text: The Corporation maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. The Corporation's cybersecurity program is based on the Federal Financial Institutions Examination Council ("FFIEC") framework which tailors the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to be more financial services focused. The risk of cybersecurity threats is integrated into the Corporation's Enterprise Risk Management ("ERM") program, led by the Corporation's Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies. The Corporation's cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the "CITSO"), the VP of Information Technology, and the VP of Information Security. Risk owners regularly monitor cybersecurity risks and the evolving threat landscape and review and update the cybersecurity threat risk action plan in response to newly identified threats or risk mitigation actions. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services. Management reassesses all suppliers on a regular interval.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems.

companyName: Fyntechnical Innovations Inc

ticker: FYNN

secItem: Item 1C


text: As discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business.

companyName: Tradewinds Universal

ticker: TRWD


text: Our response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our President and Chief Operating Officer or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: American Assets Trust, Inc.

ticker: AAT


text: We use third-party service providers to perform a variety of functions throughout our business, such as providing cloud-based infrastructure, hosting third party applications, and delivering content to customers, as well as data center hosting. We have a formal vendor management program designed to manage cybersecurity risks associated with our use of these providers. The procurement organization conducts an initial risk assessment to determine the criticality of the vendor prior to onboarding. Depending on the criticality of the vendor–which is based on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider–our security organization conducts our vendor security review process, which involves different levels of assessment designed to identify cybersecurity risks associated with a provider prior to onboarding and on a periodic basis, including, for example: (1) a vendor security questionnaire; (2) results of audit reports and certifications; and (3) policies and standards detailing the third-party's security program. Based on the results of the vendor security review, a decision is made on whether the third-party can be engaged. We review our most critical providers' audit reports and certifications on a regular basis to reassess whether or not they have experienced any material changes or degradations to their security programs since our initial review that may warrant re-evaluation. The Company generally attempts to engage reputable third-party service providers and when appropriate, imposes contractual obligations related to cybersecurity on its providers.

companyName: Fastly, Inc.

ticker: FSLY


text: To ensure that members of Registrant's Board are informed of material cyberattacks, Registrant's CFO and IT Director have been designated as key members of management that will provide current updates to Registrant's ERM liaison and the Board. The communication will include but not be limited to, the nature and status of the cyberattack and Registrant's plan to contain and mitigate the cyber threat and ultimately the remediation and recovery plan to return to "business as usual" state. Registrant's CFO has over 15 years overseeing the Company's risk management area. Registrant's IT Director has over 25 years in Information Technology designing, implementing and supporting various cybersecurity and technical solutions, along with ensuring compliance with multiple cybersecurity regulations.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Our Chief Information Security Officer is responsible for our overall data security and cybersecurity risk reduction efforts, including information security compliance, training and awareness and application, network and system security. Our Chief Information Security Officer has 25 years of prior experience in the fields of information systems, cybersecurity, risk management, and infrastructure management. Our Chief Information Security Officer holds master's and bachelor's degrees in both Computer Information Systems and Business Administration and the following certifications: Certified Internal Controls Auditor (CICA), Payment Card Industry Professional (PCIP), Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC).

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: We employ third-party information technology ("IT") consultants to manage our information technology environment and help manage and assess cybersecurity risks.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: We use certain third-party service providers to perform a variety of functions that help us operate our business, such as application providers, hosting companies, contract research organizations, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity and information processed, and the identity of the service provider, our vendor management process may include different levels of assessment designed to help identify cybersecurity risk associated with a provider. Such assessments include, for example, reviewing the written security program of such provider and conducting security assessments and audits.

companyName: Pulmonx Corp

ticker: LUNG


text: Our Board is responsible for oversight of our cybersecurity program. The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy ris k, including compliance with all applicable laws and regulations, incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations. Our cybersecurity risk management and internal controls program are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.

companyName: Mistras Group, Inc.

ticker: MG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Cybersecurity risk oversight and management is a top priority for the Company and the Board of Directors. The Company offers a broad portfolio of cybersecurity solutions to its customers, and an understanding of cybersecurity risks is critical to both the Company internally and to our customers and business partners. The Company identifies, assesses, and manages cybersecurity risk as part of both the enterprise cybersecurity program and the enterprise risk management program. The Company's expertise, dedicated resources and proven technology in cybersecurity management are evident in the Company's enterprise cybersecurity program. The Company's Cybersecurity Committee (described below) is a subcommittee of and reports to the Audit Committee, which oversees the enterprise risk management program.

companyName: BELDEN INC.

ticker: BDC


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, which includes the identification, assessment and management of material cybersecurity risks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: Cross-functional management engagement We have established a committee comprised of leaders from key functions across the Company including, but not limited to, information security, IT, engineering, legal, regulatory, medical affairs, finance, research and development, operations, supply chain, marketing and people operations. This committee generally meets quarterly and is responsible for promoting a culture of awareness and accountability related to, among other things, information security. The committee also provides cross-functional input to facilitate the development, articulation, implementation and operation of information security risk management programs.

companyName: Outset Medical, Inc.

ticker: OM


text: The day-to-day management of the Company's cybersecurity framework is managed by the Company's information technology team while operational oversight of its design and function are managed by the Company's management team including, but not limited to, its Chief Operating Officer (COO), Chief Financial Officer (CFO), Director of Industrial Engineering, and Director of Information Technology, all of whom have substantial experience managing enterprise risk, including cybersecurity risks. Our management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our incident response procedures.

