risks with a residual risk above low are escalated to the board for oversight and a mitigation plan is developed to remediate the remaining residual risk.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, Software-as-a-Service (SaaS) platforms, managed services, cloud-based infrastructure, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.

companyName: Equillium, Inc.

ticker: EQ


text: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy and managing our cybersecurity threat detection and response plan. With over 25 years of experience in information security, IT infrastructure and cybersecurity and with several industry certifications such as the Certified Chief Information Security Officer certification, our CISO brings a wealth of expertise to the role. Our CISO oversees our cybersecurity governance programs, monitors and assesses cybersecurity threats, monitor compliance with industry best practices and standards, and leads our ongoing employee cybersecurity training and awareness program.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our management team, with the assistance of the Company's third-party information technology providers, is responsible for assessing and managing our material risks from cybersecurity threats. Internal personnel, including our Senior Vice President, Finance, have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our senior management do not have direct cybersecurity expertise obtained through certifications, but their experience managing the Company, which includes consulting and coordinating as necessary with third-party information technology and cybersecurity experts, enables them to assess and manage material risks from cybersecurity threats.

companyName: Q32 Bio Inc.

ticker: QTTB


text: We periodically evaluate, test, and update our policies, standards, and processes to mitigate cybersecurity threats and manage incidents effectively. These efforts include risk assessments, vulnerability assessments and remediations, phishing tests and employee education, and external scans. Additionally, to enhance our capabilities, we periodically engage third-party service providers, including cybersecurity consultants, to incorporate threat intelligence into our processes.

companyName: Celcuity Inc.

ticker: CELC


text: Substantially all our locations are branded fuel locations for which sensitive debit and credit card transactions for fuel or merchandise products or services do not pass through our networks; rather, such information passes through the branded fuel supplier's (or its service providers') networks.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: Board of Directors is responsible for oversight of cybersecurity risk. Our Chief Financial Officer and Chief Executive Officer are the members of management responsible for managing and assessing our cybersecurity practices and have commenced reporting on such practices and risks. The plan for the future is that they will continue to report to the Board on cybersecurity at least quarterly. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. We believe we are appropriately staffed (as supported by IT consultants and service providers, as needed) to support a healthy cybersecurity posture given our size and scope.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: Information Security Program Allstate has implemented a robust Information Security Program to manage material risks from cybersecurity threats. The Company's Program uses a risk-based, defense-in-depth approach to identify, assess and manage cybersecurity risks to the Company's information assets and systems, enabling the business to achieve its objectives. The Information Security Program is aligned with industry best practices and standards including the ISO 27001/27002 standards, the Control Objectives for Information and Related Technologies Framework and the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: ALLSTATE CORP

ticker: ALL


text: Additionally, we have implemented an enterprise risk management process, which addresses cyber risks. This process is led by our Chief Legal Officer and includes participation by the board of directors, as appropriate. Our Chief Legal Officer reports regularly on the enterprise risk management process to executive leadership and the audit committee.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into our compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee of the Board having certain responsibilities relating to risk management of cybersecurity.

companyName: BATTALION OIL CORP

ticker: BATL


text: Our Information Security Standards provide rules for the implementation of the EISP. These standards provide greater granularity on the Bank's requirements for the establishment, maintenance and continuous improvement of our information security program.

companyName: Federal Home Loan Bank of Indianapolis


text: TEC's Information Security group of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout TEC in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT cyber systems, assets, and networks are aligned with Emera and affiliate cybersecurity framework. TEC engages independent third-party consultants from time to time to assess the adequacy of its cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. In addition, TEC participates in an Electric Power Research Institute (EPRI) research project to develop cybersecurity performance metrics. EPRI offers a web-based platform, which supports automated cybersecurity data collection, security metrics calculation, visualization, and analysis. The Vice President of Information Technology and Chief Information Officer (CIO), who reports to the President and Chief Executive Officer, oversees this group and is responsible for managing the program, in collaboration with TEC's businesses and functions. TEC's CIO has advanced degrees in computer science and extensive experience in cybersecurity and information technology, including many years of experience at large organizations leading cybersecurity, IT processes and controls, strategy, architecture, delivery and support of IT applications, and overseeing large groups of employees and contractors responsible for carrying out these responsibilities.

companyName: TAMPA ELECTRIC CO


text: We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Vice President of Finance and Treasurer is responsible for our insurance policies and reviews on a regular basis our cyber insurance policy with management to ensure we have appropriate coverage. We have business continuity, contingency and disaster recovery plans and procedures in place in the event of a cybersecurity incident. These plans are tested in conjunction with the Company's annual testing of its cybersecurity incident response readiness and reporting through tabletop exercises.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: The Company's processes for identifying, assessing and managing cybersecurity risk are integrated into the Company's overall risk management process. The Company's internal audit group monitors the Company's risk profile and conducts regular enterprise-wide integrated risk assessments, with input from corporate and business unit management and personnel, to identify and assist the Board of Directors and senior executives in managing key existing and emerging risks for the Company and its businesses, including cybersecurity risk. The risk assessment process culminates in semi-annual reports to the Audit Committee and the Board of Directors. In addition to its own systems and technology, the Company relies on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations. The Company has policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers. When contracting with these providers, the procurement function works closely with the compliance, cybersecurity, privacy and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract. The Company and its business units have developed, and seek to incorporate, standard contractual security requirements into their service provider agreements. The Company also performs cybersecurity assessments of third-party service providers where it deems appropriate given the nature of the engagement and the data and systems expected to be accessed.

