text: We utilize information technology that enables our operational leaders to access and share with their peers, both clinical and financial performance data in real time. Armed with relevant and current information, our operation leaders and their management teams can share best practices and the latest information, adjust to challenges and opportunities on a timely basis, improve quality of care, mitigate risk and improve both clinical outcomes and financial performance. We have also invested in specialized healthcare technology systems to assist our nursing and support staff. We have installed software and touch-screen interface systems in each operation to enable our clinical staff to monitor and deliver patient care and record patient information more efficiently. We believe these systems have improved the quality of our medical and billing records, while improving the productivity of our staff. Such uses of information systems give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage and inadvertent release of information.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. In collaboration with our external vendors specializing in cybersecurity management, we routinely assess material risks from cybersecurity threats, including any potential unauthorized access to our information systems that could result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA

secItem: Item 1C


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI") and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: While risks from cybersecurity threats have not materially affected nor are they currently expected to materially affect the Bank's business strategy, financial condition or results of operations, the Bank has invested and expects to continue to invest significant resources to maintain and enhance its cybersecurity program.

companyName: Federal Home Loan Bank of Dallas


text: The Company maintains a global presence, with cybersecurity threat operations operating 24/7 around the world with a specific goal of detecting, containing and responding to cybersecurity threats and incidents.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all companies, we face a risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – Risks Related to Our Operations – "Cybersecurity breaches or disruptions of our information technology systems could negatively impact our operations," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: We are aware that we must continuously evolve our controls to address new threats, adhere to changing laws and standards, and reduce the risk associated with the introduction of new, innovative technology. While all of our employees play a part in information security, cybersecurity, and data privacy, oversight responsibility is shared by the Board, its committees, and management, as further highlighted below.

companyName: US Foods Holding Corp.

ticker: USFD


text: The Registrants have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. While PPL has not determined any cybersecurity incidents have materially affected the Registrants, including their business strategy, results of operations or financial condition, there can be no guarantee that the Registrants will not be the subject of future, successful attacks, threats or incidents, which may be material.

companyName: PPL ELECTRIC UTILITIES CORP


text: Our cybersecurity program includes: • Processes to assess cybersecurity risk, designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise information technology environment; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity controls; • cybersecurity awareness training of employees, incident response personnel, including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to sensitive data or information.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: The Board of Directors has tasked the Audit Committee with overseeing the Company's cybersecurity risk management processes and determining which threats are likely to impact the Company's strategy, business operations, and financial condition. Pursuant to its charter, the Audit Committee of the Board of Directors reviews the Company's policies regarding information technology security and protection from cyber risks.

companyName: OptimizeRx Corp

ticker: OPRX


text: Process for Assessing, Identifying and Managing Material Cybersecurity Risks The proper function, availability, and security of our and third-party information systems are critical to our business. We have attempted to structure our cybersecurity program and its incident response policies and procedures, including an incident response plan (the "IRP"), around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which provides best practices to identify, protect from, respond to, and recover from cyber attacks. The cybersecurity program, led by our chief security officer ("CSO"), consists of dedicated internal IT security employees, including the staff of a security operations center, and long-term third-party security service providers. Our IT security staff, led by our CSO, is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. In furtherance of our cybersecurity program, members of our internal security staff participate in industry and governmental cybersecurity cooperative groups, including the Health Information Sharing and Analysis Center ("H-ISAC") and the FBI's InfraGard.

companyName: Encompass Health Corp

ticker: EHC


text: Board Governance The members of the Boards of Directors of the Company and the Bank are identical. The Bank's Board of Directors oversees cybersecurity risk management and strategy for both entities through management updates regarding the policies, practices and security results related to the Gramm-Leach-Bliley Act, IT risk management, IT security metrics, penetration testing, tabletop exercises, IT risk assessments, disaster recovery testing, and security awareness testing and training. Management is responsible for designing and implementing policies, processes and procedures, and deploying physical and virtual technology and safeguards to measure, monitor, and control cybersecurity risk. The Bank's Chief Information Officer provides an annual comprehensive update to the Board of Directors on the status of IT, and the plans for the future as well as quarterly updates which include any cyber incidents. The Bank's Chief Information Officer or delegate provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any. Cyber incidents with (i) the potential of materiality, pursuant to SEC cybersecurity disclosure rules; (ii) anticipated publicity; or (iii) anticipated written notices to a significant number of customers; have been promptly reported to the Board with ongoing updates during regular Board meetings. The Bank's Chief Information Officer presents updates on new security measures, programs and services to ITOC. The minutes and materials from the ITOC meetings are available to the Board of Directors on the Directors' Board Portal. The Bank's Information Security Officer provides the Board of Directors with an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc. This annual report also includes an independent third-party assessment of the Bank's information security systems together with information on steps taken to address any identified weaknesses. The Board of Directors also participates in an annual evaluation of enterprise risk and is presented with management's assessment of the top risks, which generally include several cybersecurity components.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Role Managing Risk The Chief Information Security Officer ("CISO") and the Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks.

companyName: SideChannel, Inc.

ticker: SDCH


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: AIM ImmunoTech Inc.

ticker: AIM


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our President, Chief Technology Officer, General Counsel, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crisis, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Our Cybersecurity Program Given the nature of our business and the cybersecurity risks we face, we have a robust cybersecurity program for identifying, assessing, and managing cybersecurity risks, which include material risks from cybersecurity threats, to our internal systems, our products, services and programs for customers, and our supply chain. Our cybersecurity program is made up of two components: our enterprise cybersecurity program and our cybersecurity program for our products and services.

companyName: RTX Corp

ticker: RTX


text: We have not encountered cyber security challenges that have materially impaired our operations or financial condition. Additional information regarding risks from cyber security threats is provided at "Item 1A. Risk Factors."

