text: Our information security function, which is led by our Chief Information Officer, or CIO, helps identify, assess and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Data leaks: Data leaks could result in a breach of our privacy policies for customers sensitive data, resulting in potential regulatory violations or commercial litigation. Our processes aim to restrict access and monitor for leaks of internal and/or external data.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH

secItem: Item 1C


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our Information Security team utilizes various tools to prevent, detect, monitor, and react to cybersecurity threats. Our Incident Response Playbook outlines processes, roles, responsibilities, engagements, escalations, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, escalations, and communications, including an evaluation of any necessary or required disclosure. Roles and escalation paths range from within the Information Security team up to the Executive Committee, and the board of directors and its committees, as appropriate.

companyName: ELI LILLY & Co

ticker: LLY


text: SCC's information security strategy is led by the Technology and Information Security Director ("TISD"), with review and support from the Chief Information Security Officer ("CISO") of Grupo Mexico. The main purpose of SCC's information security strategy is to identify and manage technological risks that could affect the Company's objectives and to strengthen our Company's resilience. As part of management's oversight of cybersecurity, the information security strategy is presented on an annual basis to SCC's Audit Committee of the Board of Directors, which reports to the full Board of Directors, with additional review and oversight by AMC's Risks Committee. In addition, we conduct a quarterly follow-up of our cybersecurity strategy's execution progress and any significant cybersecurity incidents are rigorously monitored.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Our cybersecurity program shares common methodologies, reporting channels and governance processes as the risk management programs of other departments within our company, including the legal, compliance, strategic, operational, and financial departments.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: Our Information Security Program is assessed periodically to test the effectiveness of key controls through cybersecurity maturity measurements, technology risk oversight, compliance risk management testing and monitoring, internal audit review, and regulatory oversight. In addition, Truist maintains disaster recovery plans that are reviewed, modified, and approved annually.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Despite the Utilities' security measures, all of their systems are vulnerable to disability, failures or unauthorized access caused by natural disasters, cybersecurity incidents, security breaches, user error, unintentional defects created by system changes, military or terrorist actions, power or communication failures or similar events.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: While Wesbanco and its third-party providers have in the past experienced cybersecurity incidents, Wesbanco is not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect Wesbanco, including its business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Interruption to Our Information Systems or Breaches in Security Could Adversely Affect Wesbanco's Operations."

companyName: WESBANCO INC

ticker: WSBC


text: We manage risk, including cybersecurity risk, via three distinct lines of defense. As the first line of defense, business managers, including IT managers, are responsible for maintaining effective internal controls and executing risk and control procedures on a day-to-day basis. As the second line of defense, the legal, compliance and information security governance functions provide guidance and training and perform monitoring, testing and surveillance activities relating to compliance with the firm's policies and procedures, applicable laws and regulations, contractual requirements, ethical standards and industry best practices. As the third line of defense, our internal audit team provides periodic independent assurance that the firm's internal controls are implemented and operating effectively.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We recognize the importance of maintaining an integrated cybersecurity risk management system and view our responsibility for cybersecurity management as an enterprise risk, where we have adopted proactive and defensive safeguards. We maintain layered processes that place responsibility for management and mitigation of cybersecurity risks at both the management and Board level, which is modeled after the National Institute of Standards and Technology's cybersecurity framework, as more fully described below.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: The Company's cybersecurity program focuses primarily on securing and safeguarding computer systems, networks, cloud services, business applications, and data and is integrated in the Company's overall risk management strategy and framework. The Company has implemented protocols to protect against cyber threats and ensure the containment and security of sensitive business data, including ongoing security reviews of critical systems, continuous monitoring of event data, and employee training programs, which processes are aligned with the Company's overall business and operational goals and strategies. The Company also actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures. In 2023, the Company initiated efforts to streamline existing processes, enhance technological capabilities, and improve user experience and security.