companyName: NEWS CORP

ticker: NWSA


text: In addition, our management team, comprised of senior staff and executives from multiple departments within the Company, including IT, finance, legal, and operations, leads all efforts for our overall cybersecurity risk management program and supervises both our internal information security personnel with prior work experience in cybersecurity and our retained cybersecurity consultants.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: The Company may not be able to fully, continuously, and effectively implement appropriate security controls as intended. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: New ERA Energy & Digital, Inc.

ticker: NUAI


text: To address evolving cybersecurity risks and corresponding regulations, the HTLF Security team uses Federal Financial Institutions Examination Council ("FFIEC") booklets and Cybersecurity and Infrastructure Agency ("CISA") guidance; identifies and defines emerging risks using third-party research and subject matter expert consultants; executes strategic cyber threat assessments; performs new product and initiative reviews; performs data management risk oversight; and conducts cyber risk reviews as part of HTLF's Third Party Risk Management process, which oversees and identifies risks, including cybersecurity threats, associated with our use of third-party service providers. The HTLF Security team conducts periodic tabletop exercises to test HTLF business units' capabilities to respond to various security incidents, including cyber-attacks.

companyName: HEARTLAND FINANCIAL USA INC


text: Engaging third -party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and Conducting periodic cybersecurity training for our employees and the Company's Board.

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: We rely heavily on our supply chain to deliver our products and services to our customers, and require our key suppliers to comply with our security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us. We also require each key supplier to notify us in the event of known or suspected cyber incidents.

companyName: Qorvo, Inc.

ticker: QRVO


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the Ares ERC periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: The Committee reports quarterly to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings on our cyber risk management program, including from our CISO.

companyName: Intapp, Inc.

ticker: INTA


text: Our Senior Director of IT Operations oversees a team of analysts and operations support personnel and has extensive experience with the company's applications and infrastructure. Our senior director reports to our President and Chief Operating Officer, who then communicates directly with the Nominating/Governance and Compliance Committee and the Board.

companyName: MANNATECH INC

ticker: MTEX


text: In line with cyber risk management best practices, we have collaborated with recognized third-party experts as needed to align the CRM's foundational processes, metrics, monitoring, and reporting with common frameworks such as NIST and RMF.

companyName: KROGER CO

ticker: KR


text: We use various security tools, including internal reporting and monitoring, to identify vulnerabilities in our products and systems. We use industry leading products and services within our IT environment to optimize security and under vendor contracts. Regular system updates and patching are done to protect our hardware and software against security vulnerabilities.

companyName: Airspan Networks Holdings Inc.


text: Our cybersecurity program is designed from a risk- and compliance-based approach to achieve system-wide resilience and protection across our operations. We regularly assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We model our cybersecurity program after the National Institute of Standards and Technology Cybersecurity Framework to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. Our cybersecurity program includes physical, administrative, and technical safeguards, and we maintain plans and procedures the objective of which is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board of Directors.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: 5. Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We have implemented communication channels with our key third-party vendors to communicate regarding potential cybersecurity risks and incidents.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability management, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity and risk assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Callon Petroleum Co


text: The Company recognizes the importance of maintaining our technology and data systems. Our cybersecurity policies, standards, processes, and practices are integrated across our operational departments.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: To prevent, detect, mitigate, and remediate information security threats, including a cybersecurity incident and/or threat, we maintain a cyber risk management process managed by our Senior Vice President, Operations ("SVP, Operations") who reports to our CEO and has seven years of experience overseeing information technology processes and procedures, including cybersecurity matters. The SVP, Operations works with the Company's Legal team on cybersecurity strategy, policy, training, standards, architecture, and processes. We have invested, and expect to continue to invest, in resources for the protection and safeguarding of our information technology systems, including, but not limited to, networks, applications, and outsourced technology services in connection with the operation of our business. We have implemented cybersecurity systems and controls based on industry best practices and the U.S. National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use such standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. These resources are designed to detect and respond to cyber incidents that may result in unauthorized access to, ransomware, damages, or destruction of, our information systems.

companyName: Zevia PBC

ticker: ZVIA


text: Our cybersecurity incident response Policy is being designed to escalate certain cybersecurity incidents to members of management depending on the circumstances.

companyName: SunPower Inc.

ticker: SPWR


text: Our Board of Directors has oversight responsibility for our overall enterprise risk management, and cybersecurity risk management in particular is regularly reviewed and overseen by our Audit Committee. The Audit Committee provides oversight and reviews management policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed. Management regularly reports to the Audit Committee regarding its process and procedures to mitigate or remediate cybersecurity risks, threats and incidents, along with monitoring activities of the cybersecurity team.

companyName: SentinelOne, Inc.

ticker: S


text: We adhere to a risk management framework based on applicable laws and regulations to handle cybersecurity risks across our products, services, infrastructure and corporate assets. We regularly conduct risk assessments to gauge the effectiveness of our systems, identifying areas for improvement. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including Squarespace and Google Workspace, which assist us with information technology system monitoring, detection, and response support services.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management to promote cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. Our management works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: RHINO BITCOIN INC.

ticker: RHNO


text: Cybersecurity risks and associated mitigation strategies and efforts are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board. Additional information on cybersecurity risks Occidental faces is discussed in Item 1A of Part I, "Risk Factors," under the heading "Occidental is exposed to cyber-related risks," which should be read in conjunction with the foregoing information.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Parties' Systems, Exposure of Personal or Confidential Information or Increased Government Regulation Relating to Handling of Personal Data, Could, Among Other Things, Disrupt Our Operations or Cause Us to Incur Substantial Costs or Negatively Affect Our Reputation".