companyName: TOMI Environmental Solutions, Inc.

ticker: TOMZ


text: Key security, risk, and compliance personnel across a cross-functional group of internal stakeholders, including senior management, meet regularly to develop and continually evaluate our cybersecurity policies and procedures, including discussions of the following: • cybersecurity strategies for preservation of the confidentiality, integrity and availability of company and customer information; • identification, prevention and mitigation of cybersecurity threats and incidents; and • effective response to cybersecurity incidents (including escalation procedures of certain cybersecurity incidents so that decisions regarding public disclosure and other required reporting can be made by the appropriate personnel in a timely manner).

companyName: Rackspace Technology, Inc.

ticker: RXT


text: In the absence of a permanent CISO at December 31, 2023, the Company contracted an interim CISO who previously had served as the Company's interim CTO from July of 2022 through October of 2023. Additionally this contractor served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer and Chief Technology Officer of two large public financial services companies. The interim CISO has also performed Information Security leadership roles in two technology companies assessing and managing cyber risk on large amounts of data.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Management's Role in Cybersecurity Risk Management The Fund's management, including the Fund's CCO and a Technology Risk and Information Security Committee (the "Committee") established by the Investment Adviser, manage the Fund's cybersecurity program. The CCO of the Fund oversees the Fund's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's CFO, General Counsel, and Director of Information Technology. The CCO has been responsible for this oversight function since the Fund's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Fund.

companyName: John Hancock Comvest Private Income Fund


text: No risks from cybersecurity threats have materially affected, nor has LP identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, LP, including our business strategy, results of operations or financial condition. Please see "Risk Factors – Business and Operational Risk Factors – Cybersecurity risks related to the technology used in our operations and other business processes, as well as security breaches of Company, customer, consumer, employee, or vendor information, could adversely affect our business" in Item 1A of this annual report on Form 10-K for additional discussion of cybersecurity risks applicable to LP.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: To help ensure disaster recovery and business continuity, Tyler maintains a business continuity plan with comprehensive procedures designed to recover Tyler and client assets quickly and effectively following a service disruption. Tyler's policies and procedures with respect to disaster recovery, as well as its process to help recover critical technology platforms, data center infrastructure, and operations, are updated regularly, tested annually, and reviewed by third-party auditors. We also partner with our Internal Audit team to regularly assess and respond to evolving risk management findings.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Our chief executive officer and chief financial officer oversee the details of our information security risk management approach and may appoint team leads from various departments from time to time to assist with certain aspects of our cybersecurity risk mitigation strategy.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: Carrying out regular trainings and tests, including phishing simulation tests, to ensure the Company's associates remain vigilant with regards to cybersecurity threats.

companyName: National Bank Holdings Corp

ticker: NBHC


text: We have a written incident response plan that uses a severity classification process to identify incidents to escalate to executive management and determine whether the impact of the incident is material. We also conduct periodic trainings and tabletop exercises to enhance incident response preparedness. We are a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo initial cyber security awareness training when hired and maintenance cybersecurity awareness training annually.

companyName: GUESS INC

ticker: GES


text: The operations of AEP's electric utility subsidiaries are subject to extensive and rigorous mandatory cyber and physical security requirements that are developed and enforced by NERC to protect grid security and reliability. AEP's enterprise-wide security program includes cyber and physical security and incorporates many of the guidelines set forth in the National Institute of Standards and Technology Cybersecurity Framework. AEP has a primary and a back-up NERC Critical Infrastructure Protection Senior Manager, who is responsible for ensuring alignment of compliance with the enterprise-wide security program.

companyName: AEP Transmission Company, LLC


text: Additionally, at least annually, our Chief Audit Executive, who manages the day-to-day activities of our ERM program, reports to our Board of Directors on enterprise risk assessment under our ERM program, providing updates on key risks, status of mitigation efforts and residual risk trends, including an analysis of cybersecurity risks. Also at least annually, our Chief Information Security Officer reports to the full Board of Directors on cybersecurity matters related to or impacting our company and our business.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: We have never had a breach of cyber-security at any point in our past. The risk to us of cybersecurity threats is in data storage of customer questions and emails. A breach of customers' data could negatively materially affect our public trust and could result in loss of customers and revenue.

companyName: IIOT-OXYS, Inc.

ticker: ITOX


text: The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company. Additionally, the CCO provides updates to the Board on any reported incidences of the Company's service providers. The CCO informs the Board of material cybersecurity matters as they arise.

companyName: First Eagle Private Credit Fund


text: As an important cybersecurity risk mitigant, E2open provides mandatory training to its new hires and existing employees on a regular basis, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.

companyName: E2open Parent Holdings, Inc.


text: We continue to enhance our capabilities in cloud security and assurance testing, security operations and automation, product security, and enterprise risk management. To combat the evolving cybersecurity risk landscape and the enhanced level of sophistication of cybersecurity threats, management has prioritized five areas of our information security program: global standards and operations, a risk-aware workforce, product security, detection and response, and data governance management. In addition, we maintain cybersecurity insurance; however, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Dayforce, Inc.

ticker: DAY


text: Board's Oversight Role. Our Audit Committee reviews and assesses our risk management program and cybersecurity activities and strategy to help align with our business objectives and compliance with legal and regulatory standards. These updates include reviews of new or evolving cybersecurity threats, our cybersecurity measures, the results of recent third-party security audits, and assessments and oversight of any recent cybersecurity events with certain characteristics that may have occurred. This oversight role includes evaluating the effectiveness of policies and procedures designed to protect our assets and sensitive customer information from cyber threats. The Chair of our Audit Committee regularly reports on our Audit Committee's oversight activities related to enterprise risk management and cybersecurity to our full Board of Directors. The Information Security Coordinator promptly notifies the Chair of our Audit Committee of any significant security events reviewed by the SIRT, the SIRT's determination of whether a security event is reportable on Form 8-K pursuant to the SEC Cyber Rule and the factors underlying that determination. If the SIRT determines that a cybersecurity incident is likely material and therefore reportable on Form 8-K, a draft of the Form 8-K will be provided to our Audit Committee for review and comment prior to us filing the Form 8-K within the deadline specified by the SEC's cybersecurity disclosure rules. Our Audit Committee's active engagement with and oversight of our cybersecurity program helps foster a culture of security awareness throughout our company.

