text: In recent years, we have invested significant time and resources to develop, implement, and maintain a robust set of cybersecurity measures, which all support our efforts to mitigate potential risks to the confidentiality, integrity, and availability of our data and critical business systems. Since the cybersecurity risk landscape is in a constant state of change, we employ a continuous, multi-layered approach to assess and measure the effectiveness of our cybersecurity defenses. Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices.

companyName: Enpro Inc.

ticker: NPO


text: Our Information Technology Security Team, under the oversight of our Senior Vice President of IT and the leadership of our VP of IT Infrastructure and Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Information Technology Security Team manages and continually enhances a robust enterprise security structure with the ultimate goal of minimizing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our Information Technology Security Team possesses decades of experience in navigating cybersecurity threats and mitigating associated risks as a result of holding similar positions at other large companies. Most members of the team hold degrees in cybersecurity and/or related disciplines, have cybersecurity certifications such as Certified Information Systems Security Professional (CISSP) and/or periodically attend various cyber-focused conferences and training programs. Specifically, our Senior Vice President of IT and our VP of IT Infrastructure and Security combined have over 30 years of technology and cybersecurity experience. The team provides regular reports to senior management and affected departments on various cybersecurity threats, assessments and findings.

companyName: EQUITY RESIDENTIAL

ticker: EQR

secItem: Item 1C


text: Our Board of Directors is responsible for overseeing cybersecurity risks. Management, led by our IT department, is responsible for the operational oversight of the company-wide cybersecurity strategy and standards. Administrative access to our critical systems is limited to authorized personnel and documented in our IT inventory.

companyName: OZOP ENERGY SOLUTIONS, INC.

ticker: OZSC


text: We have created a robust Information Security Awareness Program to deliver our employees pertinent and timely educational content. Mindful that human error can be a significant factor in cybersecurity incidents, our employees undergo regular training to stay informed about the latest threats and best practices. This reduces the risk of inadvertent security breaches and cultivates a culture of security throughout the organization. Additionally, we regularly conduct social engineering tests on our employees to keep them sharp and alert for threats through email, text messages, and voice calls. Mid Penn did not experience a material incident to our computer systems or networks in 2023.

companyName: MID PENN BANCORP INC

ticker: MPB


text: Cybersecurity Risk Governance and Oversight The Company's Board, in conjunction with its Audit Committee, oversees management's approach to cybersecurity risk and its alignment with the Company's enterprise risk management program. The Board and Audit Committee receive reports from Management regarding the prevention, detection, and mitigation of cybersecurity incidents, including security risks and vulnerabilities. Additionally, the Audit Committee receives updates on cybersecurity risk assessments, risk mitigation strategies, and relevant cybersecurity matters. The Company's information technology team is responsible for developing and implementing its information security program and reporting on cybersecurity matters to the Board of Directors and Audit Committee.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Our cybersecurity and risk management program is designed to protect the confidentiality, integrity, and availability of our critical information systems and the data they hold. Due to the nature of our business and our customers, we face many potential cybersecurity challenges and threats, including attempts to gain unauthorized access to our intellectual property, trade secrets, codebase, proprietary or confidential information, fraud, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. Because we operate in financial-technology and data-sensitive environments, we expect these threats to continue to evolve and increase in complexity. We have implemented IT systems and processes designed to help defend against the ever-evolving threat landscape while remaining agile to keep up with such threats. As we expand efforts in the financial technology sector, we will continue to invest in strengthening and supporting a robust cybersecurity posture and defense.

companyName: USBC, Inc.

ticker: USBC


text: We have implemented a third-party risk management process that assesses the inherent risks of third-party service providers and informs our engagement, contracting with, and oversight of such parties. Through this process, our information security personnel, in collaboration with our vendor management operations, evaluate the information security and business continuity capabilities, risks and vulnerabilities, of prospective and existing service providers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: Many of our employees work remotely or in various locations around the world and are provided with company-owned IT equipment. Software and firmware updates to such equipment are managed and controlled by the Company.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Allstate evaluates candidates for information security positions based on experience and qualifications. Senior leadership, team leads and subject matter experts conduct interviews to identify top candidates who represent the technical and behavioral acumen required of cybersecurity professionals at Allstate. Allstate provides cybersecurity employees with continuing education associated with their roles and responsibilities.

companyName: ALLSTATE CORP

ticker: ALL


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

companyName: BOISE CASCADE Co

ticker: BCC


text: Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect our Company, business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third party vendors' information systems. For more information, please see the section entitled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: The Board Risk Committee assists the Board in fulfilling its responsibilities related to the oversight of the Bank's Enterprise Risk Management Framework. The Board Risk Committee oversees executive management's design, implementation, and maintenance of an effective risk management program to ensure compliance with laws and regulations, and operation within the parameters established in the Bank's risk appetite statement. This includes a review of the cybersecurity dashboard which summarizes key risk indicators and identifies emerging risks.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We have established a dedicated vendor assessment team, which employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or that otherwise implicates the third-party technology and systems we use. We also require cybersecurity insurance coverage for vendors whose services or products may present a cybersecurity risk.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized cybersecurity industry frameworks established by the National Institute of Standards and Technology, and other applicable industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Additionally, we utilize internal and external independent controls to monitor and mitigate the risk of these threats, including a Security Incident Response Plan ("SIRP") and periodic Information Technology training for all employees.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: To operate our business, we rely on third party service providers to perform a variety of functions, such as SaaS platforms, managed services, property management, cloud-based infrastructure, content delivery to customers, encryption and authentication technology, and corporate productivity services. We have a vendor management program designed to help manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for certain vendors; security questionnaires for certain vendors; review of certain vendor's written security program and security assessments; and imposition of information security contractual obligations on the vendor.

companyName: Grindr Inc.

ticker: GRND


text: We also maintain stringent security requirements for third-party service providers, ensuring that vendors comply with our cybersecurity policies and controls. Our third-party risk management program includes due diligence assessments prior to engagement and ongoing security evaluations to mitigate external risks that could impact our operations.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: As part of the executive team reporting to the Board, Mr. Peng oversees our cybersecurity policies and processes, including those described in "Risk Management" above. The processes by which Mr. Peng is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include log review from IT and operations teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.

companyName: Zhuoxun Hongtu Inc.