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to our Business" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Zomedica Corp.

ticker: ZOMDF


text: We rely on certain third-party computer systems and third-party service providers, including global distribution systems ("GDSs") and computerized central travel reservation systems in connection with providing some of our services. We also depend upon various third parties to process payments for certain transactions. These third-party business partners, service providers, and consultants need to access our customer and other data, and connect to our computer networks. We define confidentiality, security, and privacy requirements through our contracting processes and perform third-party cyber risk assessments to monitor such third parties as needed.

companyName: Booking Holdings Inc.

ticker: BKNG


text: The CSWAT is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.

companyName: QWEST CORP

ticker: CTBB


text: No system is entirely immune to cyber threats and although our risk is low, the impact of a cybersecurity incident could impact our business, cause reputational harm, subject us to increased operating costs and/or expose us to litigation. To date, we have had no cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact our operations or financial condition. Should an incident occur, the CFO and/or DFO will immediately report the incident to the Audit Committee with all details. The communication will identify what steps are currently being taken to resolve the incident, and what actions are being taken to prevent any further security incidents from occurring.

companyName: BAB, INC.

ticker: BABB


text: The Company's Director of Information Technology ("IT"), who reports to our CFO, has over 20 years of experience leading cyber security oversight and is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our IT security team, led by the Director of IT, consists of professionals with broad cybersecurity experiences, including a number of cybersecurity certifications and degrees. As a result, our IT security teams utilize their understanding of industry best practices and hands-on experience to seek to implement effective cybersecurity solutions. Cybersecurity remains a top priority across the organization, with resources allocated in an efficient manner to seek to mitigate risks and enhance our overall security posture.

companyName: ASTRONICS CORP

ticker: ATRO


text: Our management team, including other internal staff such as the Head of IT and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's and their delegates' collective experience include over ten years of cybersecurity, incident response, and the safeguarding of organizational assets expertise. Specifically, our Head of IT has over ten years of experience leading cybersecurity teams and programs, while our Chief Operating Officer has over seven years of experience risk management and three years of cybersecurity oversight.

companyName: Atai Beckley N.V.

ticker: ATAI


text: Our full Board receives biannual updates on cybersecurity from our Chief Technology and Product Officer (the "CTPO") or head of cybersecurity (the "CISO") to, among other items, review cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. Our Board also regularly reviews cyber-related risks as part of our enterprise risk management program on a quarterly basis and receives updates from our Internal Audit team on the results of the risk monitoring and mitigation process, as described in more detail above.

companyName: TheRealReal, Inc.

ticker: REAL


text: Our management Info Sec Steering Committee has established an Information Security Program, which includes appropriate security risk assessments, security monitoring, incident response, policies, operating standards, compliance, and employee training. The underlying controls of this security program are based on the guidelines and frameworks provided by the Office of the Comptroller of the Currency (the "OCC"), the Federal Financial Institutions Examination Council (the "FFIEC"), and the National Institute of Standards and Technology ("NIST"), as well as industry best practices and standards. The Information Security Program focuses on the following key areas: • IT Governance, Risk & Compliance – As discussed in further detail under the "Governance" section below, we have established programs, policies, and procedures for security oversight, including risk assessments for business processes and applications. These cyber and information security programs, policies and procedures are reviewed annually by a third-party. • Identity & Access Management – We have established controls to mitigate risks related to unauthorized access, identity theft, and data breaches. Process and technology controls include identity, authentication, authorization, account management, and access, along with monitoring and logging for tracking events. • Security Architecture & Engineering – Our security is tailored around industry best practices and guidance. This establishes the foundation for secure resilient systems that can withstand and mitigate cyber risks effectively. • Security Operations – We use various tools to assess, monitor, and analyze the vulnerability of our operating systems, and have established an incident response plan for addressing identified threats and incidents. • Resiliency, Safety & Security – We have established policies and procedures to withstand and recover from disruption, protect our people and environment, as well as protect our systems and information from threats and unauthorized access. • Vendor Risk Management – We use a risk-based approach to assess and monitor cybersecurity risks presented by our vendors, third-party service providers, and other third-party users that we partner with. • Security Awareness Education – We use current cybersecurity and information security threats to develop our education program. This training focuses on information security, privacy, cybersecurity best practices (e.g., social engineering, incident reporting, maintaining strong passwords), identity and access management, and physical security. All employees receive education and awareness training throughout the year. In addition, some of this education is extended to our customer base, with current cyber activity and hygiene highlighted.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: We have a vendor management program to manage cybersecurity risks associated with our use of certain service providers. The program includes, depending on the nature of the services and the identity of the service provider, completion of security questionnaires, review of the service provider's written security program, and imposition of cybersecurity-related contractual obligations on the provider.