companyName: EVgo Inc.

ticker: EVGO


text: The Company is subject to risks associated with cybersecurity threats. Although the Company has not experienced a cybersecurity incident that materially affected or, to the Company's knowledge, is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, the Company has, from time to time, experienced threats to and breaches of its data and systems. The Company faces risks associated with security breaches through cyber attacks, cyber intrusions, or otherwise, as well as other significant disruptions of its information technology networks and related systems. These risks are described in more detail under Item 1A. Risk Factors.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: The Information Security Management Committee (ISMC) and Enterprise Risk Management Committees (ERM) meet regularly to provide oversight of cyber risk management functions. Committee composition includes members from cross-functional departments, including technology, innovation, human resources, accounting and finance, internal audit, operations and executive management. Various members of these committees hold industry certifications representing expertise in information security risk and compliance management, including the Certified Information Technology Professional (CITP), Certified Information Systems Security Professional (CISSP), Certified Information Security Auditor (CISA), and Certified in Risk and Information Systems Control (CRISC) designations. SUN COMMUNITIES, INC.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: Our Board of Directors is responsible for oversight of risks to the Company, and is assisted by the Audit Committee in the oversight of cybersecurity risks. Management updates the Board on at least an annual basis on key cybersecurity activities. In connection with this oversight, the Audit Committee monitors the quality and effectiveness of the Company's cybersecurity program covering security of its internal information technology systems and its products and solutions as well as our cyber incident response plan and resources. The Audit Committee regularly receives updates from management about prevention, detection, mitigation and remediation of cyber threats, including the overall status of the Company's cyber security program, results of third-party assessments, and recent cyber threats. In addition, the Audit Committee reviews the Company's cyber security investment methodology to determine whether cyber maturity improvements and risk reductions are being made.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Our enterprise security team works closely with our senior management, information technology, legal, and compliance teams to develop, implement, assess, and improve our information technology security program, compliance, and controls, as described in more detail above under "—Cybersecurity Risk Management and Strategy." By engaging in the development, implementation, assessment, and improvement of our information technology security program, compliance, and controls, the enterprise security team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. As described in more detail above under "—Board of Directors Oversight," our CISO reports to the Board of Directors regarding cybersecurity risks and cybersecurity incidents and also works with the Audit Committee to evaluate the program, compliance, and controls in place to address cybersecurity risks and cybersecurity incidents.

companyName: Finance of America Companies Inc.

ticker: FOA


text: As part of our company-wide culture of security, we maintain a formal cybersecurity and information security program that is aligned with the standards set forth by the International Organization for Standardization ("ISO"), the American Institute of Certified Public Accountants in Systems and Organization Controls 2, the Criminal Justice Information Services, the Federal Risk and Authorization Management Program and the National Institute of Standards and Technology. The Company's Information Security Team maintains the program, which is designed to ensure proper monitoring, prevention, detection, mitigation and remediation of cybersecurity vulnerabilities, including the prompt investigation and management of all reported or discovered security events, including cybersecurity threats and incidents, in the ordinary course of the business of the Company.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: A cross functional team, including Finance, Legal, Risk and the Information Technology departments, in conjunction with others as needed, are involved in the materiality assessment of cybersecurity threats and incidents. The factors considered in the assessment of materiality include, but are not limited to, the probability of an adverse outcome, actual and expected direct and indirect costs stemming from the incident, the possibility of litigation or regulatory investigations, and the nature and extent of harm to policyholders, cedents, vendor relationships, and the Company's reputation and competitiveness. Conclusions are reviewed and approved by the Company's CEO, CFO and CRO.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: Union's IT Steering Committee has representation from the following departments: information technology, information security, other department leaders and stakeholders, and Union's senior management team. This Committee receives regular updates on the state of Union's cybersecurity program, including any incidents, as well as approving information technology or information security related projects and proposals. These team members are also responsible for the resolution of any findings and implementation of recommendations from internal and external audits and examinations.

companyName: UNION BANKSHARES INC

ticker: UNB


text: The Company's Audit Committee and Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's Chief Information Officer ("CIO") provides quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's processes, program and initiatives for managing these risks.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: Additionally, we assess data risks using privacy impact assessments and manage these risks in close alignment with data governance, operations, and analytics teams. We identify assets and their criticality to business operations and provide reasonable protection, threat detection, response and recovery capabilities.

companyName: TYSON FOODS, INC.

ticker: TSN


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of this program are based on recognized best practices and standards for cybersecurity and information technology, including those set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Among the key elements of our cybersecurity risk management program are the following: • Security Awareness and Training - We use an IT security awareness program consisting of training on the fundamentals of information security protection. These training courses are provided annually to all employees. • Annual Risk Assessment - An annual risk assessment is conducted by a third party, which is designed to assess the effectiveness of the Company's security controls and to identify key risks. • Network Protection - Network protection, detection, and monitoring technologies have been deployed on all external and internal network connections to segment different sections of the business from each other to strengthen key protection capabilities. • Identity and Access Management - We have implemented user authentication controls on the Company's systems, devices, data and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to systems and networks. • Penetration Testing – We have partnered with a third-party penetration testing company to help identify new vulnerabilities and continuously improve the security posture of the Company through annual testing. • Endpoint Detection and Response ("EDR") – EDR is an integrated, layered approach to endpoint protection that uses continuous monitoring and data analytics. We have partnered with a third-party security operations center, to provide critical support in monitoring, identifying and assessing cyber threats such as malware, ransomware, breaches, and denial of service attacks. • Security Incident Management - In the event of a cybersecurity incident, we have established an incident response plan, which outlines clear protocols for incident detection, containment, investigation, and resolution, aiming to minimize the impact on our operations, customers, and stakeholders.