companyName: Penumbra Inc

ticker: PEN


text: Board and Committee Oversight - Our Board of Directors has ultimate oversight of the Company's cybersecurity programs and strategy, with the Audit Committee maintaining oversight responsibility in reviewing cybersecurity and other information technology risks. The Audit Committee assesses the steps management has taken to monitor, minimize or control such risks or exposures. The Company's Chief Information Officer ("CIO") presents a cybersecurity report to the Audit Committee each quarter. The report includes updates of recent cybe rsecurity threats, current key performance indicators of security controls and summaries of any recent incidents at the Company.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: PyraMax Bank remains committed to maintaining the highest standards of cybersecurity to protect the interests of its customers, shareholders, and other stakeholders. By implementing robust risk management practices, strategic initiatives, and effective governance mechanisms, PyraMax Bank strives to mitigate cybersecurity risks and safeguard its operations against evolving threats.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: We have also established a cross-functional Cybersecurity Incident Response Team led by our Head of Information Security serving as the chair and consisting of senior-level functional leaders, with appropriate members of our executive leadership team added on an ad hoc basis as necessary for any particular threat or incident. This team seeks to safeguard the confidentiality, integrity, and availability of our critical information assets and protect against cyber threats through establishing a proactive and effective incident response program, fostering a culture of security awareness, and ensuring the continuous improvement of our incident response capabilities. In the event of a cyber security incident, the team is responsible for the swift detection, containment, mitigation, and recovery from such incident to minimize business disruption, protect intellectual property, and maintain the trust of our stakeholders.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: Integrated Risk Management Management is responsible for the day-to-day management of the Company's risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of the Company's risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, manage, monitor and report current and emerging non-financial risks. As part of this framework, the Company has an Enterprise Risk Management ("ERM") Committee which is chaired by the Company's Chief Risk & Compliance Officer. Our Chief Information Security Officer ("CISO") is also a member of the ERM Committee. The ERM Committee oversees the Company's risk management framework, including the implementation of the framework components across the Company and promotes a strong Company-wide culture of risk management, compliance and control.

companyName: S&P Global Inc.

ticker: SPGI


text: Our Board of Directors ("Board") generally oversees Columbia's risk management practices and processes. Annually, the Board reviews the results of the annual enterprise risk management program, including updates from our CISO related to cybersecurity matters. The Audit Committee also receives an update on the enterprise risk management program annually. The Board has delegated primary oversight of the management of cybersecurity risk to the Audit Committee. The Audit Committee annually reviews the strategies, investments and risks related to Columbia's information technology systems, including a review of Columbia's cybersecurity programs, and also receives quarterly updates from our CISO. The Board is informed of cybersecurity events to the extent they may materially impact Columbia or management otherwise believes they should be escalated to the Board.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: The Company's Infrastructure Director is responsible for managing cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Infrastructure Director has 20 years of experience in the creation and management of enterprise security risk programs. The Infrastructure Director reports to the Chief Information Officer, who actively engages to monitor IT activities and has 40 years of Enterprise Security Management Experience as well as membership in a CIO peer group that reviews local cybersecurity concerns on a regular basis. The Chief Information Officer in turn reports to the EVP, Global Supply Chain & Import who is responsible for the Company's management of cybersecurity risk. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the appropriate Business Team Member in accordance with the Company's Incident Management Plan.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: Management has responsibility for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: KORU Medical Systems, Inc.

ticker: KRMD


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. We leverage a defense-in-depth model to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally. Our privacy and cybersecurity policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our Information Technology, Privacy, Product, and Operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed privacy and cybersecurity laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.

companyName: QWEST CORP

ticker: CTBB


text: We are continuing to build processes to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. Additionally, we generally require those third parties that have greater access to sensitive information to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: Inari Medical, Inc.