companyName: ENZO BIOCHEM INC


text: Risk Management & Strategy Our management is principally responsible for defining the various risks facing us, formulating risk management policies and procedures, and managing our risk exposures on a day-to-day basis. Our information is processed, transmitted, and stored in a secure environment using hardened, proven enterprise-grade technologies to protect both our data and the physical computing assets. We guard against business interruption by maintaining a disaster recovery plan, which includes storing critical business information in multiple off-site data centers, testing the disaster recovery plan at a host-site facility, and providing fault tolerant devices, communication services, and utilities. We have independent third-party cybersecurity audits conducted no less than annually, following a framework modeled after the National Institute of Standards and Technology standard. We also have third-party security reviews and testing of our network, processes and systems conducted on a regular basis. We use internally developed proprietary software, cloud-based software as a service ("SaaS") as well as purchased software, with proven, non-proprietary hardware. While we believe that our internal policies, systems and procedures for cybersecurity are thorough, the risk of a cybersecurity event cannot be eliminated. We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply or our systems are compromised, we could be subject to government enforcement actions, private litigation and adverse publicity.

companyName: BJs RESTAURANTS INC

ticker: BJRI


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our internal disclosure committee and our senior leadership team. Senior leadership team members work with our company's incident response team to help Vital Farms mitigate and remediate cybersecurity incidents of which they are notified. In addition, our company's incident response plan provides for reporting of certain cybersecurity incidents to the Audit Committee.

companyName: Vital Farms, Inc.

ticker: VITL


text: Our management team, including our Chief Digital and Information Officer and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Digital and Information Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital and Information Officer has more than 30 years of experience in information technology, including prior experience in cybersecurity architecture. We have an information security team with varying backgrounds, years of experience and levels of information security certification.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Cybersecurity is an important part of our overall risk management processes and the Technology Committee of our Board of Directors has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee reviews and discusses with management our cybersecurity, privacy and data security programs, the status of projects to strengthen internal systems and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives periodic updates regarding our cybersecurity program.

companyName: Arhaus, Inc.

ticker: ARHS


text: Cybersecurity Incidents While we have experienced cybersecurity incidents in the past, there have been none to date which have materially affected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors – Risks Related to Data Privacy, Intellectual Property and Cybersecurity."

companyName: Criteo S.A.

ticker: CRTO


text: Although cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not do so in the future.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees or customers violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. The Board has delegated primary responsibility for the oversight of cybersecurity matters to members of management who are responsible for implementing and maintaining our cybersecurity and data protection practices. Management reports to the Board at least annually on data protection and cybersecurity matters and reviews, and more frequently as needed. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: NORTHWEST BIOTHERAPEUTICS INC

ticker: NWBO


text: While we and third parties that provide services to us commit resources to the design, implementation and monitoring of our digital systems, there is no guarantee that our or our third parties' cybersecurity measures will provide absolute security. Like other companies in the natural gas industry, we have identified and expect to continue to identify cyberattacks and incidents on our systems. Additionally, we have received notification from third-party service providers of certain such matters on their systems. None of the cyberattacks and incidents we have identified, or been notified of, to the filing of this Annual Report on Form 10-K has had a material impact on our business strategy, results of operations or financial condition. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations, or financial condition, see "Cyberattacks aimed at us or those third parties on which we rely, as well as any noncompliance by us or such third parties with applicable laws and regulations governing cybersecurity and/or data privacy, could materially adversely affect us." included in Part I, "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: Midstream Co LLC


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity to assess and enhance the effectiveness of our security programs. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support and audit our cybersecurity preparedness. We have also adopted cybersecurity incident response guidelines. As required by these guidelines, teams and plans are in place to respond to any cyber security incident, including internal and external communication responsibilities.

companyName: OGLETHORPE POWER CORP


text: The Company has a crisis response team comprising senior members of various corporate functions to oversee the response to various crises including potential crises arising from cybersecurity incidents that may impact the Company and/or its vendor partners. This team conducts regular tabletop exercises to simulate responses to cybersecurity incidents. To the extent there is a cybersecurity incident impacting the Company and/or a vendor partner, the crisis response team's process would be to ensure that our Head of Information Security and Chief Technology Officer are informed immediately and that the potential impact of the incident and remedial measures arising from the incident are communicated to the executive officers of the Company.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the s ervice center's CIO and CISO, each of whom has over 15 years of experience in IT, including various leadership roles at other large corporations. Directors Scott E. Lamb, Gregory K. Morris M.D., and John G. Nackel, Ph. D. provide key oversight on cybersecurity matters. Our executive team is also regularly briefed on any significant security risks during monthly leadership meetings.

companyName: Pennant Group, Inc.

ticker: PNTG


text: The global head of Information Technology is part of our operating team and ensures that management is well-informed about preventing, mitigating, detecting, and remediating cybersecurity incidents. This role involves managing our comprehensive cybersecurity risk management and strategy processes and overseeing the operation of our incident response plan.

companyName: ARTIVION, INC.

ticker: AORT


text: Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The CFO has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology personnel and our retained external cybersecurity consultants. Our management team's cybersecurity experience is limited.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: Cybersecurity is an important part of our overall risk management processes and the Audit Committee of our Board of Directors has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee reviews and discusses with management our cybersecurity, privacy and data security programs, the status of projects to strengthen internal systems and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives periodic updates regarding our cybersecurity program.


text: Critical vendors are monitored by our sourcing and vendor management team. Resources contracted through a third-party that will have access to corporate systems must complete CNO's associate training or their company's security awareness training that has been approved by CNO. We also perform periodic risk assessments throughout the term of the engagements, including those third parties located outside the United States that have access to our Company and customer information.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: In connection with the operation of the Company's business, we identify, assess and manage key risks that may affect the Company, including material risks from cybersecurity threats, through our system security plan. Our system security plan is aligned with the 110 controls detailed in the NIST (SP) 800-171 and Department of Defense CMMC Level 2 guidelines for Cybersecurity. We have company-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures covering our information technology systems, including the protection of customer data, vendor data and employee information. We have also implemented specialized training and education programs to guard against cybersecurity incidents, including company-wide communications and presentations, phishing simulations, focused training for specific roles and a general cybersecurity training program required for all employees.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: The Company maintains an Information Security Program which is designed to ensure the confidentiality, integrity, and availability of all data and systems across the organization. We have developed a system of processes and controls to mitigate risks and respond effectively to security incidents.

companyName: Eagle Bulk Shipping Inc.