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes.

companyName: ALTEROLA BIOTECH INC.

ticker: ABTI


text: Our business, results of operations, or financial condition could be materially affected as a result of such risks, due to: the cost of and modification of business activities related to prevention or incident response; potential system failure, data loss, fraud or theft, or other material adverse consequences; disruptions, including in operations, due to potential delays in remediation of high risk or critical vulnerabilities; costs of notices and other disclosures that may be required by applicable data privacy and security obligations; or our inability to recover such costs under insurance policies or contractual rights. See "Risks Related to Our Business" in Item 1A, Risk Factors for more information.

companyName: Dutch Bros Inc.

ticker: BROS


text: The CIO has dual degrees in Accounting and Computer Science from the University of Montana. The CIO has over 30 years of experience managing information technology at the Company.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Cyber Security Governance Oversight of cybersecurity infrastructure is managed by members of our management team, including our President & Chief Executive Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider periodically reviews and updates our antivirus and antimalware software, manages our Business Continuity and Disaster Recovery system, reviews our vulnerability management and ensures our system is Payment Card Industry (PCI) compliant. Given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Saker Aviation Services, Inc.

ticker: SKAS


text: Our Director, Information Technology (our " IT Director "), who has a career of 23 years in IT, has in-depth working knowledge on IT systems and data security, and his experience is instrumental in developing and executing our cybersecurity strategies. Our IT Director along with the IT team, oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity risk training program. However, the primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Risk Management Team. The diverse background and experience of our Risk Management Team members are instrumental in developing and executing our cybersecurity strategies and supplement the expertise of our IT Director with their understanding of the needs of our business.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The Technology Committee provides oversight with respect to our technology risk management, assessment and exposures, including cybersecurity risks. The Technology Committee receives regular updates from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") regarding our cybersecurity risk management strategy, the cyber threat landscape, industry trends and other relevant cybersecurity topics. Management also provides the Technology Committee with detailed reports regarding our technology priorities and initiatives to ensure that our cybersecurity risk management strategy remains current and aligned with our overall business strategy.

companyName: Wendy's Co

ticker: WEN


text: Cyber Incident Response Plan Our Incident Response Plan outlines the processes for detecting, identifying, prioritizing, and analyzing information security events. Depending on the incident's scope, business impact, and potential material risk, our CISO, legal counsel, and business stakeholders are engaged. This cross-functional team assesses the appropriate response and mitigation pathway. Once security events are identified through our enterprise detection and monitoring ecosystem, the Incident Response Plan establishes a prioritization and decision workflow to determine the scope, business impact, and potential material risk, implemented in collaboration with the CISO, legal counsel, and business stakeholders.

companyName: EGAIN Corp

ticker: EGAN


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: NEVRO CORP


text: The Company maintains an Information Security Program to safeguard all WSFS information assets against unauthorized use, disclosure, modification, damage, or loss. Information Security, in conjunction with Operations, Technology, and Executive Leadership, work together to provide and maintain security processes and procedures pursuant to which the Company will: • Ensure the security and confidentiality of customer and bank records covered by law. • Protect against any anticipated threats or hazards to the security of such records. • Protect against the unauthorized access or use of such records or information in ways that could result in substantial harm to the Company, our Customers, and Associates. • Establish guidelines and practices for ensuring Information Technology compliance to external and regulatory requirements. • Ensure proper and effective Business Continuity and Disaster Recovery programs are implemented and tested.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and EchoStar's Board of Directors as a whole to ensure accountability.

companyName: DISH DBS CORP


text: The Audit Committee of our Board of Directors is primarily responsible for oversight of the Company's risk assessment and risk management, including cybersecurity risks. The committee meets at least annually with our Head of Information Technology, who provides a report on the Company's current risk assessment as well as mitigation efforts. The Audit Committee also periodically updates the Board of Directors on risk matters.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: We evaluate our security posture on an ongoing basis via vulnerability scans, penetration testing, and threat intelligence monitoring. We periodically conduct third-party security assessments and regularly evaluate our processes against industry standard security frameworks. We conduct regular security training to elevate awareness and foster a security conscious culture among all employees.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: To expedite security policy changes, active threat monitoring, infrastructure enhancements, device management, and endpoint security, the company engages additional third-party IT consultants.

companyName: Earth Science Tech, Inc.

ticker: ETST


text: Identifying, assessing, and mitigating cybersecurity and related risks are disciplines we integrate into our overall enterprise risk management ("ERM") process. Our ERM process and cybersecurity policies are based on the National Institute of Standards and Technology and Consensus Audit Guidelines. As part of our process, we complete continuous vulnerability scanning, end point detection and response, employee cybersecurity awareness training, and security monitoring. To the extent our ERM process identifies any relevant heightened cybersecurity related threat, we assign risk owners to develop mitigation plans, which we then track until full execution aligned with our Incident Response Plan.

companyName: ExchangeRight Income Fund


text: Our employees represent the foundation of cybersecurity protection and are a key line of defense, and we seek to strengthen their ability to target risks by proactively training active employees and contractors each year. We update our online security awareness training annually to review key policies and practices for security. To engage our workforce and inform employees of applicable security topics, we provide a monthly internal cybersecurity newsletter. Our monthly campaign on mock phishing emails is designed to serve as a reminder to employees to refrain from clicking on fraudulent emails disguised as safe content. We also assign enhanced cybersecurity training to employees who have access to potentially sensitive government information.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Our Chief Legal Officer and our security governance steering committee, which includes our Vice President and Corporate Controller, Vice President of Human Resources, Senior Vice President of Development Operations, and Director of Information Technology and Cybersecurity, are primarily responsible for assessing and managing our risks from cybersecurity threats. Our Chief Legal Officer has more than a decade of operational experience overseeing and advising on risk management in the highly regulated biopharmaceutical industry, and leads a wide range of business functions, including IT/IS. Our Director of Information Technology and Cybersecurity has nearly 20 years of experience with IT, having had leadership roles in strategic technology development and information security, and holds several industry-recognized certifications such as the Certified Information Security Manager (CISM) and CompTIA Network+. They and other members of our security governance steering committee engage in training and education relating to cybersecurity risk.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Our information security program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, software, and services; (ii) an information security team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally and by external security and risk audit providers, as appropriate; (iv) new-hire and annual cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: conducting regular vulnerability scans and tests utilizing threat intelligence feeds in the assessment of hardware and software; and providers and other third parties, where appropriate, to assess, test, or otherwise assist with aspects of our systems addressing cybersecurity threats.