companyName: AZZ INC

ticker: AZZ


text: Collaborative Approach: We utilize a cross-functional strategy, involving key security, risk, and compliance stakeholders, to preserve data confidentiality and manage cybersecurity threats. Technical Safeguards: Regular assessments and updates of technical safeguards are based on ongoing vulnerability analyses and threat intelligence.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Chief Financial Officer plays a pivotal role in informing the Board of Directors on cybersecurity risks and provides briefings to the Board of Directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and industry standards.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: To achieve this, we have implemented a comprehensive cybersecurity risk management framework, which is integrated into our overall enterprise risk management system and processes and is internally managed.

companyName: AIRWA INC.

ticker: YYAI


text: Monitoring, Testing and Auditing We monitor the evolving cybersecurity landscape that could result in new or increased cybersecurity threats. We also engage in the periodic assessment and testing of our policies, standards, processes and practices. These efforts include audits, vulnerability and penetration testing, tabletop exercises, social engineering campaigns and other internal and external assessments. We evaluate the effectiveness of our information technology-related internal controls annually.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Risks from Cybersecurity Threats As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I, Item1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences. "

companyName: Personalis, Inc.

ticker: PSNL


text: Our CISO is accountable for managing our enterprise cybersecurity department and delivering our cybersecurity program. The responsibilities of this department include privacy, resiliency, cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third-party risk management and business resilience as it relates to the cybersecurity program.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks. We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including personal information, intellectual property and proprietary information. • Cybersecurity incident responses plan and testing. We have a cybersecurity incident response plan and dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have a Managed Security Service Provider, or MSSP, that is responsible for leading the initial assessment of priority and severity. Our cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise level. • Training. We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations and industry risks. • Supplier risk assessments. We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for us to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Our third-party assessments. We have third-party cybersecurity companies engaged to periodically assess our cybersecurity posture and to assist in identifying and remediating risks from cybersecurity threats.

companyName: NorthStar Healthcare Income, Inc.


text: We have implemented and maintain various processes, procedures, and measures to support our overall risk management strategy and to manage and mitigate the material risks posed by cybersecurity threats to our systems and data. With respect to cybersecurity, these measures include conducting risk assessments of our operations and using a risk register to assess identified risks; developing business continuity, disaster recovery and incident response plans; implementing technical safeguards and tools; conducting ongoing cybersecurity awareness training; and using contractual protections where appropriate. Our incident response plan outlines the procedures for reporting, investigating, and remediating cybersecurity incidents, including a framework to facilitate the escalation to our management team and board of cybersecurity incidents, so that our management team is alerted in a timely manner to material information that would be required to be disclosed or reported.

companyName: Celcuity Inc.

ticker: CELC


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. To keep our network secure, we have multifactor authentication (MFA) for all users, a password change policy, separation of duties in accounting systems, controlled access to network drives, endpoint protection, email security, mobile device management, device encryption, and ongoing active monitoring of threats. We have implemented devices designed to control third-party access to our plant systems and also provide 24/7 monitoring of our infrastructure.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The Divisional Vice President of IT has a biannual meeting with the Audit Committee and other senior executives to provide an update of our current cyber security posture, IT Risk assessment, and compliance with multiple applicable regulations, frameworks, and other privacy initiatives. The Divisional Vice President of IT, along with the Information Technology Leadership Team, also meet with other senior executives every other week throughout the year to discuss on-going cyber security and governance initiatives and risk mitigations. The Divisional Vice President of IT has fifteen years of cybersecurity experience, including ten years with Mistras Group, and the Information Technology Leadership Team has a combined fifteen years of cybersecurity experience, including a combined ten years with Mistras Group. The Divisional Vice President of IT and members of the Information Technology Leadership Team maintain industry recognized credentials relevant to their roles.

companyName: Mistras Group, Inc.

ticker: MG


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Operating Officer. This individual has over twenty years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. The Chief Operating Officer, along with the Company's managed services provider, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the Chief Operating Officer reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: In the event of a potential material risk, the risk is reported to the Chief Information Security Officer, the Chief Technology Officer, and to the appropriate member of senior management responsible for the function where the risk has been identified. The risk is then reviewed by the Disclosure Committee, which includes among others, the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, and Chief Accounting Officer to make a determination of whether the risk is material.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: Our CFO is principally responsible for overseeing our cybersecurity risk management program in partnership with other Company management. We believe our business leaders, including our CFO, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats. Our CFO collaborates with other Company business leaders and our third-party service provider to maintain a program designed to manage our exposure to cybersecurity risks and to respond to cybersecurity incidents promptly.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our IT Systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • designing products and services built with security tools; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our IT Systems, information, products, services, or our broader enterprise IT environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: Our CISO has 25 years of industry experience, including in developing and leading cybersecurity risk management programs for Fortune 100 companies. Additionally, our CISO and members of the cybersecurity team hold a number of industry recognized certifications, such as Certified Information Systems Security Professional, Payment Card Industry Data Security Standard Internal Security Assessor, Certified Information Security Manager, Certified in Risk and Information Systems control, and Certified Ethical Hacker, among others.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: We maintain an information technology and security program appropriate for a company our size, taking into account our operations and risks. The Company recognizes the critical importance of maintaining the trust and confidence of our investors, employees, and vendors. The Company's cybersecurity policies and processes are integrated into the Company's enterprise risk management program and are informed by recognized frameworks established by the National Institute of Standards and Technology, and other applicable industry standards.