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our Chief Executive Officer and has been responsible for overseeing the assessment and management of cybersecurity risks at Assertio for approximately a year and a half.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: We take a risk-weighted approach to mitigation of cybersecurity risks associated with use of third-party service providers. Based on an assessment of the cybersecurity risks presented by a given third-party service provider, we seek to minimize third-party cybersecurity risk on a case-by-case basis, generally through a combination of due diligence in the selection of qualified vendors and the imposition of contractual terms requiring the vendor to maintain specified cybersecurity safeguards and/or to accept financial responsibility for security breaches occurring within the vendor's area of responsibility.

companyName: OMEROS CORP

ticker: OMER


text: Cybersecurity risk is overseen by the board of directors, with additional oversight of the relevant risk framework and controls provided by the Audit Committee. The Audit Committee oversees our policies with respect to risk assessment and risk management generally, including guidelines and policies to govern the process by which our exposure to risk is handled. As set forth in its charter, Audit Committee oversight includes periodic review of our information security controls and procedures and the processes and procedures for managing cybersecurity risks.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Given our decentralized and adaptive operating model, each of our businesses is responsible for implementing and managing its own cybersecurity program, following our established enterprise-wide standards and strategy and using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which outlines industry-wide best practices addressing the components of a cybersecurity program. We utilize a third party to routinely assess the alignment of the cybersecurity programs across our organization with the NIST CSF and the program maturity in each of the included objectives. The results of these assessments are used to develop a risk-informed approach to our prioritization and allocation of resources and investment.

companyName: Post Holdings, Inc.

ticker: POST


text: Embecta has established a Cyber Security Incident Response Team, a cross-functional team composed of representatives from our Information Technology, Information Security, Product Security, Privacy, Legal, and Human Resources groups. This team is responsible for the response to security threats by implementing our detailed incident response plan. Our incident response plan includes processes, procedures, and playbooks for assessing potential internal and external threats, developing remediation plans, and facilitating post-incident recovery; all designed to safeguard the confidentiality, integrity and availability of both Company and customer data.

companyName: Embecta Corp.

ticker: EMBC


text: Our CISO regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Technology Officer, the Chief Information Officer, Deputy Chief Legal Officer, and Chief Compliance Officer, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: As of December 31, 2023, our CISO has served in various roles in information technology and information security for over 37 years, as an IT auditor and an IT security executive. He has been in various industries including Finance, Manufacturing and Retail. The CISO has both the CISA and CRP designations.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We manage these known risks by using internal security controls designed to align with standards set the International Organization for Standardization ("ISO"). In connection with the identification, assessment and management of material risks and cybersecurity threats, we also conduct the following activities at various intervals during the year: monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply with such laws; undertake regular reviews of our customer facing policies and statements related to cybersecurity;

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: We continuously monitor our computing environments, products, and services for vulnerabilities and signs of compromise, and we utilize our own security products to combat cybersecurity threats. We integrate security into our computing environments, products, and services through our Security Development Lifecycle ("SDL"). Our SDL introduces security and privacy considerations throughout all phases of our development process and through the adoption of zero-trust end-to-end architecture. We utilize machine learning and AI-powered security tools to gain insights from over 78 trillion signals per day and over 135 million managed devices. We track over 300 unique threat actors, including 160 nation-state actors and 50 ransomware groups. To support our efforts, we operate a Cyber Defense Operations Center connected to over 10,000 security and threat intelligence experts, including engineers, researchers, data scientists, cybersecurity experts, threat hunters, geopolitical analysts, investigators, and frontline responders across the globe.

companyName: MICROSOFT CORP

ticker: MSFT


text: The Audit Committee of the Board of Directors oversees the company's cybersecurity risks. Additionally, our Board of Directors periodically engages with third-party advisors to provide further education about cybersecurity risks.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.

companyName: Invesco Real Estate Income Trust Inc.


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton requires third party vendors to comply with our confidentiality, security, and privacy requirements. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party vendors are also subject to additional diligence requirements.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: The Vice President of Corporate Strategy and Planning meets regularly with members of our Information Technology team, whose responsibilities are dedicated solely to cybersecurity matters. On a quarterly basis, we hold Information Technology Steering Committee meetings, which are attended by our Information Technology team, Chief Executive Officer and Chief Financial Officer, where we discuss the risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Our Information Technology team also works with our Vice President – General Counsel to oversee compliance with legal, regulatory and contractual cybersecurity requirements.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other weaknesses; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Within our cybersecurity team, subject matter experts regularly obtain cybersecurity certifications. Our program includes procedures to identify cybersecurity risks and threats of our third-party service providers. These procedures measure the maturity of third-party provider cybersecurity programs against industry best practices. The collection of this information is used to assess the use of third-party software or partnerships. We also review the cybersecurity scores of our business customers and suppliers, and we rely on consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. Our cybersecurity risk management program includes response plans that are aligned with our crisis response plans and outline the procedures and protocols to follow when a cybersecurity incident has or may have occurred, including to allow assessments related to disclosure and notice requirements to be timely made to regulators and affected parties. The response plan includes protocols to notify our Chief Technology Officer ("CTO"), our Chief Legal Officer, other members of senior management as appropriate, and, under certain circumstances, the Audit Committee of our Board, or our full Board as appropriate.