text: Management's Role in Assessing and Managing Cybersecurity Threats Our IT and Security team, which is headed by our CIO, is responsible for our efforts to comply with cybersecurity standards, establish industry-recognized protocols and protect the integrity, confidentiality and availability of our IT infrastructure. Our CIO and various members of the IT and Security team, meet regularly with members of management to address key security and privacy issues. Our CIO has more than 24 years of infrastructure and cybersecurity experience and holds various relevant certifications. We also have formed a cyber event incident team, composed of our CIO, Chief Financial Officer, Corporate Controller, Chief Legal Officer and vice president of Internal Audit, who upon the occurrence of a cybersecurity incident, would convene to assess the materiality of the event as well as the appropriate remediation and escalation procedures, including escalation to our Chief Executive Officer and the Board of Directors. Our internal audit department additionally conducts regular audits to assess management's processes and controls employed to identify and manage material cybersecurity risks.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: The Cyber SteCo oversees our engagement with reputable third parties, which we utilize in connection with our established processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: Our CTO and CISO meet regularly to assess current cybersecurity threats and evaluate our potential vulnerability to cybersecurity risks. The CTO and CISO also engage periodically with external and internal auditors and engage periodically with the guidance of outside threat intelligent agencies including the Cybersecurity and Infrastructure Security Agency and the Oil and Natural Gas Information Sharing and Analysis Center.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Immunovant and the healthcare technology Vants that have established and maintain separate cybersecurity functions, governance is similarly overseen in the first instance by the boards of directors of those Vants as part of their overall risk management strategy, with ultimate oversight on a company-wide basis by the Roivant board of directors.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the section titled "Risk Factors—Risks Related to Our Business and Industry—Our business and operations would suffer in the event of information technology system failures, security breaches, cyberattacks or other deficiencies in cybersecurity."

companyName: P3 Health Partners Inc.

ticker: PIII


text: The Company leverages the Advisor's expertise in cybersecurity risk management and compliance, including the assessment and ongoing oversight of risks associated with our use of third-party vendors, suppliers, and service providers critical to the Company's business functions. Any material risks identified by the Advisor's chief technology officer (the "CTO"), will be reported to the Advisor's chief operating officer (the "COO") and the Company's chief compliance officer (the "CCO").

companyName: 5C Lending Partners Corp.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. Oversight of such cybersecurity risks is executed directly by the Board of Directors. The Board receives reports and engages in regular discussions with management regarding the Company's significant risk exposures resulting from material cybersecurity threats and the measures implemented to monitor and reasonably manage these risks.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition. See Item 1A. "Risk Factors – OPERATIONAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure" in this Form 10-K.

companyName: SLM Corp

ticker: SLM


text: Managing cybersecurity risk is critical to supporting our vision, enabling our strategy, and safely operating our business. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process which covers all Company risks. As part of this process, appropriate personnel collaborate with third-party subject matter experts to gather insights for identifying and assessing material risks associated with cybersecurity threats, their severity, and potential mitigations. Further, we provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real cybersecurity incident or suspected cybersecurity threat. Compare our processes to benchmark standards, such as those set by the National Institute of Standards and Technology ("NIST"). Closely monitor emerging data protection laws and implement changes to our processes as needed. Conduct annual cybersecurity management and incident training for employees involved in our systems that contain sensitive data.

companyName: I-ON Digital Corp.

ticker: IONI


text: The Company has implemented and maintains multiple layers of physical, administrative and technical security processes designed to protect our manufacturing facilities from disruptions that may result from cybersecurity incidents, as well as to safeguard the confidentiality of our critical systems, and data residing on those systems, including employee data, customer data, and intellectual property. Our risk assessment and management of material risks from cybersecurity threats is integrated into our overall enterprise risk management process, as well as our information systems processes. Our strategy includes regular formal risk assessments, dynamic risk and threat analysis, utilization of security tools, regular cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and frequent security awareness and technical security trainings. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response program, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.

companyName: GENTEX CORP

ticker: GNTX


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our ongoing efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to the risk factor titled "We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could materially harm our business." in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.

companyName: STAR OPERATING COMPANIES, INC.