companyName: BIOVIE INC.

ticker: BIVI


text: Management Oversight—Our CISO, who reports directly to our CIO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents is described above. He reports information about such risks to the CIO and other members of senior management, who, in turn, report them to our board and audit committee, as appropriate. Our CISO joined the company in August 2022 with over 20 years of risk management, national security and cybersecurity experience garnered at both public and private companies, as well as governmental agencies.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: Cybersecurity risk management is overseen by the full Board of Directors and by the Risk Policy and Capital Committee of the Board. While the Board maintains oversight of cybersecurity risk, the Board has delegated oversight authority at the management level for risk-related matters, including cybersecurity risk matters, to the Enterprise Risk Committee, as described under "Management Role" below.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Anywhere views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection and response to ensure holistic coverage of the program and our environments.

companyName: Anywhere Real Estate Group LLC


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our chief information officer has primary oversight of material risks from cybersecurity threats. Our chief information officer is the senior vice president responsible for the Information Technology Solutions (ITS) organization and for information protection. Our chief information officer has more than 25 years of experience across various engineering, business and management roles, including serving as the vice president of the design and manufacturing ITS organization, leading the development and implementation of information technology strategies and roadmaps for manufacturing automation.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: Internal and External Risk Evaluations An annual Information Technology Audit, which is facilitated by the Internal Audit Department, is conducted via a co-sourcing agreement with a third-party auditor. The objective of the IT audit is to evaluate the effectiveness and efficiency of operations, test the reliability of data and IT controls, and ensure compliance with applicable laws, regulations, guidance, and industry best practices. The audit scope addresses IT Governance, IT Management, IT Operations, and IT Security. Testing of the internal network environment and external network perimeter are included in the Results of the IT Audit and are reviewed with the IS Steering Committee and Company management. For any exceptions identified, a responsible party is assigned, and action plans are developed to address corrective measures. The final results of the IT Audit are reviewed with the Board Audit Committee. The status of unresolved audit issues along with their priority ratings is reported to both Management and the Board Audit Committee at each meeting.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: We have an overarching cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats that includes documented policies and procedures and incorporates a layered cybersecurity defense. We utilize a variety of technologies that target detection of malicious attempts to infiltrate our information systems. We also maintain an endpoint threat detection and response tool which uses artificial intelligence to alert our managed security service provider. On a regular basis, we hire a third-party cybersecurity service provider that performs a penetration test on our information systems. The Company seeks to address vulnerabilities that are found. We also utilize a third-party cybersecurity training company to educate our employees about cybersecurity threats. On a regular basis, we send out test phishing emails with a follow up email explaining to end users the "red flags" in these emails. Where appropriate, we utilize dual-factor authentication on our information systems. On an annual basis we receive system and organization control reports from many of our key external IT vendors as these will reveal any sort of potential security issues these companies have had in the past year.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in specializing in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.

companyName: Invesco Real Estate Income Trust Inc.


text: The Company currently relies on third-party hosting and software providers for its core platform operations, email communications, and data storage. These vendors maintain their own cybersecurity programs, which include network protection, access controls, and incident response procedures. While Mercalot Inc. does not yet employ a dedicated IT security team, its directors are actively involved in overseeing operational and technological risk, including cybersecurity.

companyName: Mercalot Inc.


text: Our CIO and Vice President of Information Security, in coordination with our Legal, Internal Audit, and Compliance teams, work collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our security IRP. To facilitate the success of this program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the CIO, the Vice President of Information Security, and our Cybersecurity Incident Materiality Assessment Council monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: VAIL RESORTS INC

ticker: MTN


text: Our Board of Directors is responsible for overseeing the cybersecurity risk management process and exercises this risk oversight through both our full Board of Directors and its Audit Committee. Our Board of Directors has delegated to our Audit Committee the responsibility to oversee risks related to cybersecurity threats, and our Audit Committee Charter requires our Audit Committee to review and discuss with management the Company's policies with respect to risk assessment and enterprise risk management and to review the risk exposure of the Company related to the Committee's areas of responsibility, including with respect to cybersecurity. In carrying out this role, our Audit Committee meets with our Chief Information Security Officer regularly and receives at least quarterly reports on cybersecurity matters.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our cybersecurity risk management program also addresses cybersecurity risks associated with our use of third-party service providers and our vendors. We proactively manage these risks by reviewing current and prospective third-party service providers' compliance with our established relevant privacy and data security standards. We also require our key vendors to complete security questionnaires and we conduct audits and vulnerability scans related to them. Depending on the nature of the services provided and the sensitivity of the relevant data involved, our service provider and vendor management processes may involve different levels of assessment and impose additional obligations related to cybersecurity on the service provider or vendor.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under Item 1A. "Risk Factors," specifically the risks titled "We could be negatively impacted by security threats, including cyber security threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: The Security Program is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2023, has over 10 years of experience leading cybersecurity programs in a large, publicly traded, international enterprise, and is a Certified Information Systems Security Professional ("CISSP"). Our Executive Security Steering Committee ("ESSC"), comprised of selected members of leadership, assesses and manages any material risks from cybersecurity threats and manages our Security Program. The CISO and information security team provide regular updates to the ESSC on our Security Program and, in accordance with our security incident response plan, escalate applicable cybersecurity threats or incidents to the ESSC for review and management. SPS COMMERCE, INC.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, which is led by our General Counsel and Vice President of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing the Company, including from cyber threats. As part of this process, our IT organization assesses cybersecurity risk and evaluates our policies, procedures, skill sets and tools, with the aim to identify and address, as appropriate, areas of vulnerability. Our internal audit team performs testing to assess whether our program is appropriately designed and operating as intended.