companyName: Bunge Global SA

ticker: BG


text: We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Information Security Program The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. The information security organization is overseen by the Information Security Advisory Team (the "ISAT"), further detailed under the caption "Cybersecurity Governance" below.

companyName: MARA Holdings, Inc.

ticker: MARA


text: Management's Role in Cybersecurity Risk Management Our management team, including our Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN


text: The Company focuses on building cybersecurity awareness with its employees and other end-users through training and security exercises and communicates the Company's expectations of employees and contractors with respect to cybersecurity matters. The Company uses third-party cybersecurity professionals to review and assess the Company's cybersecurity controls and procedures.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: The framework for our overall process for managing risk encompasses the management of risks posed by cybersecurity threats and is discussed further in Item 1. "Business, Risk Management." As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Board also receives regular updates from management on cybersecurity risks, incidents, and the overall effectiveness of our cybersecurity programs, ensuring alignment between cybersecurity objectives and business goals.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by GECM's Chief Operating Officer, IT Specialist and other members of Company management (together, Great Elm IT Management) and their third-party consultants. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires these parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs annual reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Our Chief Financial Officer provides briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In addition, our Chief Financial Officer provides briefings of any significant cybersecurity matters to the Board of Directors as well as an annual update of cybersecurity risks and activities.

companyName: Allakos Inc.


text: The Company maintains a cybersecurity risk management program that establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems. The program includes general controls for managing changes in and access to the Company's IT environment, cybersecurity awareness and training to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident.

companyName: US ENERGY CORP

ticker: USEG


text: Controller and Chief Accounting Officer Patrick Doyle. Mr. Doyle has served as Executive Chair of our Board since January 2023 and was appointed Executive Chairman of RBI in November 2022. Most recently, he served as an executive partner focused on the consumer sector of the Carlyle Group, a global diversified investment firm from September 2019 through November 2022, Prior to that he served as the chief executive officer of Domino's Pizza from March 2010 to June 2018, having served as president from 2007 to 2010, as executive vice president of Domino's Team USA from 2004 to 2007 and as executive vice president of Domino's International form 1999 to 2004.

companyName: Restaurant Brands International Limited Partnership


text: Process and Management's Role Management is responsible for designing and implementing policies, processes and procedures and deploying physical and virtual technology and safeguards to measure, monitor and control cybersecurity risk. The primary executives responsible for the oversight of risk and cybersecurity are the Company's Chief Risk Officer, who has over 36 years of experience in the banking industry, including 25 years as a national bank examiner for the Office of the Comptroller of the Currency, and the Company's Chief Information Security Officer ("CISO"), who has an educational and experiential background in information technology and information security for public companies (bachelors degree in computer science and service as the Company's CISO for the past nine years, with 10 prior years of information technology and information security experience). The CISO leads the members of the Information Security Department, some of whom maintain a variety of certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Security+ (Plus) Certification (SEC+). Both of these executives, along with the other professionals in the Information Security and Information Technology Departments, have the appropriate knowledge and expertise to effectively assess and manage the Company's cybersecurity risk and establish a system of internal controls in an effort to safeguard the Company's network and comply with regulatory requirements.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: While material risks are generally overseen by the full Board of Directors, the Audit Committee has a key role in cybersecurity risk monitoring and oversight as set forth in its charter. In establishing Audit Committee membership, the Nominating & Corporate Governance Committee identifies directors with relevant IT, network and cyber expertise to serve on the Committee. The CDIO and CISO provide periodic reports to the Audit Committee on the Company's data privacy and information and infrastructure security programs, including cybersecurity risks. In addition, senior management reports to the Board of Directors at least annually on cybersecurity risks.

companyName: Frontier Communications Parent, Inc.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a portion of our workforce has the option to work remotely. We leverage internal auditors to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: of Cybersecurity Risks The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to the Company's risk management, including risks associated with cybersecurity threats. The Chief Compliance Officer will periodically report to the Board on cybersecurity matters, such as the overall state of the Company's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and material cybersecurity incidents.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: Information Security Program Our Vice President of Information Technology and his information security team provide regular reports to the Chief Operating Officer and other relevant teams on various cybersecurity threats, assessments and findings. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors or other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. Our management team identifies and assesses information security risks using industry practices, including those informed by the National Institute of Standards and Technology.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our information technology systems or those of our third party service providers could subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares to decline" under Item 1A of this Annual Report Form 10-K.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: Vulnerability Assessments and Penetration Testing We hire an independent third-party cybersecurity firm to perform penetration testing annually. The third-party checks for vulnerabilities on our external and internal network perimeters. If vulnerabilities are found, corrective actions are implemented to remediate any issues.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: nCino conducts annual cybersecurity risk and threat assessments which include detailed control analyses for measuring both inherent and residual risk factors. These assessments are performed by nCino Information Security as part of the ISO 27001 ISMS requirements. Our annual risk assessment is performed by using the nCino ISO 27001 risk assessment as a basis for risk identification, with additional assessments to address risks that threaten the achievement of the control objectives as appropriate. Threats to security, confidentiality, and availability are identified and assessed as part of our annual and routine risk assessments.