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: The Company also maintains an internal, cross-functional Cyber Resiliency Committee, which includes members of senior management from Information Technology, Cybersecurity, Enterprise Risk Management, Internal Audit, Corporate Communications, Legal, Finance and Corporate Physical Security. The Managing Director of Information Security chairs this committee, which is responsible for: • establishing cybersecurity policies and standards that align with our corporate objectives and regulatory requirements; • monitoring compliance with cybersecurity policies and standards across the organization; • ensuring that cybersecurity strategies are integrated with the organization's overall governance structure; • reviewing and approving significant cybersecurity investments and initiatives; • providing guidance on cybersecurity risk tolerance levels and ensuring that cybersecurity risks are communicated to the Audit Committee and Board of Directors; and • facilitating cross-departmental collaboration to address cybersecurity challenges and responses.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: The Board receives periodic reports on our cybersecurity risks and processes from management. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: CHARLES & COLVARD LTD


text: Cybersecurity is a critical priority within, and has been integrated into, our enterprise risk management framework. We have instituted a risk-based, multi-dimensional global cybersecurity program, guided by the framework established by NIST (National Institute of Standards and Technology). This program aims to assess, identify, and manage risks from potential threats to our data, systems and networks, as well as those of our primary third-party suppliers. We have deployed a suite of physical, administrative and technological safeguards to protect our information systems, encompassing personal data (associate, consumer, customer and business partner), intellectual property and confidential business information. These protections are designed to maintain the confidentiality, integrity and availability of all information housed within our network infrastructure.

companyName: PVH CORP. /DE/

ticker: PVH


text: The investigation determined that the incident primarily affected systems that were used for back-office activities. Data was exfiltrated from these systems and posted on the dark web. The data consisted of confidential information from our files, including personally identifiable information, primarily information of our employees, former employees, and their dependents, and the bank account information of some customers and other sensitive Company information. We cooperated with inquiries about the incident from three state consumer and financial service regulators, provided notices to impacted customers and individuals, and complied with regulatory requirements of various states that address notice and credit monitoring. We delivered all required notices during the fourth quarter of 2023 and consider our investigation to be complete.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this Form 10-K, including the risk factor entitled "Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions."

companyName: Woodward, Inc.

ticker: WWD


text: The Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of material risks arising from cybersecurity threats. The Audit Committee regularly receives updates from management and third-party cybersecurity experts about major cybersecurity risks, their potential impact on our business operations, and management's processes to identify, monitor, and mitigate such risks, including, as relevant, the results of assessments or audits of our processes. The Audit Committee periodically provides updates on these matters to the Board of Directors.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material cybersecurity threats, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see Item 1A "Risk Factors."

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: The Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to all security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team ("CSWAT"), which is responsible for addressing cybersecurity incidents that raise more significant risks.

companyName: QWEST CORP

ticker: CTBB


text: The Corporation maintains an Incident Response Plan that provides documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the board of directors when appropriate. The Incident Response Plan is managed by the Information Technology Department, including the ISO, and is reviewed and tested at least annually.

companyName: PENNS WOODS BANCORP INC


text: The monitoring and surveillance procedures over our key systems and IT environments are performed jointly with Genworth. Potential threats are evaluated, correlated and escalated to the extent appropriate. Incidents that are subject to escalation are initially evaluated by a team of IT security personnel led by our Chief Information Security Officer. If the incident is sufficiently severe, it will trigger our cybersecurity incident response plan, which is carried out by a cross-functional team of professionals who ultimately report findings and suggest action plans to our senior leadership team and Genworth. In accordance with the plan, we assess, contain and eradicate the threat and notify relevant external parties. We engage with third parties to assist with the research and evaluation, if deemed necessary.

companyName: Enact Holdings, Inc.

ticker: ACT


text: The Board and Audit Committee participates in discussions with management regarding cybersecurity risks and performs a review at least annually of the Company's cybersecurity program. This includes discussions of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: Cohen & Steers' cybersecurity risk management function is led by its Cybersecurity Management team which is composed of its Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO"), members of its Information Technology ("IT") department as well as members of its Legal and Compliance departments. Its Cybersecurity Management team is primarily responsible for developing, implementing and monitoring its cybersecurity program and reporting on cybersecurity matters to Cohen & Steers' senior management as well as our audit committee, on behalf of our Board.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to continue the vendor's engagement based on their cybersecurity risk profile.

companyName: SEMTECH CORP

ticker: SMTC


text: As part of the Program, the Company maintains various safeguards to help protect the confidentiality, integrity, and availability of its information systems and data, including: • layered technical controls designed to help detect, prevent, and mitigate cybersecurity threats to Company assets; • utilization of a third-party managed detection and response service provider to monitor for cybersecurity threats, ingest threat-intelligence, and coordinate incident response efforts; • policies, procedures, and standards that are utilized to outline the Company's expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity training and education for our employees; • practices for monitoring cybersecurity risks of key third-party service providers; and • incident response plans that provide a framework for the Company's response to cybersecurity incidents.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: Cyber Risk Management and Strategy The Company relies on electronic systems and information technologies to conduct its operations. We have adopted and maintain a cybersecurity risk management program, in accordance with our risk profile and business, that is informed by industry standards.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Our Board of Directors is primarily responsible for the oversight of our risk management activities and has delegated to the Audit Committee the responsibility to assist in this task.

companyName: Criteo S.A.

ticker: CRTO


text: In 2023, we did not identify any cybersecurity breaches that materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: Identified risks and vulnerabilities are ranked and prioritized for mitigation based upon the aforementioned factors. Some risk mitigation and minimization activities include: regular software patches and updates; permitting only required connections to sensitive and critical systems; reactive response to newly identified and discovered exploitable vulnerabilities; implementation of additional auditing and monitoring controls; and cadence-driven system security assessments for critical systems.

companyName: Spire Global, Inc.