text: The Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, and General Counsel comprise the Company's ERM Committee. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: related to Cybersecurity Incidents face significant risks related to cybersecurity threats, which could adversely affect our business, financial condition, and results of operations. Cybersecurity incidents, including but not limited to unauthorized access, data breaches, and other malicious activities, could result in the loss or theft of sensitive information, disruption of our operations, and damage to our reputation. While we have implemented measures to protect our information systems, there can be no assurance that these measures will effectively prevent all cybersecurity incidents.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Chief Information Consultant works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats and, as appropriate, reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: In an era marked by rapid technological evolution, the business landscape is increasingly data-driven. Companies, including ours, collect, store, and leverage data to glean valuable insights about our members and travel trends; deliver relevant content to our members, suppliers, and business partners and enhance operational efficiency. This collection and leverage of data exposes us to potential cybersecurity threats. Our cybersecurity program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"). As a result, we have implemented a cybersecurity risk management framework that is designed to identify, assess, and mitigate risks from cybersecurity threats to our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the data residing on those systems. While no organization can eliminate cybersecurity risk entirely, we believe our cybersecurity program is reasonably designed to mitigate our cybersecurity and information technology risks.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: The program is one component of our enterprise risk management system. The technical, administrative and physical controls underlying our program are based on nationally recognized practices and standards for cybersecurity.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Strategy and Governance Given the importance of the integrity and security of the information and data utilized in our day-to-day operations, our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our overall enterprise risk management framework. We evaluate cybersecurity risks on an ongoing basis, and both our executive management and Board of Directors have an overall responsibility for assessing and managing risks from cybersecurity threats. We have established an information security team which is structured into three areas, each with its own teams and leaders who report directly to our Chief Information Security Officer (CISO): 1) Governance, Risk and Compliance; 2) Architecture; and 3) Operations (Detect and Respond). Our information security team is responsible for the design and execution of our cybersecurity risk management and helps executive management and our Board of Directors stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, including but not limited to, briefings with internal security team members, threat intelligence obtained from public and private sources and alerts and reports produced by security tools deployed within our IT environment. Our current CISO has over 16 years of experience in various roles involving information technology governance and compliance, including cybersecurity, engineering and enterprise architecture, while our Chief Information Officer (CIO) has over 25 years of IT and cybersecurity experience. Our information security team includes professionals with relevant industry, educational and cybersecurity experience.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our security approach is aligned with applicable security and/or technical requirements and best practices established by multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. This does not imply that we meet any particular technical standards, specifications or requirements, only that our information security team uses the NIST CSF, ISO 27001 and other frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – RISKS RELATED TO INFORMATION TECHNOLOGY, CYBERSECURITY AND DATA PRIVACY."

companyName: LANDS' END, INC.

ticker: LE


text: Since 2018 the Company has been primarily focused on pursuing FDA Pre-Market Approval (PMA) for its HemoStyp products to enable it to access the Class III surgical markets and has de-emphasized its commercial operations. We have fewer than 10 employees and consultants and currently use third-party vendors and service providers for certain product development and regulatory approval activities. Most of the information generated and collected by the Company is stored and maintained by these third-party vendors and service providers. Each of these providers has demonstrated its own cybersecurity protocols which our management believes to be adequate for protecting the Company's digital files in their possession. Our CEO (who is also one of the Company's directors) and VP of Finance are responsible for assessing and managing cybersecurity risks. Neither of them have cybersecurity expertise. Due to the current small size and limited commercial operations of the Company, we have no formal cybersecurity policies and processes in place, however, the Board and management believe cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: United Health Products, Inc.

ticker: UEEC


text: Anticipating or preventing all cyber-attacks requires an ever-present focus. A cyber-attack or a security incident leading to a breach could disrupt our business operations, harm our reputation, necessitate compliance with data breach notification laws, and subject us to litigation, regulatory investigation, or other liabilities under laws, regulations, and contractual obligations. This could result in increased costs, significant legal and financial exposure, and reputational damage.

companyName: Li-Cycle Holdings Corp.


text: In an effort to deter and detect cyber threats, we also periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use and mobile security, and further educates employees on the importance of and process for reporting all potential incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The Audit Committee of our Board of Directors (Audit Committee) oversees the Company's overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. The Audit Committee provides periodic reports to the Board of Directors regarding its oversight of cybersecurity, information technology, data protection and related matters. Members of the Board of Directors also participate in table-top exercises involving simulated data security incidents and the Company's responses to those incidents.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: 2018, the United States Securities and Exchange Commission (the " SEC ") published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal laws and regulations. If we fail to observe this regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: As of December 31, 2024, no risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have implemented controls to protect our data and information systems and monitor our systems on an ongoing basis, such efforts may not prevent material compromises to our information systems in the future, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with our consultants that perform the Company's internal audit function regarding opportunities and enhancements to strengthen our policies and procedures.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: MPC applies an enterprise risk management ("ERM") methodology as established and led by the MPC and MPLX GP executive leadership team and overseen by the Board to identify, assess, and manage enterprise-level risks. MPC's cybersecurity risk program directly integrates and is intended to align with MPC's governing ERM program.

companyName: MPLX LP

ticker: MPLX


text: Company recognizes that cybersecurity risks present a growing and evolving challenge. We are committed to protecting our systems, networks, and data from unauthorized access, disruption, or damage that could adversely affect our operations, customers, or stakeholders.