companyName: nCino, Inc.

ticker: NCNO


text: The Risk Committee is appointed by the Board and is authorized to perform its functions in assisting the Board with fulfilling its fiduciary responsibilities with respect to its oversight and assessment of S&T's enterprise-wide risk management framework. The Risk Committee oversees risk from cybersecurity threats as a part of its oversight of the ERM Program. The Risk Committee regularly reviews reports from, and has discussions with, S&T's Chief Risk Officer, or CRO, Chief Operating Officer, or COO, CSO, and Director of Operational Risk Management regarding cybersecurity risks, the threat landscape, updates on incidents and reports on our investments in cybersecurity risk mitigation and governance. The Risk Committee chairperson reports activities and recommendations with respect to such matters to the Board as are relevant and deemed appropriate by the Risk Committee. In the event of a material cybersecurity event, the CSO is responsible for promptly reporting such incidents to the CRO, executive management and the Board. A special meeting of the Board will be held, as deemed necessary by the Chairperson of the Board in consultation with the Chair of the Risk Committee.

companyName: S&T BANCORP INC

ticker: STBA


text: The Sub-Advisor has developed a comprehensive incident response plan and established a Cybersecurity Task Force which leads the effort for enhancing data protection practices and is responsible for administering the cybersecurity policy and determining and implementing the appropriate technical and organizational measures within the firm for the safeguarding of sensitive data. The Director of Information Technology at the Sub-Advisor is primarily responsible for assessing cyber risk and bringing risks to the attention of the other members of the Cybersecurity Task Force. The Sub-Advisor has also engaged a third-party to assist with tasks such as planning incident response plans, conducting tabletop exercises, conducting phishing exams, etc.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports, as applicable, to senior leadership and the Audit Committee.

companyName: Xometry, Inc.

ticker: XMTR


text: Since September 2022, we have engaged a seasoned cyber consultant from the global cybersecurity risk firm, Kroll, LLC, to provide CISO-level advisory services to assist our technology teams, business leadership and Board of Directors with guidance and direction as we strengthen our security systems and improve our cyber readiness, as well as to provide insight and intelligence on existing and emerging threat landscapes. The scope of service includes reviewing our current information security policies, past and current security reports, cybersecurity program, and staffing models to assess our ability to prevent and respond to cyberattack incidents and mitigate any impacts they may have.

companyName: Century Communities, Inc.

ticker: CCS


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Fund's Chief Compliance Officer and Adviser's Director of IT regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and any cybersecurity incidents impacting the Fund.

companyName: Stone Point Credit Income Fund


text: Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents.

companyName: LEGACY VENTURES INTERNATIONAL INC.

ticker: LGYV


text: Role of Management/Board The Senior Vice President of Information Technology (the "IT Officer"), along with the broader Information Technology function, is responsible for assessing and managing Aquestive's cybersecurity risk and informing senior management and the Audit Committee of the Board regarding cybersecurity risks and the prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Officer reports to the Chief Executive Officer and leads our cybersecurity program. Our IT Officer has been responsible for this function at Aquestive for 10 years and has over eleven years of experience in information security strategy and the management of cybersecurity risk. The internal Aquestive IT team has over fifteen years of technical experience, program management and architecture experience in managing cyber risk and information security.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: We have established physical, electronic, and organizational measures to safeguard and secure our systems to prevent a data compromise. These approaches vary in maturity across our business and we work to continually improve them.

companyName: HCW Biologics Inc.

ticker: HCWB


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. See " Item 1.A Risk Factors – We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Stock and our ability to pay distributions. " for more details on how cybersecurity threats are reasonably likely to materially affect the Company including its business strategy, results of operations, or financial condition. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Lafayette Square USA, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A: Risk Factors" above for additional information on risks related to, for example risks related to cyber-attacks, information and system breaches, and technology disruptions and failures; our reliance on using and protecting certain intellectual property rights; keeping pace with technological developments; legal and regulatory developments; and obtaining hardware, software and operational support from third-party vendors.

companyName: Funko, Inc.

ticker: FNKO


text: As a global cybersecurity provider, cybersecurity risk management is integral to our company. Historically, the Audit Committee of our board of directors (the "Audit Committee") was responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. However, due to the importance of cybersecurity to our company, in July 2024, our board of directors formed Cybersecurity Committee of our board of directors (the " Cybersecurity Committee "), which is solely dedicated to cybersecurity risk management. Our executives with responsibility over cybersecurity, including our Chief Information Security Officer, provide quarterly reports to the Cybersecurity Committee as well as to the Chief Executive Officer and other members of our senior management as appropriate. Each member of our board of directors is invited to attend all meetings of the committees of our board of directors, including the Cybersecurity Committee, and thus all of the members of our board of directors are apprised of cybersecurity developments. The quarterly reports to the Cybersecurity Committee include updates on cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Cybersecurity Committee. We also actively engage with key vendors and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. The Cybersecurity Committee also receives prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved or otherwise addressed.

companyName: Fortinet, Inc.

ticker: FTNT


text: The following factors, among others, are considered by the Company in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and severity of risk; impact on the Company and others, if a risk materializes; feasibility and cost of controls; and impact of controls on operations and on others. The specific controls used by the Company vary based on the specific systems, but usually include firewalls, intrusion prevention and detection systems, anti-malware technical safeguards and access controls, endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring using security information and event management (SIEM), multi-factor authentication (MFA), vulnerability and patch management, third-party dark web monitoring and threat-intelligence services.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: We believe we maintain an information technology and security program appropriate for a company of our size, taking into account our operations and risks. We recognize the critical importance of maintaining the trust and confidence of our investors, employees, customers and vendors. Our cybersecurity policies and processes are integrated into the Company's enterprise risk management program. We have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes include mechanisms, controls, and certain technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with an outside information technology consultant on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: The Board of Directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board receives at least quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President, Administration as well as other members of the senior leadership team.