companyName: DNA X, Inc.

ticker: SONM


text: We manage cybersecurity risks through a robust enterprise risk management process. These policies and practices follow the National Institute of Standards and Technology (NIST) cybersecurity framework. Our cybersecurity program encompasses the IMT and its policies, platforms, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers. Our program includes various policies, procedures, and plans related to cybersecurity, including the CSIRP, Corporate Crisis Management Plan, Crisis Communications Response Plan, Organizational Resiliency Governance Policy and Framework, and Business Continuity Plans. These plans outline a coordinated approach for protecting information security, managing vulnerabilities, and assessing, identifying, and managing risks from cybersecurity threats, including identifying and responding to cybersecurity incidents, and processes for categorizing incidents, reporting findings, and keeping senior management, our Audit Committee, and other key stakeholders informed and involved as appropriate.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: We provide annual mandatory training for personnel regarding cybersecurity threats to equip our employees and contractors with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Velo3D, Inc.

ticker: VELO


text: Additionally, Carpenter Technology leverages third party security firms in various capacities to assist with various aspects of Carpenter Technology's cybersecurity program, including risk assessments, vulnerability scans, and penetration testing. Carpenter Technology uses a variety of processes to address cybersecurity threats related to the use of third party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of Carpenter Technology's process to continuously improve its cyber and information security programs, Carpenter Technology also engages third party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: Our Board of Directors considers cybersecurity risk as part of its enterprise risk management oversight function. The Board of Directors delegates oversight of the cybersecurity risk management program to the Audit Committee. This oversight includes periodic reports from management concerning cybersecurity related risks. The management of the program is the responsibility of our Risk Management Committee, comprised of our Chief Financial Officer, Chief Digital & Information Officer, Chief Accounting Officer and General Counsel. Our Chief Digital & Information Officer, who has over 30 years of extensive work experience in the field of technology and cybersecurity, leads our team of cybersecurity professionals and provides the Risk Management Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. Our team of cybersecurity professionals monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through the cybersecurity risk management and processes described above, including the operation of our incident response plan. The Risk Management Committee provides updates to the Audit Committee on our cybersecurity risk management program as appropriate, including updates on ( 1) any critical cybersecurity risks; ( 2) ongoing cybersecurity initiatives and strategies; ( 3) applicable regulatory requirements; and ( 4) industry standards. The Risk Management Committee also notifies the Board of Directors of any significant and/or material cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Azenta, Inc.

ticker: AZTA


text: Cybersecurity risk is an important and continuously evolving focus for us, and significant resources are devoted to protecting and enhancing the security of computer systems, software, networks and our other technology assets. We have controls and systems in place to safely receive, protect and store information; collect, use, and share that information appropriately; and detect, contain and respond to data security and denial-of-service incidents.

companyName: FIRST INDUSTRIAL LP


text: We (or third parties we rely upon) may not be able to fully, continuously and effectively implement security controls as intended, or the controls we implement may be inadequate or fail to address a particular risk. For further discussion of these risks, see "Business and Operating Risks – Technology failures or cybersecurity incidents could disrupt our operations and negatively impact our businesses" within "Risk Factors" in Item 1A of this report. While we are regularly targeted by cybersecurity threats, including cybersecurity attacks, ransomware and other cybersecurity breaches, and we expect them to continue in the future, during the year ended September 30, 2025, we did not identify any risks from cybersecurity threats that materially impacted or are reasonably likely to materially impact us.

companyName: Post Holdings, Inc.

ticker: POST


text: We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data ("Information Systems and Data").

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We engage subject matter experts such as consultants to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Enterprise Incident Response Team oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: Our CTO and Chief Compliance Officer have primary responsibility for assessing and managing material cybersecurity risks, including overseeing and identifying cybersecurity risks associated with our use of third party cybersecurity consultancy firms, and are members of management's IT Steering Committee, which consists of management team members and certain employees who drive alignment on technology and security decisions across the Company. The IT Steering Committee meets monthly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The IT Steering Committee also considers and makes recommendations to management, the Board of Directors and the Audit Committee on security policies and procedures, security service requirements, and cybersecurity risk mitigation strategies.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: This certification is issued by third party service providers who review annually the Company's security controls around its Information Technology Infrastructure ("ITI") and business practices to determine the Company's vulnerability to cyber security threats. We also implement all recommendations which may come out of the certification assessments process.

companyName: Coda Octopus Group, Inc.

ticker: CODA


text: We employ a range of tools and services including (but not limited to) regular network and endpoint monitoring, vulnerability assessments and penetration testing to inform our professionals' risk identification and assessment.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: The Chief Financial Officer periodically provides reports to the technology, quality and regulatory committee of the board of directors regarding information technology and cybersecurity matters and associated risks. The technology, quality and regulatory committee is responsible for reviewing and overseeing the Company's risk management process and strategy, including risks from cybersecurity threats. The technology, quality and regulatory committee periodically reports on cybersecurity risk management to the full board of directors.

companyName: MYOMO, INC.

ticker: MYO


text: Our Senior Director of Cybersecurity Infrastructure and Threat Hunting, Corporate Cybersecurity leads our information security organization responsible for overseeing our information security program. This individual has over 20 years of experience in various roles involving security, including risk management and security leadership. Team members who support our information security program have relevant educational and industry experience, including, but not limited to, holding similar positions at large technology companies. The team provides regular reports to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), and Chief Legal Officer ("CLO").