ticker: SPIR


text: All logs and records related to such events are preserved for future analysis. Cybersecurity testing is incorporated into every stage of product development, ensuring that vulnerabilities are identified and addressed proactively. Additionally, server security patches are regularly updated to mitigate potential threats.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: Additionally, quarterly cybersecurity updates are provided to risk and board committees including, but not limited to, the following materials: Annual GLBA Report, Information Security Metrics (including Key Performance and Key Risk Indicators), Penetration Testing and Tabletop Exercise updates, Cyber Maturity Assessments/Roadmap, Annual Threat Landscape Report, and additional cybersecurity education topics.

companyName: Independent Bank Group, Inc.


text: Our cybersecurity risk management strategy and processes, which are integrated into our overall risk management process, for assessing, identifying and managing material risks from cybersecurity threats are designed based on established frameworks and standards developed by the National Institute of Standards and Technology ("NIST"). Although this does not mean that we currently meet all technical standards, specifications, or requirements, we use this framework, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. These initiatives are supported by a Managed Security Service Provider ("MSSP") that provides continuous intelligence and threat assessments, including such risks from cybersecurity threats associated with our use of any third-party service provider. Also, as part of the program, GEO engages third party cybersecurity organizations to perform bi-annual assessments of the environment. Identified cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's annual risk assessment is presented to the Board.

companyName: GEO GROUP INC

ticker: GEO


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: The Company maintains a Cybersecurity Employee Awareness Program, which provides targeted education and mandatory quarterly training to employees. The Cybersecurity Employee Awareness Program also conducts monthly phishing test exercises with employees, which includes an escalation procedure for repeated failures. Additionally, the Company performs an annual cyber knowledge assessment of all employees to address any identified knowledge gaps.

companyName: UNITIL CORP

ticker: UTL


text: The Company's Audit Committee holds oversight responsibility over the cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with executive management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. The Company prepares a quarterly report from the Chief Operating Officer and the CISO which includes updates on the Company's current cybersecurity maturity, progress on the Company's previously mentioned multi-year cybersecurity plan, strategy updates to combat changes in the threat landscape, education of employees and executive management on cybersecurity awareness, enhanced cybersecurity defenses, incident response programs and regulatory reporting obligations. The Audit Committee delivers a summary of these reports to the full Board of Directors on a quarterly basis. Furthermore, the Board of Directors receives a direct report from the CISO on no less than an annual basis with interim reports provided when appropriate or necessary.

companyName: Veris Residential, L.P.


text: We have established an incident response plan to promptly and effectively address cybersecurity incidents. The incident response plan provides steps to identify, mitigate, and recover from incidents, and procedures to escalate issues to senior management, legal, and, when appropriate, our Board of Directors. The plan includes procedures for investigating and containing incidents, notifying affected parties, as appropriate, and implementing corrective actions.

companyName: Science Applications International Corp

ticker: SAIC


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our VP of Information Security, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: StandardAero, Inc.

ticker: SARO


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry-leading practices, and we evaluate them for additional information, product, and physical security requirements.

companyName: Dayforce, Inc.

ticker: DAY


text: The Company's cybersecurity program is periodically reviewed and adjusted by the CISO's office so that it can remain flexible and responsive as circumstances evolve, new cybersecurity threats emerge, and regulations change.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: No Material Breaches or Incidents: There have been no material breaches or cybersecurity issues affecting the company. Consequently, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected, nor are they reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition. As of the date of this filing, the company maintains that its cybersecurity measures have been effective in mitigating potential risks associated with cybersecurity threats.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: The Risk Committee meets at least four times a year and regularly reports to the full Board, including regarding its review and assessment of cybersecurity risk oversight matters and related recommendations. The Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of F5's business strategy.

companyName: F5, INC.

ticker: FFIV


text: The safety and security of our customers and team members is our top priority. This includes working to put in place appropriate administrative, physical and technical cybersecurity safeguards to help protect our assets that keep our operation running and securely store the information in our care. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our systems and information.

companyName: AMERICAN AIRLINES, INC.


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems. Our cybersecurity risk management program incorporates several components, including information security program assessments, continuous monitoring of cyber risks and threats using automated tools, on-premises and cloud backups, periodic threat testing, and employee training. Under the direction of executive management, our cyber risk management program is led by a third-party IT consultant with Microsoft Cybersecurity Architect Expert certifications. We deploy endpoint detection software and device management in conjunction with other reputable cybersecurity software. We require multifactor authentication across all systems and utilize access control policies to further limit access to data within the systems.

companyName: Motus GI Holdings, Inc.

ticker: MOTS


text: Please see Item 1A. Risk Factors – Technology Risks – "A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations" for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: We use third-party service providers for a variety of services throughout our business, ranging from infrastructure support and maintenance, cybersecurity incident response, data protection and privacy compliance. In addition, we engage with contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources.

companyName: Celcuity Inc.

ticker: CELC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of CEO. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: AI Unlimited Group, Inc.


text: Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents and informs designated members of executive leadership and of the Board of Directors of material cybersecurity threats and incidents.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Cybersecurity Risk Oversight and Governance Our Board of Directors is responsible for the overall oversight of our enterprise risk management. The Audit Committee semi-annually reviews the Company's enterprise risk management framework, including enterprise risk management processes, and assists the Board of Directors in its oversight over certain key areas of risks, including overseeing cybersecurity, data governance and privacy risk and regularly reporting on such matters to the Board. The Audit Committee and full Board of Directors receive periodic updates from our CISO about Kyndryl's cybersecurity policies and practices, cybersecurity developments, trends, risks, notable incidents, mitigation strategies, maturity initiatives and other developments throughout the year, as well as periodic updates from our CIO, Security & Resiliency global practice leader and other senior leaders on cybersecurity-related matters.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Our cybersecurity team is led by our Chief Security Officer ("CSO") or the CSO's delegee partnering with our risk, technology, legal, compliance, privacy, human resources, and other applicable business teams.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: The Company also identifies and assesses third-party risks within the enterprise, and through the Company's use of third-party service providers, across a range of areas including data security and supply chain through a structured third-party risk management program.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: We also require our employees to participate in cybersecurity training and awareness programs. Company's employees are expected to help safeguard the Company's information systems and to assist in the discovery and reporting of cybersecurity incidents. These programs are intended to decrease cybersecurity risks associated with human error and foster a culture of cybersecurity consciousness.