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: Cybersecurity risk management is embedded in the annual enterprise risk management ("ERM") process, which is jointly administered by the Chief Financial Officer and head of Internal Audit and overseen by the Board of Directors, primarily through the Audit Committee. As part of the ERM process, senior management annually, or more frequently as necessary, identifies, assesses and evaluates enterprise level risks using a range of tools and services.

companyName: Frontier Communications Parent, Inc.


text: Central to our governance approach is the involvement of our Audit Committee, which maintains oversight over the Company's cybersecurity strategy.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely on our information technology (IT), operational technology (OT), and a number of complex business systems to assist with the management of our business and customer and supplier relationships, and a disruption of these systems, including from cyber-attacks, could adversely affect our business."

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: The Audit Committee regularly reviews our cybersecurity and other technology risks, controls and procedures. The Audit Committee receives reports from the CIO quarterly regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. The Company's Information Technology Security Team and its cybersecurity infrastructure is overseen by the CIO who reports to the Chief Executive Officer. The CIO has served in various roles in information technology for over 30 years.

companyName: UNIFI INC

ticker: UFI


text: The Company also educates and shares best practices globally with its employees to raise awareness of cybersecurity threats. As part of our onboarding process, we train all new employees on cybersecurity and conduct an annual retraining of all employees on cybersecurity standards. Training also includes how to recognize, report and properly respond to phishing and social engineering schemes. Multiple phishing simulation exercises are conducted throughout the year to increase cybersecurity awareness. Our cybersecurity defenses also utilize technologies such as next generation firewalls, Zero Trust architecture, intrusion detection and prevention measures, anti-malware software, advance threat protection, multifactor authentication, network segmentation and encryption to ensure the security of West intellectual properties, customer and vendor data. In addition, we have a dedicated 24-by-7 Security Operations Center to facilitate the monitoring of the Company's cybersecurity landscape and associated applications.

companyName: WEST PHARMACEUTICAL SERVICES INC

ticker: WST


text: We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by our assessments, audits and reviews. Such processes include (i) procedural and technical safeguards, (ii) response plans, (iii) periodic tests on our systems, (iv) incident simulations and (v) routine review of our cybersecurity policies and procedures to identify risks and improve our practices. We engage certain external cybersecurity firms to enhance our cybersecurity oversight. We include confidentiality provisions in all contracts with third-party service providers, and data protection provisions in certain contracts with third-party service providers where applicable, to help protect us and our employees and patients from any related vulnerabilities.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: • The Board of Directors conducts informed oversight of our risk management processes. The Audit Committee of the Board of Directors has primary responsibility for oversight of enterprise risk management and cybersecurity risk management. Reports on enterprise and cybersecurity risk, risk treatment plans, and key performance indicators of our cybersecurity program are provided to the Audit Committee by management, including our Chief Information Security Officer (CISO), on a quarterly basis and are provided to the Board of Directors as requested and as part of routine Audit Committee updates to the Board of Directors. • The Executive Leadership Team (ELT), a cross-functional leadership group that includes our Senior Vice President, Information Systems, is responsible for assessing and managing enterprise risks, including cybersecurity risks. The ELT reviews enterprise and cybersecurity risks, risk treatment plans, and key performance indicators regarding the Company's enterprise risk and cybersecurity risk management programs quarterly. • The CISO is responsible for cybersecurity strategy and reporting on cybersecurity risks to the ELT, Audit Committee, and Board of Directors. The CISO collaborates with a cross-functional group of the Company's business leaders to assess cybersecurity risk, establish and monitor cybersecurity processes, and report program effectiveness. Our CISO has over 25 years of cybersecurity and Information Technology experience across multiple industries with expertise in governance, risk and compliance, cybersecurity operations and cybersecurity engineering. • The Cybersecurity Advisory Committee supports cybersecurity risk assessment, advises on program enhancements, and acts as a cybersecurity advocate across the business. The committee is comprised of employees with extensive experience across a diverse range of disciplines. • All employees are responsible for adherence to the Company's cybersecurity processes and for remaining vigilant to potential cybersecurity threats. This employee commitment to operational excellence is strengthened by ongoing cybersecurity education, training, and awareness programs.

companyName: Infinera Corp


text: The business of the Company is managed with the oversight of the Board of Directors. The Board of Directors has delegated to the Audit Committee the responsibility to discuss guidelines and policies governing the process by which our senior management and the relevant departments and functions of the Company assess and manage our exposure to risk. As part of that responsibility, the Audit Committee regularly reviews our exposure to cybersecurity risk, the effectiveness of our cybersecurity, and the knowledge, experience and capabilities of the Audit Committee and management with respect to cybersecurity and cybersecurity risk. The Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide regular briefings to the Audit Committee, including on current and emerging cybersecurity threats, ongoing priorities and strategies to mitigate cybersecurity risk, and compliance with various regulations. In addition, our CIO and CISO periodically update the Board of Directors regarding the Company's cybersecurity efforts.

companyName: Brookdale Senior Living Inc.

ticker: BKD