companyName: Eva Live Inc

ticker: GOAI


text: The ERM Committee meets quarterly and oversees the information security program. It approves the broad objectives, strategies and major policies governing the Company's protection of data assets and provides agreement on the definition and scope of the information security framework. Along with reviewing, approving, and prioritizing information security efforts, it reviews and challenges the results and adequacy of information security practices. From an enterprise perspective, the ERM Committee reviews the cybersecurity risk profile on a quarterly basis and reports on cyber risk to the Risk Committee of the Company's board of directors.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: The Audit Committee receives updates from our Chief Information Officer on our cybersecurity risks on a periodic basis or more frequently if needed, and reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, third party service providers and the current and emerging threat landscape. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Our information security management team is informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including managed service providers engaged by us, and alerts and reports produced by security tools deployed in our information technology environment.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: In addition, we have established a Global Cybersecurity Disclosure Committee, a senior-level, cross-functional governance committee comprised of representatives from our Information Technology, Compliance, Finance, and Legal departments, which is engaged during certain cybersecurity incidents to determine further response, escalation and reporting needs. The Global Cybersecurity Disclosure Committee meets quarterly to review information technology risk metrics and as needed in the event of a potentially material security incident, including at the discretion of Vice President of Information Security. The Global Cybersecurity Disclosure Committee is responsible for oversight of the implementation of appropriate remediation for security incidents where required, as well as determining whether to discuss any information security incidents with the Audit and Risk Committee of the Board of Directors and if external reporting is required under relevant laws, regulations or SEC rules. Members of our Global Cybersecurity Disclosure Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging cybersecurity and data privacy risks.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: LGAM Private Credit LLC


text: The Company's Board of Directors provides active oversight of cybersecurity threats in accordance with the Board-approved Information Security Policy and Program. Direct oversight of the Program is delegated to the Audit Committee of the Board of Directors. The Audit Committee has an established risk appetite statement that defines the Company's risk acceptance tolerance. The Audit Committee reviews and approves the Risk Appetite statement annually. The Audit Committee also plays a critical role in overseeing the Bank's efforts to develop, implement, and maintain an effective Information Security Program. With direction and oversight by the Audit Committee, the Bank's Chief Risk Officer ("CRO") oversees the enterprise-wide risk management program, and the Chief Information Officer ("CIO") is the Board-appointed Information Security Officer, responsible for the Information Security Program, including cybersecurity. The CRO and CIO report cybersecurity related matters directly to the Audit Committee.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Audit Committee oversees our risk management process, including the management of risks arising from cybersecurity threats. Our CIO is tasked with reporting any and all matters relating to cybersecurity to the Audit Committee. The Audit Committee receives regular presentations and reports on cybersecurity risks, which including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Audit Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Pluri Inc.

ticker: PLUR


text: Our SVP of Group Operations and our Cybersecurity Steering Committee, which includes our Chief Medical Officer, SVP-Corporate Controller, Executive Vice President of Process Development and Manufacturing, SVP of Preclinical Sciences, and our SVP of Legal Affairs, are primarily responsible for assessing and managing our material risks from cybersecurity threats. As part of our risk identification, assessment, and mitigation activities, we leverage the experience of our external cybersecurity advisor/consultant (CISSP, CISA, CISM, CRISC, QSA) who has extensive cybersecurity expertise across various industries. Our SVP of Group Operations, who manages our cybersecurity program, has over 25 years of experience in the Life-Sciences IT space, with over 8 years in IT security and cybersecurity functions.

companyName: IGM Biosciences, Inc.


text: Our cybersecurity program is integrated into our overall risk management processes. Key elements of our cybersecurity risk management program include, among others: Ongoing cybersecurity training and testing for all employees; Regular patching, vulnerability scanning, penetration testing, and network monitoring; Robust IT infrastructure to help reduce opportunities for adverse exploitation; Operational processes that reinforce cybersecurity policies and IT controls; Regular audits to assess our cybersecurity posture, maturity, and progress;

companyName: Clearfield, Inc.

ticker: CLFD


text: Role of the Board of Directors The Board's oversight of cybersecurity risk management is supported by the EROC, which regularly interacts with the Company's ERM function and the CISO.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: During the year ended December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: Dakota Gold Corp.

ticker: DC


text: As of December 31, 2023, BlackRock is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect BlackRock's business strategy, results of operations, or financial condition. For additional information on whether and how risks from cybersecurity threats are reasonably likely to materially affect BlackRock, see "A cyber-attack or a failure to implement effective information and cybersecurity policies, procedures and capabilities could disrupt operations and lead to financial losses and reputational harm, which may cause BlackRock's AUM, revenue and earnings to decline." under Part I, Item 1A, Risk Factors herein.

companyName: BlackRock Finance, Inc.


text: The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by Cybersecurity Leadership who are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department, including responsibility for leading organization-wide cybersecurity strategy, policy, and processes. Our CIO has served in this role since June 2024 and has over 25 years of cybersecurity experience, including technology positions at the US Army, Accenture, Advance Auto Parts, Finishline Shoes, and PF Chang's. • The VPIT, reporting to the CIO, is responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our VPIT has served in this role since 2020 and has significant relevant experience and professional certifications, including nearly 20 years of cybersecurity and infrastructure experience. The VPIT, along with our cybersecurity team, has guided the organization through building a multi-layer cybersecurity program.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: In addition, we collaborate with GE Aerospace on certain cybersecurity functions and will continue to do so during a transition period following our Spin-Off. These arrangements increase our overall cyber risk given the degree of our interconnectedness with these third parties and the potential impact on our outsourced functions that could be caused by an attack on them.

companyName: GE Vernova Inc.