companyName: Hughes Satellite Systems Corp


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and updates are presented to our board of directors and members of management, as appropriate.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Each quarter or as needed, the Board of Directors receives an overview from management of our cybersecurity program and strategy covering topics such as cybersecurity incidents and response, progress towards pre-determined risk-mitigation-related goals, results from third-party assessments, cybersecurity staffing, compliance status, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to any such risks. In such sessions, our Chief Information Security Officer is available to the Board of Directors to discuss any relevant cybersecurity matters. In addition, at least bi-annually, the Chief Information Security Officer and Chief Technology Officer report to the Board of Directors about cybersecurity threat risks, among other cybersecurity related matters.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: As part of its cybersecurity risk management program, Mattel utilizes cybersecurity assessors, consultants, auditors, and other third-parties to assist its internal team with network security, cloud security, endpoint security, identity and access management, data loss prevention, and security information and event management. In addition, Mattel utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents.

companyName: MATTEL INC /DE/

ticker: MAT


text: We maintain a comprehensive process for detecting, assessing, and managing material risks from cybersecurity threats as part of our overall enterprise risk management system and processes. Our Chief Technology Officer ("CTO") oversees our Chief Information Security Officer ("CISO") and a dedicated team of information security professionals who are responsible for our cybersecurity risk management program. Our CTO oversees our information security professionals' efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents and the efforts for assessing and managing our material risks from cybersecurity threats. Our cybersecurity risk management program includes technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools, and related services from third-party providers. Our CTO has over twenty years of extensive experience in information technology and security.

companyName: Churchill Downs Inc

ticker: CHDN


text: g.leverage the NIST and ISO incident handling frameworks to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and h.maintain multiple layers of controls, including embedding security into our technology investments.

companyName: TruBridge, Inc.

ticker: TBRG


text: Our Application Security program proactively performs static and dynamic scanning of systems and software code. In addition, we perform vulnerability scans daily on our systems and assets.

companyName: Bandwidth Inc.

ticker: BAND


text: Our Board oversees the Company's risk management process, including on cybersecurity risks, directly and through committees to which the Board has delegated authority. The Company's Audit & Risk Management Committee is responsible for overseeing our internal controls, including cybersecurity and data protection programs, and reviews the effectiveness of our financial reporting processes and internal controls, including data privacy, information technology security and control. Meetings of the Audit & Risk Management Committee often include discussions of specific risk areas, including, among others, those relating to cybersecurity. The Audit & Risk Management Committee also frequently discusses, in accordance with its duties and responsibilities as enumerated in its committee charter, the policies, guidelines and process by which management assesses and manages risks related to data protection and cybersecurity, including assessments of the overall threat landscape, steps management has taken to monitor or mitigate its risk exposure and related strategies and investments. Our Chief Information Officer and Chief Information Security Officer regularly reports on data protection and information technology security matters to the Audit & Risk Management Committee and to Argo senior management via Security Governance Council meetings.

companyName: Argo Group International Holdings, Inc.


text: We conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers. Additionally, we maintain cyber coverage through our insurance carrier to mitigate risks associated with cybersecurity incidents, subject to customary terms and exclusions.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: Risk Assessment and Strategy Our approach towards cybersecurity follows our enterprise risk management framework. Through this process our management identifies risks to achieving our strategy and objectives; assesses, manages, controls and monitors those risks; and communicates results, including elevation of those risks to the Risk Committee of the Board of Directors, where applicable.

companyName: Enact Holdings, Inc.

ticker: ACT


text: a management team responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: As of the date of this report, there have been no cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business, strategy, results of operations, or financial condition. For additional description of cybersecurity risks and potential related impacts on the Company, refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security, including cybersecurity incidents, could materially and adversely affect our business, results of operations and financial condition" in "Item 1A. Risk Factors."

companyName: ASSEMBLY BIOSCIENCES, INC.

ticker: ASMB


text: We promote a company-wide culture of cybersecurity risk management intended to protect the confidentiality, integrity, and availability of our critical systems and the information contained therein. No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. Additionally, while we have insurance coverage in place that is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

companyName: KORU Medical Systems, Inc.

ticker: KRMD


text: We regularly assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect our information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing procedures, systems, and safeguards in place to manage such risks. Our cybersecurity risk management program is integrated into our overall risk management scheme by seeking to identify and mitigate those cybersecurity threats that are more likely to lead to a material impact on our business.

companyName: AMBARELLA INC

ticker: AMBA


text: In the ordinary course of our business, we collect, store and transmit sensitive information including intellectual property, proprietary business information and personal information in connection with business operations. Additionally, we leverage our third-party vendors to collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Executive Vice President of Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: NOODLES & Co

ticker: NDLS


text: We engage third parties to perform assessments of our cybersecurity programs, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Targeted security assessments were conducted and penetration tests throughout the year by internal teams as well as through engagement with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: Magnera Corp

ticker: MAGN


text: Related to Cybersecurity Risks Cybersecurity risk oversight is a top priority for management and our board of directors. Management is responsible for the day-to-day management of cybersecurity risks we face, while our board of directors, as a whole and through committees, is responsible for the oversight of risk management. Our incident response process contemplates that management will notify the board of directors of a material cybersecurity incident.

companyName: Newsmax Inc.

ticker: NMAX


text: We have established processes designed to manage the cybersecurity risks associated with working with third-party service providers. We evaluate the risks associated with third parties before engagement and maintain ongoing monitoring of such third parties designed to ensure compliance with our security standards. This includes security questionnaires and assessments, as well as external attack surface management. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. As of the date of this report, we have not encountered any cybersecurity incidents since our IPO.