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have developed the following processes as part of our strategy for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Stran & Company, Inc.

ticker: SWAG


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Audit Committee semi-annually receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging cybersecurity threat risks and describing the company's ability to mitigate those risks. Members of the Board and the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.

companyName: BioAtla, Inc.

ticker: BCAB


text: CXApp's information security program is aligned with business objectives that establish rules governing how to identify risks, assign risk ownership, how the risks impact the confidentiality, integrity and availability of the information and the method of treatment for identified risks. A formal risk assessment methodology is approved by management.

companyName: CXApp Inc.

ticker: CXAI


text: Our cybersecurity management team includes our corporate vice president of information technology, who leads the operational teams responsible for enterprise security, data governance and enterprise incident response, and global operations, and our senior vice president of cloud and engineering operations, who leads the operational teams responsible for product and cloud security, data governance and product security incident response. Our operational cybersecurity teams are comprised of members with decades of collective experience in IT security systems, tooling, operations, and governance, and hold various IT security industry certifications and have received specialized cybersecurity training.

companyName: CALIX, INC

ticker: CALX


text: We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, there is no guarantee the measures and security we have implemented will be successful in detecting and preventing a cybersecurity incident. Please refer to Item 1A of this Annual Report on Form 10-K for more information regarding additional risks related to cybersecurity and information technology.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: For a description of the risks from cybersecurity threats that may materially affect us and how those threats may do so, see our risk factors under Part 1. Item 1A. "Risk Factors - If our information technology systems or data, or those maintained by the third-parties with whom we work, are or were compromised, this could result in a Material Adverse Impact."

companyName: aTYR PHARMA INC

ticker: ATYR


text: The Audit Committee is responsible for oversight of our cybersecurity policy, procedures and risk mitigation. Our information technology (IT) leadership briefs the Audit Committee and the Board of Directors on a periodic basis on information security matters, including the current cybersecurity landscape, progress on information security initiatives and accomplishments, and reports on material cybersecurity incidents, as needed.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology and cybersecurity functions. By fully outsourcing our IT environment and placing it within expert third-party software-as-a-service, human resource, and clinical providers our primary means of avoiding cyber risk is not having sensitive data within our enterprise. All third parties are managed by our team, and we review our vendors to ensure that they have risk management procedures in place, including physical, procedural, and technical safeguards (such as: response plans, regular tests on the systems, third-party auditing, incident simulations and routine review of appropriate policies and procedures to identify risks and refine security practices). Our Senior Director of IT Operations and Security is responsible for vendor management regarding our vendor risk experience and reports directly to our Chief Financial Officer. We track security risk as a company and review it annually at the senior management level.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: We have a Cyber Risk Committee ("Cyber Committee") which reviews and reports on cybersecurity risks and related issues. The Cyber Committee is comprised of senior management from various business units within the Company and meets at least quarterly to review the status of the Company's overall cybersecurity risk management program, as well as controls and procedures and to stay up to date regarding relevant legislative, regulatory, and technical developments. The Cyber Committee is responsible for assessing and managing our material risks from cybersecurity threats. The Cyber Committee has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants, and in this capacity, the Committee works closely with the Chief Information Security Officer.

companyName: Kimco Realty OP, LLC


text: The Audit Committee of the Board of Directors receives periodic reports as needed from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: CalciMedica, Inc.

ticker: CALC


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.

companyName: VOC Energy Trust

ticker: VOC


text: The Audit Committee and Board receive prompt and timely information regarding cybersecurity threats and incidents that meet specified thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.

companyName: BORGWARNER INC

ticker: BWA


text: For the year ended December 31, 2024, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For more information on potential risks related to cybersecurity threats and incidents, please see "Item 1A. Risk Factors – Breaches of our IT systems or improper disclosure of confidential company or personal data, or a failure to comply with privacy laws, regulations and our contractual obligations concerning data privacy or the security of certain information, could have a material adverse effect on our reputation and operations."

companyName: Elanco Animal Health Inc

ticker: ELAN


text: LiveRamp maintains a Security Charter which establishes the overall security program, appoints responsibility and authority to the Chief Information Security Officer (CISO), and establishes a Security Action Committee (SAC) to provide leadership and oversight. LiveRamp's CISO has over 20 years of experience as the Company's security leader, and maintains several industry standard security certifications. The members of the security leadership team, who report directly to the CISO, each have at least a decade of experience relevant to their area of responsibility.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Data Sciences and IT, who has prior work experience in information technology, and our Director of IT, who has experience in network security and systems administration, who are primarily responsible for assessing and managing our material risks from cybersecurity threats. The Vice President of Data Sciences and IT and Director of IT, who report to our Chief Financial Officer, have a combined 25 years of risk management experience. Our Vice President of Data Sciences and IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: OmniAb, Inc.