ticker: GEV


text: The IRP provides our management and information technology personnel with processes and procedures for assessing, identifying, managing and escalating material risks from cybersecurity threats which have been integrated into our overall risk management processes. For example, our enterprise risk management processes involve the identification of events that may arise in the course of operating our business and the potential impact of such events on our business. We have identified and prioritized cybersecurity events as requiring increased managerial focus and urgency in actions taken to mitigate cybersecurity risks due to the potential impact such events could have on our business. Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, it is possible that a cybersecurity incident resulting in a serious compromise of our IT Systems or a demand for payment to restore our IT Systems, could have a material adverse effect on us by negatively impacting our ability to operate our business effectively and by diverting the attention of our management and other resources, including financial resources, to address the cybersecurity incident. Despite our efforts to mitigate the risks associated with cybersecurity threats, we cannot eliminate all such risks or provide assurance that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: Our cybersecurity program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incident. The Company operates a 24 x 7 security operations center (" SOC ") which monitors our global cybersecurity solutions and production environments, and serves as a central location for the reporting of cybersecurity matters. The roles and responsibilities of the SOC and our cybersecurity team in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: We have risk management processes in place for identifying, assessing and mitigating cybersecurity and risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems and other processes that are designed to detect, prevent or mitigate data loss, theft, misuse, unauthorized access, interference with operations, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. Cybersecurity concerns are an important consideration in our application development and the design of our infrastructure and operations technology. We also use systems and processes designed to reduce the impact of a security incident to our clients or their customers. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems that we use for encryption and authentication, employee email, communication to clients and their customers, operational support, and other functions.

companyName: Roadzen Inc.

ticker: RDZN


text: Our Vice President of Information Technology supervises our Information Technology Department (the "IT Department") which coordinates with third -party service providers that perform security management roles, including those of a Chief Information Security Officer, to identify, assess and manage our cybersecurity threats and risks. Our IT Department and security management team, including third -party service providers, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, internal audits relating to cybersecurity, conducting threat assessments for internal and external threats, third -party threat assessments, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds, evaluating our and our industry's risk profile, and evaluating threats reported to us.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Our cybersecurity risk management process is a component of our overall approach to managing material risks that could impact our operations, including cybersecurity threats. In general, we seek to manage material internal and third-party cybersecurity risks through an approach that focuses on: (i) protecting information systems and the information residing therein; (ii) identifying, preventing, and mitigating cybersecurity threats; and (iii) assessing and responding to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program—in an effort to ensure that it remains reasonable and appropriate in light of changes in the security threat landscape, available technology, and applicable legal and contractual requirements—is an ongoing effort.

companyName: Celcuity Inc.

ticker: CELC


text: Our processes also address cybersecurity threat risks associated with our selection and oversight of third-party service providers, including our suppliers and manufacturers or those who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks in specified ways.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Arq, Inc.

ticker: ARQ


text: Using comprehensive risk assessment methodologies, we diligently identify and evaluate potential cybersecurity threats and vulnerabilities across our systems, networks, and data assets. This process includes regular reviews of emerging threats, penetration testing, vulnerability scanning, and thorough analysis of industry-specific risks. We actively participate in industry forums and information-sharing initiatives and collaborate with relevant stakeholders to exchange threat intelligence and best practices.

companyName: NBT BANCORP INC

ticker: NBTB


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Adviser's Chief Information Security Officer ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Barings BDC, Inc.

ticker: BBDC


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annual review of our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: DermTech, Inc.


text: We monitor our information systems for potential cybersecurity issues and assess risks from cybersecurity threats as an element of our overall business risks. To protect our information systems from cybersecurity threats, we use various security tools supporting protection, detection, and response/mitigation capabilities. We also alert employees to significant new cybersecurity issues on a regular basis.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: Our executive management team, with oversight from our Board, is responsible for our enterprise risk management process and the day-to-day supervision and mitigation of enterprise risks, including cybersecurity risk. Our enterprise risk management program includes our executive management team receiving regular reports from our operations personnel. As part of our enterprise risk program, our executive management team has established an enterprise risk committee (the "ERC"), which is chaired by our Chief Risk Officer and is otherwise composed of each of our other executive vice presidents. The ERC oversees our risk and compliance activities to ensure that management has appropriate policies and management plans in place for managing risks of the business, including cybersecurity risk, as well as reviewing and prioritizing significant risks and allocating resources for risk mitigation.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.

companyName: Hyperfine, Inc.

ticker: HYPR


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- Risk Factors.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Despite our efforts to prevent security incidents, (i) some of these attacks have resulted in security incidents (although thus far we do not believe that any of these incidents has resulted in a material adverse effect on our operating results or financial condition) and (ii) future security incidents are likely (some of which could have a material adverse effect on operating results or financial condition). See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.

companyName: QWEST CORP

ticker: CTBB


text: Our management team and IT leadership stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: ARCH RESOURCES, INC.


text: These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.

companyName: Knife River Corp

ticker: KNF


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. We conduct penetration tests and audits of our Information Systems and Data environment with an external cybersecurity firm at least annually.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Accordingly, we recognize the critical importance of protecting and securing these information systems and have implemented multiple layers of cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risk. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Efforts to assess, identify, and manage cybersecurity risk are led by our dedicated Chief Operating Officer ("COO"), and supported by an experienced team, other members of management, and the Board. From time to time, we engage consultants, auditors, and other third parties to assist us in these efforts.

companyName: Torrid Holdings Inc.

ticker: CURV


text: The Sponsor, Fidelity Management & Research LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Ethereum Fund

ticker: FETH


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.

companyName: VIVIC CORP.

ticker: VIVC


text: Cybersecurity risk management is an essential part of our enterprise risk management program. We are committed to maintaining governance and oversight of these risks and to implementing controls, technologies, and processes designed to help us identify, assess, and manage these risks.

companyName: Genpact LTD

ticker: G


text: The Company's Board of Directors is actively engaged in oversight of cybersecurity, and it is part of the responsibilities of our Audit Committee. The Company's Chief Technology and Transformation Officer (CTTO) and President and Chief Executive Officer keep the Board informed on cybersecurity and privacy matters throughout the year, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Ulta Beauty, Inc.

ticker: ULTA