companyName: Columbus Acquisition Corp/Cayman Islands

ticker: COLA


text: We also have a security incident response plan, with defined roles and responsibilities that are intended to address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency and have strategies, policies, and procedures in place that are designed to protect employee, business, and client data in the event of an emergency or natural disaster. In addition to identifying information security risks, we have established robust controls to seek to reduce or mitigate such risks. Cybersecurity training for employees is conducted regularly and we maintain system logs of user activities, exceptions, and security events for a period consistent with industry best practices, unless otherwise required by law, regulation or contractual obligation. We employ rigorous measures to appropriately handle and protect sensitive and confidential data, particularly in light of increased use of remote access technology. We take precautionary measures to minimize, to the extent possible, the use of personally identifiable information and the electronic or courier-based transmission of sensitive and confidential data, relying instead on approved and secured digital data transfer services, which are designed to provide tightly controlled and selective access to such information. We have mechanisms in place to help ensure that our data is secured when at-rest or in-transit, and industry standard encryption is used to the maximum extent possible. We also take steps to help ensure our ability to restore data in the event of data failure, corruption, accidental deletion, or malicious tampering.

companyName: Perella Weinberg Partners

ticker: PWP


text: We have been, and expect to continue to be, subject to cybersecurity risks and incidents related to our business. We have not experienced any material cybersecurity incidents during the last fiscal year. For more information about the cybersecurity risks we face, see Item 1A – Risk Factors of this Annual Report on Form 10-K.

companyName: Azenta, Inc.

ticker: AZTA


text: We maintain an enterprise-wide approach to risk management through which we identify, manage and mitigate significant risks, including those related to our information systems. Our cybersecurity risk management program, which applies to our global operations, focuses on our people, processes and technology, and is designed to secure our information systems by preventing, detecting and responding to current and emerging cybersecurity threats.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: Our European Chief Technology/Information Officer and our European Head of Information Security each have approximately 25 years' experience in the technology industry, with our Head of Information Security having focused for the last 10 years solely on the Information Security and Cybersecurity domains.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: We maintain a cyber incident response plan that is designed to provide a framework that will allow us to respond effectively to a cybersecurity incident. A cyber emergency response team, which includes members of our executive leadership team, manages this plan. Beginning in fiscal 2024, this team began meeting monthly to discuss cybersecurity threat trends and related information. Our incident response processes are designed to escalate certain cybersecurity incidents to our cyber emergency response team and include reporting to the Audit Committee for certain cybersecurity incidents.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks, with the assistance of a third-party IT managed service provider. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools in certain environments, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of certain threats and actors; conducting vulnerability assessments in certain environments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating certain threats reported to us.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: We have also established incident response policies and procedures, overseen by our Information Technology, or IT, Director, to review and classify cybersecurity incidents and to define roles and responsibilities for response and remediation in the event of a cyber incident. We also have implemented a process to provide cybersecurity awareness training to employees during onboarding and on an annual basis thereafter.

companyName: RAPID MICRO BIOSYSTEMS, INC.

ticker: RPID


text: As part of our overall risk management framework, our cybersecurity program takes a comprehensive, layered approach to identifying, preventing and mitigating cybersecurity threats and incidents. This includes implementing controls and escalation procedures to ensure that significant incidents are promptly communicated to management for timely decision-making regarding public disclosure and regulatory reporting.

companyName: Pluri Inc.

ticker: PLUR


text: Our processes also address the cybersecurity risks associated with our use of third-party vendors, some of which have access to our customer and employee data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, our cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems, information, and products. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: We are aware of the risks associated with engaging third-party service providers, so we have implemented processes to oversee and manage these risks. We conduct security assessments of third-party providers who may have access to sensitive information before engagement and maintain ongoing monitoring of their compliance with our cybersecurity standards. The monitoring includes periodic reviews conducted by our security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Cloudflare, Inc.

ticker: NET


text: Management regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, vulnerability management, and on-going cybersecurity projects. We ordinarily do not engage assessors, consultants, auditors or other third parties in connection with such oversight.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: As of the date of this report, we have not experienced any known cybersecurity incidents, or a series of related incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' and suppliers' information, private information about employees, and financial and strategic information about the company and its business partners. Further, as we pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and increased exposure to cybersecurity risk. If we fail to properly assess and identify cybersecurity risks, we may become increasingly vulnerable to such risks.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: The Audit Committee of the Board of Directors oversees the Management Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Entity's cyber risk management program, typically on an annual basis.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: To facilitate the success of the Company's cybersecurity program, cross-functional teams work with the CISO and SOC to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and Management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board of Directors, as appropriate.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: Our Enterprise Risk Management ("ERM") process, which is governed by an ERM Committee, includes a review of our cybersecurity programs. The ERM Committee, which is led by our executive vice president and chief financial officer, meets regularly, and receives updates from the CISO on emerging risks, recent cyber risk events, and any priority risks relating to cybersecurity. We also have a Cyber & Privacy Steering ("CPS") Committee, which meets regularly and is comprised of senior management, serving as a multi-disciplinary group for coordinating and overseeing the management of the cybersecurity and privacy programs.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: CIO is expected to report to and brief the Board and the audit committee on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial results, operations, and reputation, as well as the programs and steps implemented by management to monitor and mitigate risks. The reporting cadence and structure continues to develop, including as following the Business Combination we are a newly public company with a newly established audit committee.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: Our CISO has over 25 years of information security experience during which he has worked on various information technology and security programs, including privacy operations and security risk management. He has experience with many different types of enterprises, including the federal government, private companies, and publicly listed companies. Our CISO has a Bachelor of Science in Information Technology and an MBA.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our identification, assessment, and management of material risks from cybersecurity threats is integrated into the Company's overall ERM system and processes. Our ERM program is designed to leverage existing management processes to (i) identify critical enterprise risks, including both information security and cybersecurity risks, (ii) design and implement appropriate risk mitigation strategies, and (iii) assess the status of risks and mitigation plans.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: Impact of Cybersecurity Risks on Strategy and Results Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company believes that they are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. The Company experienced a cybersecurity breach in 2020. The Company determined the impact of this incident was not material, but enhanced its cybersecurity controls and processes in response to the incident. The Company has taken reasonable measures to protect against future compromise, and believes these measures will protect against material adverse impact, including its business strategy, results of operations or financial condition.