companyName: ZyVersa Therapeutics, Inc.

ticker: ZVSA


text: Business Continuity: The Traditional Business and Journal Technologies have each implemented a Business Continuity Plan and Disaster Recovery (BCP/DR) with procedures aimed at minimizing downtime and facilitating recovery of both internal and customer assets in the event of a service disruption. The plan includes clearly defined roles, step-by-step recovery processes, and prioritized action plans to address various scenarios, such as natural disasters, cyber incidents, and hardware failures. We regularly test and update our BCP/DRs.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: Material Impact from Cybersecurity Incidents While we have experienced and will continue to experience varying cyber incidents in the normal conduct of our business, thus far to our knowledge, such incidents have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: Material risks are identified and prioritized by management, and material risks are discussed periodically or as needed with the Board of Directors. The Board of Directors regularly reviews information regarding the Company's credit, liquidity and operations, including risks and contingencies associated with each area, including cybersecurity. In addition to the formal compliance program, the Board of Directors encourages management to promote a corporate culture that incorporates risk management into the Company's corporate strategy and day-to-day business operations.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: Dow's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages International Organization for Standardizations 27001/27002 standards for general information technology controls, International Society of Automation/International Electrotechnical Commission standards for industrial automation, the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls. In addition, Dow maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.

companyName: UNION CARBIDE CORP /NEW/


text: As a key component of Polaris' Enterprise Risk Management process, Polaris' cybersecurity risk management program is designed to align with industry-standard cybersecurity frameworks and includes processes related to each of the following functions for assessing, identifying, and managing risks from cybersecurity threats: identification, protection, detection, response, and recovery. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contracts with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. Our cybersecurity team engages third-party security experts to assist with our processes for assessing, identifying, and managing risks from cybersecurity threats, including, for example, assessment of the maturity of our cybersecurity risk management program, penetration testing, employee awareness testing, phish testing, and incident monitoring and response, including conducting tabletop exercises.

companyName: Polaris Inc.

ticker: PII


text: The Board has overall responsibility for risk oversight and has delegated oversight of our Cybersecurity Program, including enterprise-wide risk assessment and management, to the CCDC. The CCDC's charter requires it to monitor Company efforts to prevent, detect, mitigate, and remediate cybersecurity incidents, and to comply with cybersecurity laws and regulations. The CCDC oversees and approves all Company policies and procedures related to cybersecurity. The CCDC also ensures that significant cybersecurity issues or concerns are reported to the Board and A-Mark's CEO, and disclosed to the public, individuals, or regulators where required by law.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our information technology ("IT") networks and related systems are essential to the efficient operation of our business and our ability to perform day-to-day operations (including managing our building systems and accounting for our business operations). In some cases, our clients' operations depend on our building systems. The risk of a security breach, incident, compromise or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access of our network, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions and other events of varying degrees. To date, these events have not, individually or in the aggregate, materially affected our operations or business. In addition, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" for additional discussion of the cybersecurity risks related to our Company.

companyName: BXP, Inc.

ticker: BXP


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, based on information available as of the date of this annual report, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect and there can be no assurance that we will not be subject to future cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cybersecurity incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.

companyName: StepStone Group Inc.

ticker: STEP


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the senior and executive management levels to validate roles and responsibilities, and response protocols respective to cybersecurity threats.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Risks from Cybersecurity Threats Our systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. We have not experienced any cybersecurity incidents to date, directly or indirectly, that have materially impacted our business, financial condition, or results of operations. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in cyber- or other information security systems, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, employee, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: NEE, including FPL, operates U.S. critical infrastructure. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets and there may be such attacks in the future. In addition, the advancement of artificial intelligence has given rise to new security risks. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor FPL's business strategy, results of operations, or financial condition, NEE's or FPL's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and FPL to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.

companyName: FLORIDA POWER & LIGHT CO


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Flywire engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments and consultation on security enhancements.

companyName: Flywire Corp

ticker: FLYW


text: We have established a tiered risk management strategy that helps us to evaluate our ability to protect assets (data and systems) by identifying, assessing, and prioritizing associated risk through, among other tools, the use of a non-affiliated third-party assessor, audits by our internal audit team, tabletop exercises, penetration and vulnerability tests, and simulations. We report the results of these assessments to the Audit Committee of the Board of Directors.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Our Board is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in its role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually from the COO.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats and employee, health care professionals, or HCPs, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, independent privacy assessors, and computer security firms to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Apellis Pharmaceuticals, Inc.

ticker: APLS


text: Management is responsible for day-to-day implementation of risk management strategies and recommends process improvements. Our VP of IT has primary oversight of material risks from cybersecurity threats. Our VP of IT has more than 25 years of experience across various engineering, business and management roles focused on information technology, including roles at global, public companies, as well as across multiple industries including fintech, research, and high tech. Our VP of IT regularly presents updates to the audit committee regarding Company cybersecurity matters and developing industry trends.

companyName: Adeia Inc.