companyName: BELDEN INC.

ticker: BDC


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item IA. Risk Factors— Risks Related to Our Business and Operations—We face risks associated with security breaches through cyber-attacks, cyber intrusions, as well as other significant disruptions of our information systems."

companyName: Plymouth Industrial REIT, Inc.


text: We have established policies and procedures, including our Incident Response Plan ("IRP") for identifying and assessing potential threats, responding to cybersecurity incidents and security breaches, informing executive leadership and the Board, and reporting incidents within the approved timeline adopted by the FDIC in 2021 and the Securities and Exchange Commission in December 2023. In addition, the Company complies with the following reporting requirements: FDIC Computer-Security Incident Notification Rule; State statutes and laws regarding cybersecurity; Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA); All other applicable regulations.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: The Manager administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2023.

companyName: Greenpro Capital Corp.

ticker: GRNQ


text: We have, from time to time, experienced threats to and breaches of our data and systems, including breaches of our data within third party vendor's system. As of the filing date of this report, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, security breaches, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A of this report.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: We require all employees to participate in cybersecurity awareness, privacy, security training annually and provide system-wide mechanisms to report potential threats. In addition, we use a third-party phishing awareness vendor to increase employee awareness of cybersecurity threats.

companyName: Talkspace, Inc.

ticker: TALK


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors of Brighthouse Financial, Inc. (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors of Brighthouse Financial, Inc. (the "Board") is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, tabletop exercises, and other areas of importance. Our board of directors also receives regular technology and cybersecurity updates. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. Our Chief Compliance Officer also regularly reports to the Audit Committee and our board of directors regarding the Company's compliance with applicable regulations relating to cybersecurity.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: To our knowledge, neither cybersecurity threats, nor the results including as a result of any previous cybersecurity incidents have materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors - Risks Related to Out Business.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: The IT Department collaborates with various stakeholders across the organization to identify, assess, and mitigate cybersecurity risks. They regularly monitor and adapt our information security program to address the evolving threat landscape.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from our CIO and CISO. Our CIO and CISO report to the Audit Committee at least quarterly. The Audit Committee actively engages with our CIO and CISO regarding these risks. Depending on the materiality of a risk, the Audit Committee, CIO or CISO may report on such risk to the full Board.

companyName: MKS INC

ticker: MKSI


text: We utilize a Managed Security Provider (MSP) who serves as the central point for identifying all cybersecurity incidents and reporting, including incidents that directly target company network, internal information systems and incidents originating from third parties. The MSP provides end-to-end operations for the purpose of monitoring, detecting, alerting and responding to cyber incidents. The MSP is also responsible for activating the containment and resolution efforts where appropriate to support Aemetis through the resolution of the incident.

companyName: AEMETIS, INC

ticker: AMTX


text: Given the risks associated with third-party service providers, thorough assessments are conducted before engagement and ongoing monitoring is maintained to ensure compliance with organizational standards. Elements of the assessment include cyber, financial, reputational, compliance, legal, strategic and operational reviews. The Third-Party Risk Management department, reporting directly to our CISO, oversees this critical process.

companyName: FB Financial Corp

ticker: FBK


text: The Technology and Safety Committee of the Board of Directors reviews the integrity of information technology systems, including the potential for cybersecurity threats. In addition, the Risk Oversight Committee monitors management's identification and evaluation of major strategic, operational, regulatory, information technology, cyber security and other external risks inherent in the Company's business. Activities include mandatory training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. The Enterprise Incident Response Team also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Enterprise Incident Response Team escalates events, including to the Chief Executive Officer and Board of Directors, as relevant, according to pre-defined criteria.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Cybersecurity Risk Management Team, including Sean Ryder (General Counsel) and an external cybersecurity consultant with over 15 years of experience providing cybersecurity services and training (who is also a member of the Company's Cybersecurity Risk Management Team) and an external information technology consultant.

companyName: GENELUX Corp

ticker: GNLX


text: We leverage the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to drive strategic direction and maturity improvement and engage third-party security experts to conduct risk assessments and program enhancements. Additionally, we evaluate our controls environment annually using other relevant standards like Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model.


text: Our board of directors has an important role in the oversight of the Company's cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the company, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Chief Information Security Officer ("CISO") and Chief Risk Officer ("CRO"). We also regularly engage external parties to assist in the review of our cybersecurity risk oversight processes.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: The Company's day-to-day management of cybersecurity risks is led by the Chief Information Security Officer ("CISO") with direct oversight from the Chief Information Officer ("CIO"). The Company's IR Plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CISO and CIO, who further escalate critical or high severity events to the Company's Crisis Management Team, which consists of senior management from IT, including the CIO and CISO, Human Resources, Risk and Internal Audit, Marketing and Communications, Legal, and Finance. The Crisis Management Team further elevates sufficiently critical and high severity events to the Company's Cyber Incident Review Committee ("CIRC"), which consists of the CIO, Chief Financial Officer, Chief Accounting Officer, VP of Investor Relations, VP of Compliance, Risk and Audit, and General Counsel, or their delegates. Additional senior management from relevant business units are added to the CIRC as needed based on the nature of identified cybersecurity incidents. The CIRC preliminarily evaluates whether an incident is material and provides a proposal to the CEO and CFO, who work in consultation with the committee to make a final determination of materiality. Such determination is communicated to the Audit Committee of the Board (the "Audit Committee").