ticker: ADEA


text: The CISO informs, as appropriate, the Enterprise Risk Council, the CIO, the Company's senior leadership and, as noted above, the board of directors and its Audit Committee, on safeguards to prevent, detect, mitigate and remediate cybersecurity incidents. The CIO and CISO both report directly on a regular basis to the Company's senior leadership on progress towards specific IT risk management objectives, with the CISO focusing on cybersecurity objectives.

companyName: Sylvamo Corp

ticker: SLVM


text: Mattel's CISO has more than twenty years of cybersecurity industry experience at Mattel and elsewhere and is responsible for coordinating cybersecurity efforts within Mattel, with a focus on cybersecurity threat prevention, detection, and mitigation, as well as enhancement of privacy and security measures, including security updates, security architecture and engineering, and identity access management. Mattel's CISO reports to the CTO, regularly communicating risks and other relevant information related to cybersecurity threats and incidents. Mattel's CTO has significant leadership, cybersecurity, and technology experience, is responsible for overseeing the monitoring and mitigation of cybersecurity threats, and advises and consults Mattel's senior management regarding material cybersecurity risks.

companyName: MATTEL INC /DE/

ticker: MAT


text: Stewart recognizes the importance of protecting our customers', employees' and partners' confidentiality and data integrity. To that end, we continuously and methodically evaluate cyber risks, how they evolve and how they may affect us. We utilize considerable resources in our cybersecurity efforts, and we are committed to continuous cybersecurity education and training across our entire organization as well as our partners and customers. We continuously evaluate and monitor third-party risk relating to the protection of sensitive data. Our program focuses on a broad area of security domains, including, but not limited to: risk management, data protection, incident response, identity and access management, threat and vulnerability management, disaster recovery, business resiliency, and continuity.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: We evaluate cybersecurity risk as part of our broader enterprise risk framework. Our Board oversees Haemonetics' enterprise-wide approach to risk management while our management team is responsible for managing risk on a day-to-day basis and for bringing to the Board's attention material risks facing the Company, including with respect to cybersecurity threats. The Board focuses on the quality and scope of the Company's risk management strategies and considers the most significant areas of risk inherent in the Company's business strategies and operations as well as the steps that management is taking to mitigate those risks. We conduct an annual enterprise risk assessment – including consideration of cybersecurity risks – that is reviewed with the Board and Audit Committee and informs strategic priorities throughout the Company. Additionally, certain Board committees consider discrete categories of cybersecurity risk relating to their respective areas of responsibility. Our CISO reports at least annually on Haemonetics' threat landscape and security programs to our Governance and Compliance Committee, which oversees Haemonetics' compliance programs and policies regarding data privacy and cybersecurity risks associated with our information technology systems. Management also reports on these programs to the Audit Committee as needed and periodically reviews with our Technology Committee certain aspects of new and existing products as they relate to quality, safety and cybersecurity.

companyName: HAEMONETICS CORP

ticker: HAE


text: Our enterprise risk management and strategy processes are led by our CRO. Cybersecurity program management and strategy processes are led by our CISO. Such individuals have collectively over 40 years of prior work experience in various roles involving managing enterprise risk and information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, and Certified Information Systems Security Professional. The CRO and CISO provide regular updates to the executive management team. The executive management team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the CRO and CISO report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.

companyName: Bakkt, Inc.

ticker: BKKT


text: Cybersecurity is overseen by the Audit Committee of the Board of Directors. The Senior Director - Information Security coordinates with and directs cybersecurity initiatives through information technology and cybersecurity personnel throughout RPM.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, any cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate such incidents as well as to comply with applicable legal obligations.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: Assessing, Identifying, and Managing Material Risks Trinity's IRM program is aligned to the National Institute of Science and Technology ("NIST") Cybersecurity Framework ("CSF") and conducts maturity assessments against the NIST CSF on a quarterly basis. Our IRM program encompasses the full lifecycle of information risk, from creation through disposition, and is guided by policies, processes, standards, and procedures in vulnerability management, incident response, information governance, risk management, and security awareness. Additionally, Trinity exercises a variety of testing approaches to assess the state of systems and personnel, including frequent automated simulated breaches, annual penetration testing by independent third parties, ad hoc penetration testing by internal personnel, and tabletop exercises for information technology, IRM and legal employees. Trinity also maintains an incident response relationship with an industry-leading provider to ensure resource availability if a significant event were to occur.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: The Company has an enterprise risk management ("ERM") program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the Company's broader business goals and objectives. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Duke Energy is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, however, Duke Energy cannot provide assurance that it will not be materially affected in the future by cybersecurity risks or any future material incidents.

companyName: PROGRESS ENERGY INC


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the National Institute of Standards ("NIST"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Bridge Investment Group Holdings Inc.


text: The Company provides regular, mandatory training for employees on safeguarding against cybersecurity threats, and communicates the Company's evolving information security policies, standards, processes, and practices.

companyName: V2X, Inc.

ticker: VVX


text: We utilize a layered approach in managing and protecting against cybersecurity threats and in detecting and responding to cybersecurity incidents. Although we have numerous practices and processes to protect against common cybersecurity incidents, some attacks or other breaches may still be effective. Such practices and processes are designed to detect, triage and contain these cybersecurity incidents. These controls include: • Identification: In addition to technology-based detection capabilities, there are numerous ways employees can report suspected or actual events, including through our internal information technology ticketing system, by emailing the cybersecurity or privacy team emails, or by submitting a report through the compliance hotline. External parties can also report a vulnerability through the link in the footer of our website. • Technical Safeguards: We leverage outside partnerships to gain intelligence on threats and continue to adjust our protection mechanisms (including firewalls, anti-malware functionality and access controls) to be effective. We have systems in place that are designed to securely receive and store information and to detect, contain, and respond to data security incidents. • Incident Response: We maintain a comprehensive incident response plan to guide our response to a cybersecurity incident. Events are analyzed and categorized into one of four severity tiers and an incident response team is formed (whose membership depends on the nature of the incident). In addition to taking actions to respond to and remediate the incident, the incident response team also considers external notification and disclosure obligations. The incident response plan provides for prompt escalation of certain cybersecurity incidents to a multi-disciplinary committee so that decisions regarding the public disclosure of such incidents can be made in a timely manner. • Testing: We engage in periodic assessment and testing of our policies, processes, and practices that are designed to address cybersecurity threats and incidents. For example, we hire a third party to perform an annual penetration test on our website, internal network, and cloud environments. Our other efforts vary from year to year, but have in the past included an information security maturity assessment, risk assessment, tabletop exercises, and threat modeling. The results of such efforts are reported to the Audit Committee of the Board (the "Audit Committee") and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessment, exercise or review. • Education and Awareness: We have a cybersecurity and information security training and compliance program in place to support our employees and directors. As part of this program YETI employees are subject to reoccurring phishing exercises. The results of these exercises are used to inform the subject matter and frequency of additional training modules that employees are required to complete. In addition, employees annually receive either reminders or training on data privacy and information security, including cybersecurity. YETI also maintains a number of policies that apply to employees and contractors, including a Global Internal Data Protection and Privacy Policy, an Acceptable Use Policy, and a Password Policy.

companyName: YETI Holdings, Inc.

ticker: YETI


text: Risk Assessment - Our enterprise risk assessment is performed by executives, management, and functional and department-level subject matter experts. This group engages in the ongoing monitoring of identified risks to the Company and risk mitigation efforts. Our enterprise risk management process captures the potential impact and likelihood of cybersecurity risk events by evaluating our current cybersecurity risk environment and our existing cybersecurity controls. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The SVP of IT & SCM, senior leadership, and our internal audit function provide both the full Board and the Audit Committee with periodic updates on the performance of our cybersecurity program.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: Third-Party Monitoring. We employ a managed security services provider that provides 24/7 monitoring of our enterprise network. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Insurance Coverage. We maintain insurance coverage that includes cybersecurity protection.

companyName: Ingevity Corp

ticker: NGVT


text: The CIMT responds to potential cybersecurity incidents raised to its attention by making an assessment of the event to determine if a cybersecurity incident has, in fact, occurred, identifying any assets impacted by the incident, determining any information stored and processed by assets identified as compromised, assessing the nature and level of damage that has occurred (accessed, exfiltrated, released to the public, etc.), and revising the assessment throughout the incident response process when additional details are identified.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our internal computer systems, or those of our third-party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs."

companyName: PALATIN TECHNOLOGIES INC

ticker: PTNT


text: Company maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats against our information systems and data. These include: incident detection and response management controls within our accounting and financial reporting functions security controls security management risk management program training.

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: We have a dedicated Information Security team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including teams within information technology ("IT"), Legal and Privacy, in identifying, analyzing, and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: We have implemented and maintain a cybersecurity program (the "Cybersecurity Program") that includes various processes designed to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach including a cybersecurity incident response plan.

companyName: Shapeways Holdings, Inc.


text: AHFC's and HCFI's Company Operating Committees advise and support each company's President on company operations and other matters of corporate importance which includes, among other things, matters regarding cybersecurity. The Company Operating Committees may report on certain matters directly to the North American Regional Operating Board. Confidentiality Committees have also been established at AHFC and HCFI whose roles includes, among other things, the safeguarding of personally identifiable information of our customers and associates from data security breaches. Members of our Confidentiality Committees include the Risk Management Officers, the Chief Information Security Officer or other information technology representative, and members from various areas throughout our companies.

companyName: AMERICAN HONDA FINANCE CORP


text: While our Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing our data privacy, information technology and security and cybersecurity risk exposures. On at least an annual basis, the ED, IT & IS reports to the Audit Committee on information security and cybersecurity matters, including significant information technology risks, significant threats (and the potential impact of those exposures on our business, financial results, operations and reputation) and the steps implemented by management to monitor and mitigate exposures. He also apprises the Audit Committee promptly of high priority cybersecurity incidents, consistent with our Incident Management and Response Policy, and provides updates to the full Board as needed.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Information Security Officer, who oversees the Company's Trust, Security and Reliability department, and the members of the Cybersecurity Risk Management Team. Our Trust, Security and Reliability department has significant collective experience in relevant computer science and engineering disciplines and cybersecurity matters.

companyName: Confluent, Inc.

ticker: CFLT


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber incident. This plan is reviewed at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: Cyber Incident Response and Reporting. Our Security Incident Response Policy is designed to enable prompt and effective action in the event of a cybersecurity incident to safeguard our information technology systems, customer data and overall business operations. We are cognizant of the ever-evolving landscape of cybersecurity threats and their potential to materially impact our operations. To date, we do not believe that we have experienced any cybersecurity incidents that have had a material adverse effect on our business strategy, operations or financial condition. However, we recognize that cybersecurity threats are a significant risk factor for any organization, especially those involved in digital infrastructure. See Part I, Item 1A, "Risk Factors – Risks Related to Our Business - Our systems are susceptible to various forms of cyber threats, including computer malware, viruses, ransomware, hacking attempts, phishing attacks and other network disruptions. These incidents have the potential to lead to security and privacy breaches, loss of proprietary information and interruptions or delays in our services and operations, any of which could significantly harm our business," for further discussion.

companyName: EVgo Inc.