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a global company, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to attacks from more advanced adversaries. Our customers, suppliers, and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systemic risks.

companyName: CATERPILLAR INC

ticker: CAT


text: Governance and Management Oversight The Board, in conjunction with the Audit Committee of the Board ("Audit Committee"), oversees the Company's Enterprise Risk Management process, which includes cybersecurity risks. The Board and the Audit Committee receive regular presentations and discuss topics on cybersecurity risks with management, including the Director of Cybersecurity and the Senior Vice President Global Information Systems. The presentations and discussions address a range of topics, including recent cybersecurity developments, the threat environment, evolving standards and technology, vulnerability assessments and related remediation plans, education and training programs, and cybersecurity insurance. The Board also receives periodic training on recent developments and trends in cybersecurity from a third-party advisor. Based on the Company's procedures, the Board and Audit Committee receive prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, and regular updates until such threat or incident has been addressed.

companyName: MANITOWOC CO INC

ticker: MTW


text: Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats. The Board's Audit Committee oversees management of financial, regulatory, compliance and security risks and receives reports at least quarterly from our Chief Operating Officer regarding our cybersecurity programs, vulnerabilities, threats and risks. The full Board is regularly informed about such risks through committee reports, attendance at committee meetings and other communications.

companyName: COMSCORE, INC.

ticker: SCOR


text: Our Cybersecurity Program also addresses cybersecurity risks associated with our use of third-party service providers, in particular those identified as critical to the functioning of our business. To that end, we take cybersecurity considerations into account in the selection of our third-party service providers. We perform cybersecurity diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity risks identified through such diligence, and we require those third parties to implement appropriate cybersecurity controls with respect to the services they provide to us.

companyName: ITERIS, INC.


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Risk Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CIO and Director of Information Security, reports on cybersecurity matters at least quarterly to the Board, primarily through the Risk Committee, including an annual report regarding specific risks and mitigation efforts within the Company. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board, including training by third-party experts, to educate directors on the current cyber threat environment and measures companies can take to mitigate risks and impact of cyber attacks.

companyName: CAMBRIDGE BANCORP


text: The SVP of IT provides periodic briefings for our senior management team on cybersecurity matters, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and cybersecurity threats.

companyName: EyePoint, Inc.

ticker: EYPT


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business strategy, results of operations, or financial condition is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenant, loss of tenant or other sensitive data, regulatory intervention, inability to properly monitor our compliance with the rules and regulations regarding our qualification as a REIT, misstated financial reports, violations of loan covenants and/or missed reporting deadlines, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking,"" "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location.

companyName: KBS Growth & Income REIT, Inc.


text: While the Company has experienced, and may in the future experience, cybersecurity incidents, prior incidents have not materially affected the Company's business, results of operations or financial condition. Although the Company has invested in the protection of its data and information technology and monitors its systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to Company information technology systems that could have a material adverse effect on the Company's business. See Item 1A. Risk Factors, which are incorporated by reference into this Item 1C.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Under our Security Incident Response Policy, all of our employees and other personnel are responsible for reporting any known, suspected or possible security events, including those that may have originated with a third-party service provider, to our Information Security Department, which promptly notifies our President, who serves as our Information Security Coordinator. The Information Security Coordinator reviews the initial facts and findings regarding any security events, provides direction to the Information Security Department regarding any additional information that should be obtained, and convenes a meeting of the SIRT to review the matter, including to determine if the event could constitute a security incident.

companyName: EVgo Inc.

ticker: EVGO


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks. The Audit Committee reviews and approves our cybersecurity risk management program.

companyName: American Assets Trust, Inc.

ticker: AAT


text: Our Vice President of Security and Compliance leads our cybersecurity program and is responsible for implementing and maintaining our cybersecurity controls and provides regular updates to the Audit Committee and our executive management team on the status of our cybersecurity program and any cybersecurity incidents.

companyName: Health In Tech, Inc.

ticker: HIT


text: Additionally, the company uses third-party service providers, or vendors, in the course of conducting its operations. As such, the company has measures in place to help identify material risks from cybersecurity threats associated with the use of those vendors. When work with a vendor is evaluated, we consider, among other items, the availability of system and organization control reports, the use of artificial intelligence, interactions with our systems, the data involved and its level of sensitivity, the amount of data the vendor will process, where the data will be stored, what they will do with the data and destruction of data. Once a vendor is approved by the appropriate personnel, expectations regarding incident reporting are established and followed.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Schwab's corporate cybersecurity program is led by our Chief Information Security Officer (CISO), who reports to our Chief Information Officer (CIO). The current CISO has been in his role for several years, and is responsible for our overall cybersecurity strategy, security engineering, security operations, cyber threat detection and incident response, and technology risk and compliance. Our CISO has extensive experience assessing and managing cybersecurity risk, and is supported by a cybersecurity organization comprised of hundreds of professionals, many of whom hold various certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, and Certified in Risk and Information System Control. Our CISO and CIO attend meetings of and present to the Risk Committee of CSC's Board of Directors on our prevention, detection, mitigation, and remediation efforts of our cybersecurity program. We also have an escalation process in place to inform senior management and the Board of Directors of material cybersecurity incidents in a timely manner.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: The Fund has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Fund's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Fund's day-to-day operations and has implemented a cybersecurity program that applies to the Fund and its operations.

companyName: Stone Point Credit Income Fund


text: Our Information Security Team is responsible for the oversight and operation of our Program. Our Chief Information Security Officer oversees our Information Security Team and works in close collaboration with our Chief Technology Officer, Chief Compliance Officer, General Counsel, and Chief Privacy Officer. This group works hand in hand with our Privacy Team in the protection of data. The Privacy Team is a team of senior leaders that identifies and addresses issues related to the use and disclosure of data. The Information Security Team, on the other hand, controls our security standards and operating procedures. In particular, they and their teams provide guidance and support to each of our business segments, coordinate internal reviews, including those conducted by our internal auditors, and monitor and evaluate the security assessments from our internal and external parties.

companyName: R1 RCM Inc. /DE


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, Morgan Stanley's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the GLB Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the MS Board and, in accordance with the MS Board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the MS Board on cybersecurity risks and threats and other related matters.

companyName: North Haven Net REIT


text: We also engage internal and external assessors, consultants, auditors, and other third parties, to identify opportunities for improvements to our cybersecurity program. We manage cybersecurity risks associated with third parties, including vendors, service providers, and external users of our systems. This includes conducting due diligence on the third parties we use, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, and by using contracts to reinforce their cybersecurity obligations.