ticker: EVGO


text: Board of Directors is responsible for monitoring and assessing strategic risk exposure including cybersecurity risk, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: Our Risk Assessment Committee, which is comprised of individuals from our information technology, risk management, and internal audit departments, meets periodically to discuss our exposure to cyber risks as well as our efforts to mitigate the potential impact of such risks to our business or otherwise transfer such risk, including through the use of insurance products. Additionally, as part of our risk-based approach to cybersecurity: • our information technology systems and internal controls undergo annual audit; • we conduct annual penetration testing in consultation with a third-party consultant to assess any vulnerabilities in our systems and utilize the results to evaluate and remediate any identified issues; • we conduct tabletop exercises in consultation with third-party consultants to enhance our readiness and response strategies in safeguarding against potential threats to our data, information technology systems, and critical business functions; • we perform daily vulnerability scans of all computers within our system; • we use single sign-on and multi-factor authentication; • we conduct diligence on, and seek engagements of, sophisticated, cloud-based third-party service providers for critical functions; • we have implemented a zero-trust security model with group-based access to resources on our network; • we monitor applicable privacy and data protection laws and regulations and implement changes, as necessary, to remain in compliance; • we maintain cyber liability and crime insurance policies; • we maintain an alternate recovery site and immutable backups of the files on our systems to aid in the recovery of our data and for operational continuity, in the event of an incident or incursion; and • our employees participate in mandatory cybersecurity training, including a recurring cyber-phishing awareness campaign designed to assess our employees' awareness of and responses to phishing requests.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: Our Information Security team evaluates cybersecurity risks and works to design and ensure implementation of appropriate controls and safeguards in alignment with our business objectives and operational needs. Management periodically reviews cybersecurity risks as part of the overall risks to the company as part of the enterprise risk management program. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: FARMER BROTHERS CO

ticker: FARM


text: We utilize Self-Assessments using industry standards and benchmarks to identify cybersecurity incidents and threats that could potentially impact the company.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: We are not aware of any risks from cybersecurity threats or cybersecurity incidents which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: Our board of directors is ultimately responsible for overseeing the our risk management activities in general and, as deemed necessary by our management team, will be informed of any cybersecurity threats or risks that may arise. In fiscal year 2023, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy and results of operations.

companyName: Slam Corp.

ticker: SLAMF


text: We recognize the critical importance of maintaining the trust and confidence of our all of our stakeholders. Our business increasingly depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party contract research organizations, contract manufacturing organizations, or other vendors, contractors or consultants. Our board of directors and our management team are actively involved in the oversight of risk management, and cybersecurity represents an important component of our overall approach to compliance and risk management. Our cybersecurity policies, standards, processes and practices are integrated into our approach to compliance and risk management and follow recognized industry best practices. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect, process, and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with third-party service providers, including cybersecurity assessors, and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: To manage risks to our Company, including information and security risks, our Board oversees our enterprise-wide approach to risk management with a fundamental belief that the key components of risk management are: • Identifying potential risks that we face; • Assessing the likelihood and potential impact of the risks; • Adopting strategies and controls designed to manage the risks; • Reporting on a regular basis regarding the assessment and management of the risks; and • Monitoring these potential risks on a regular basis.

companyName: DAVITA INC.

ticker: DVA


text: Dollars in millions except per share amounts With respect to incident response, the Company has adopted a Cybersecurity Incident Response Plan, as well as a Data Privacy Incident Response Plan that applies if customer information has been compromised (together, the "IRPs"), to provide a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting and responding to security events that are identified by or reported to the CSO. The IRPs apply to all AT&T personnel (including contractors and partners) that perform functions or services that require securing AT&T information and computing assets, and to all devices and network services that are owned or managed by the Company.

companyName: AT&T INC.

ticker: T


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: Inc.'s cybersecurity risk management program is designed to be aligned with its business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational and financial risk.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: Cybersecurity Governance JFG has a dedicated GIS team, led by its CISO, who reports to JFG's CIO. The CISO works closely with JFG's CIO, Chief Financial Officer, and the Chief Risk Officer's ("CRO") team and Legal and Compliance Departments, to develop and advance the firm's cybersecurity strategy, which applies to us.

companyName: Senior Credit Investments, LLC


text: The Company operates almost exclusively in a Software-as-a-Service (SaaS) IT environment. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The internal business owners of the hosted applications are required to document quarterly user access reviews and obtain a System and Organization Controls (SOC) 1 or SOC 2 report from our SaaS vendors. With assistance from an external consultant, management conducts an annual review of third-party SOC reports with a specific focus on their data protection procedures. If a third-party vendor is not able to provide a SOC 1 report, management takes additional steps to assess their cybersecurity preparedness and assess our relationship with them on that basis. Our assessment of risks associated with the use of third-party providers is a significant part of the Company's overall cybersecurity risk management framework.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: The information technology department has put in place robust governance measures for information security. This includes control requirements for change management, patching processes, the implementation of multifactor authentication, comprehensive data backup strategies, and continuous security monitoring. Additionally, management continues to enhance our security controls, with any significant issues promptly reported to the Audit Committee.

companyName: MDB Capital Holdings, LLC

ticker: MDBH


text: We maintain a cybersecurity risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management program incorporates various mechanisms to detect and monitor unusual network activity, as well as containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk. TECOGEN INC.

companyName: TECOGEN INC.

ticker: TGEN


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: Our board of directors is responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On an annual basis, management receives a report from Operations Management on our cybersecurity threat risk, management processes, and strategies. In addition to annual meetings, our board of directors, management and Audit Committee are notified of any cybersecurity incident, its threat level and the response. The threat level and response are evaluated and documented in a report by Operations leadership and our IT Services Provider. Based on our board of directors and Audit Committee review of the incident report, they determine if the findings require disclosure to the SEC.

companyName: Lodging Fund REIT III, Inc.


text: Trustmark engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. Trustmark also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Trustmark confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.

companyName: TRUSTMARK CORP

ticker: TRMK


text: We are a blank check company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We depend on the digital technologies of third parties, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation.

companyName: DT Cloud Acquisition Corp


text: Access to company files and data is critical to our effective operation and financial performance. The Company is aware that cybersecurity treats including ransomware must be identified and mitigated with minimal impact to corporate objectives. We employ a secure data governance policy that includes off-site, secure, multi-cloud data storage to ensure that risks to critical business operations are mitigated in the rare case of an incident.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: HilleVax, Inc.


text: We strive to align BD Information Security policies and procedures with industry best practices, including the NIST Cybersecurity Framework, International Organization for Standardization ("ISO")/International Electrotechnical Commission (IEC) 27001:2022 standards for information security, Underwriters Laboratories ("UL") 2900-1 Cybersecurity Standard for Medical Devices, and U.S. Food and Drug Administration's pre-market and post-market guidance for cybersecurity in medical devices. In 2022, BD achieved ISO/IEC 27001:2022 certification at the enterprise level, demonstrating that BD's Information Security Management System (ISMS) conforms to internationally recognized cybersecurity standards. In July 2024, BD engaged a third-party auditor to complete its second enterprise-level annual surveillance audit for ISO 27001, which determined that BD continues to meet these rigorous standards. These policies and procedures establish processes for handling data, assets, systems and other technology resources to help protect BD products, manufacturing and distribution OT, enterprise IT and BD data.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: We maintain detailed technology and cybersecurity programs to manage information security risk within the Company. We rely on both proprietary and commercially available systems, software, and tools to protect and monitor the processing, transmission, and storage of company data and both customer and team member information. The objectives of our programs are to: • protect the confidentiality, integrity, and availability of data, • protect against anticipated threats, • protect against unauthorized access to our information technology systems, • safeguard assets, and • maintain resiliency and recovery plans regarding Company informational technology.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: As part of our cybersecurity risk management program, we are working with our crypto-processing subsidiary to develop a cyber training curriculum for our employees. The training may cover topics such as phishing awareness, cybersecurity best practices, and e-mail security.

companyName: ALT5 Sigma Corp

ticker: ALTS


text: Cybersecurity Incident Management The CDR organization uses a variety of prevention and detection tools and other resources to identify potential cybersecurity incidents. When a cybersecurity incident is identified, CDR's incident response team engages with the appropriate subject matter experts, the relevant management of impacted organization(s) and others to analyze, contain, eradicate, mitigate, and recover from the incident as applicable. Throughout the incident response process, CDR leadership, the CISO and the Company's Chief Legal Officer are informed and consulted. As appropriate, incidents are escalated for review by the Senior Leader Crisis Team (the "SLCT"), which consists of cross-functional leaders of the Company. A subgroup of the Company's Disclosure Council assesses the information reviewed by the SLCT and makes a recommendation regarding the cybersecurity incident's materiality to the full Disclosure Council and subsequently to the Audit Committee. Additionally, the CDR organization has frequent operating rhythms to, among other things, review cybersecurity incidents and track the progress of cybersecurity initiatives. The SLCT also meets according to regular operating rhythms to review cybersecurity incidents and stay informed of evolving cybersecurity risks.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security.

companyName: Lightstone Value Plus REIT III, Inc.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We have implemented policies and procedures that are intended to manage and reduce this risk.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: Applied UV, Inc.

ticker: AUVI


text: Assessment, Identification and Management of Material Risks from Cybersecurity The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages the Company's day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to the Company and its operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.

companyName: HPS Corporate Lending Fund


text: We require the crew and temporary staffing to complete annual training on information security, including cybersecurity, global data privacy requirements and compliance measures.

companyName: FIVE BELOW, INC

ticker: FIVE


text: We conduct regular cybersecurity assessments with independent firms and annual evaluations for compliance with Payment Card Industry – Data Security Standards (PCI DSS) and benchmark maturity assessments aligned with the NIST Cybersecurity Framework. Our Internal Audit department evaluates our information security program through annual information security and cybersecurity audits. We also perform internal controls testing as Section 404 of the Sarbanes-Oxley Act mandates.

companyName: PVH CORP. /DE/

ticker: PVH


text: The Committee receives quarterly reports on our cybersecurity risks from the Risk Management Working Group. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Intapp, Inc.

ticker: INTA


text: Our IT Manager is actively involved in assessing, monitoring and managing our cybersecurity risks. He has over 30 years of experience in the field of cybersecurity, and his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: Insurance Coverage. We maintain insurance coverage relating to cybersecurity risks. As described in " Risk Factors — Operational and Model Risk," our insurance may not be sufficient to provide adequate loss coverage.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: seeking to acquire or merge with a business or company. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents.

companyName: ATLANTICA INC

ticker: ALDA


text: Additionally, the Company assesses and manages cybersecurity threats associated with its third-party service providers' information technology systems that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Vice President, Information Technology, as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Spyre Therapeutics, Inc.

ticker: SYRE


text: We recognize the critical importance of maintaining the trust and confidence of all our stakeholders. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Velo3D, Inc.

ticker: VELO


text: Our information technology and security, or IT, management team, and legal, and risk management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using a multi-faceted approach including use of manual and automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, evaluating reported threats as well as the industry's risk profile, and third-party-conducted red/blue team testing and tabletop incident response exercises.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: The Program will be based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we will meet any particular technical standards, specifications, or requirements. The Program will be aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: In addition, our information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for employees and our Board to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.

companyName: W. P. Carey Inc.

ticker: WPC