companyName: MCKESSON CORP

ticker: MCK


text: The cybersecurity risk management program at Viasat is centered around an internally developed set of security principles and requirements, known internally as our "Foundational Security Principles". The Foundational Security Principles, which we seek to apply across our products and services to promote security resiliency and repeatability, represents a minimum baseline of information security requirements. These principles have a focus on secure-by-design approaches for new products and services, and provide the basis for risk-informed control implementations for legacy networks and systems. Our Foundational Security Principals are designed with reference to the current published version of industry frameworks including, but not limited to, NIST Cybersecurity Framework 2.0, International Standards Organization (ISO) 27001, Payment Card Industry (PCI) Data Security Standard (DSS), National Institute of Standards and Technology (NIST) 800-171, and tailored baselines of NIST 800-53. This does not imply that we have implemented each, or any specific, technical standard, specification or configuration embedded in these frameworks but rather that they collectively inform and guide our indentification, assessment and management of cybersecurity risks relevant to our businesses. Certain IT environments with higher risk or contractual, regulatory or customer requirements, or those environments where processing or storing sensitive types of information are required, are designed to comply with stricter sets of security requirements or security control frameworks.

companyName: VIASAT INC

ticker: VSAT


text: We collaborate with third parties to assess the effectiveness of our cybersecurity incident prevention and response systems and processes as our SOT deems necessary or appropriate. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity threats and risks, as well as to support associated mitigation plans when necessary. Our System and Organization Controls (SOC) Type 2 audit, completed in September 2024, attests to the effectiveness of our security and risk management controls. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities critical to our ongoing business operations, including those that perform cybersecurity services.

companyName: QXO, Inc.

ticker: QXO


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. The Company engages cybersecurity consultants, assessors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and vulnerability evaluations to help identify potential weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company's dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Although we believe that we maintain a robust program of information security and controls and that none of the cybersecurity incidents that we have encountered to date have materially affected us, we cannot be certain that the security measures and procedures we have in place to detect security incidents and protect sensitive data will be successful or sufficient to counter all current and emerging risks and threats. The impact of a material cybersecurity incident involving our systems and data, or those of our clients, partners or vendors, could have a material adverse effect on our business strategy, results of operations and financial condition.

companyName: RYVYL Inc.

ticker: RVYL


text: Senior management is directly involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Senior management participates in cybersecurity incident response efforts by being part of the incident response team and helping direct our response to cybersecurity incidents.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: Management's Role in Cybersecurity Risk Management A division of the Company known as Nucor Business Technology, or NBT, is responsible for the Company's information technology needs, including cybersecurity risk assessment and management. NBT's cybersecurity function is led by the Cybersecurity Director, who reports to the President of NBT, who in turn reports to the Company's Chair, President, and Chief Executive Officer. The current Cybersecurity Director has twenty years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, and incident response.

companyName: NUCOR CORP

ticker: NUE


text: Our company recognizes cybersecurity as a critical component of its risk management strategy. We are committed to protecting our digital assets, customer data, and intellectual property from cyber threats. Our approach is guided by industry best practices and compliance with relevant cybersecurity standards and regulations including SOC 2, ISO 27001, and ISO 27701. We conduct regular assessments to identify potential cybersecurity threats and vulnerabilities that are then reviewed by external auditors as part of our annual SOC 2 Type 2 Review and ISO 27001 audit. This process includes evaluating external threat landscapes, internal systems, and processes for susceptibility to cyber-attacks. We utilize both in-house expertise and external consultants to ensure a comprehensive assessment. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Moatable, Inc.

ticker: MTBLY


text: The Company maintains cybersecurity policies including an Acceptable Use Policy that all system users sign to acknowledge that they understand their security responsibilities. All system users receive security awareness training which includes phishing attack simulation testing.

companyName: OneMeta Inc.

ticker: ONEI


text: As part of our cybersecurity risk management program: • Cybersecurity risk assessment is performed on all new products and product updates; • We e mploy internal staff with security certifications, and we work with third parties to perform security vulnerability testing; • Changes to data protection laws are closely monitored and necessary changes are implemented; • We provide routine security training to employees and communicate any emerging threats; • We review the security posture of all third parties that we engage; • We maintain a comprehensive incident response plan; and • We carry cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.

companyName: Phunware, Inc.

ticker: PHUN


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2 ("NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: DIH HOLDING US, INC.


text: The Company prioritizes cybersecurity as a strategic pillar integral to its business strategy, risk management, and governance frameworks. The Board of Directors and executive management play an active role in evaluating the effectiveness of our cybersecurity policies, practices, and procedures. Regular updates are provided by the Chief Information Officer to ensure cybersecurity risks are continuously monitored and addressed across all business functions. Our cybersecurity program incorporates policies, procedures, systems, and controls designed to safeguard the accessibility, confidentiality, and integrity of our data and systems. These processes are shaped by industry trends, and the evolving cybersecurity landscape.

companyName: HEICO CORP

ticker: HEI


text: Internal security controls are designed to align with standards set by the NIST. We monitor emerging data protection laws, conduct background checks of our employees in specific technology and cybersecurity roles, apply least privilege access to users, test the maturity and readiness of our cybersecurity program, conduct table top exercises based on current threat scenarios to increase awareness, conduct phishing testing, provide cybersecurity training to our Board and employees, and provide cybersecurity alerts to our customers on ongoing threats. We monitor notifications and alerts from the FS-ISAC and other industry cybersecurity sites to stay abreast of the most recent cybersecurity alerts.

companyName: ENTERPRISE BANCORP INC /MA/


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include (i) maintenance and monitoring of information security policies aligned with global regulatory controls; (ii) user and employee awareness of cyber policies and practices; (iii) information systems configuration management; (iv) third-party risk management systems; (v) identity and information asset protection; (vi) infrastructure security systems; and (vii) cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also engage a range of third-party experts in connection with various development, implementation, and maintenance activities related to our cybersecurity program. We have integrated cybersecurity risk into our disclosure controls and procedures.

companyName: MANNATECH INC

ticker: MTEX


text: Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than five years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."

companyName: PINTEREST, INC.

ticker: PINS