ticker: OABIW


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the IT department and IT Director discuss cybersecurity risk with management, including our CFO and legal department to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain risks to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. This involves ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our management team oversee and identify material risks from cybersecurity threats associated with our use of such entities.

companyName: Astra Energy, Inc.

ticker: ASRE


text: The Cyber Security program including security operations, governance, risk and compliance, data privacy, and business continuity is led by our Chief Information Security Officer ("CISO") who has over 25 years of extensive experience in technology and data center architecture, client solutioning, complex program management and nearly a decade in cyber risk management, governance and incident handling. Our CISO is supported by a team of cyber experts, many of whom are certified professionals in areas of security architecture, threat hunting, incident response, application security, business resiliency and data privacy among others.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and, to the best of our knowledge, are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. Major incidents emanating from cybersecurity threats are notified to our Operational Risk team through our enterprise risk management system and escalated in accordance with our incident response plan. In addition, cybersecurity has been designated as a principal risk by the Risk Committee of our Board of Directors (the "Risk Committee"), which requires regular monitoring and reporting.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: The Company has also implemented a vulnerability assessment program that is conducted at least annually and more frequently, depending on the nature of the risk. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.

companyName: American Water Works Company, Inc.

ticker: AWK


text: We have a third party risk management program designed to oversee, identify, and mitigate material risks from cybersecurity threats associated with our use of third-party service providers. We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example: reviewing the third party's relevant security audits and assessments; conducting our own security assessments, and imposing contractual obligations related to information security.

companyName: Zoom Communications, Inc.

ticker: ZM


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the headings "Risks Relating to our Business - If there are events or circumstances affecting the reliability or security of the internet, access to our website and/or the ability to safeguard confidential information could be impaired causing a negative effect on the financial results of our business operations" and "Risks Relating to our Business - Computer Malware, Viruses, Hacking, Phishing Attacks and Spamming Could Harm Our Business and Results of Operations" in this Form 10-K.

companyName: QXO, Inc.

ticker: QXO


text: We have not experienced any cybersecurity incidents that have had a material adverse effect on our business, financial condition, results of operations, or cash flows. Although we have not experienced any cybersecurity incidents that are individually, or in aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. We recognize the potential impact of cybersecurity risks on our business strategy, results of operations, and financial condition and take proactive measures to mitigate these risks. See Item 1A. "Risk Factors."

companyName: NOV Inc.

ticker: NOV


text: We maintain a cybersecurity risk management program and related policies and processes to identify, assess and manage material risks from cybersecurity threats. Our program includes working groups responsible for the monitoring of and response to threats. Security workgroups assess and monitor risk posture by continuously evaluating IT infrastructure, deploying security information and event management software tools, and enforcing an assortment of other IT security controls. We communicate regularly with partner contractors and agencies to support risk management, threat monitoring, and incident response efforts.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: Additionally, the Company is aware of the risks associated with third-party service providers, it implements stringent processes to oversee and manage these risks. The Company conducts security assessments of third-party technology providers before engagement and maintains ongoing monitoring to ensure compliance with Company cybersecurity standards. The monitoring includes assessments (e.g., reviewing vendor cybersecurity related attestation and disclosures (SOC 2 Type 2, etc.)) by the Company's Senior Vice President and Chief Information Officer ("CIO") and on an ongoing basis by its security engineers.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Although CLEAR has not experienced any material cybersecurity breaches during the reporting period, we acknowledge that cyber incidents, if they were to occur, could have a material adverse effect on our financial results.

companyName: Clear Secure, Inc.

ticker: YOU


text: Management of Cybersecurity Risks Textron Information Services is led by our CIO who has held positions of increasing responsibility within our corporate, Bell and Textron Systems IT organizations since 2008, including leading the IT organizations at both segments in maintaining compliance with U.S. Department of Defense information security requirements, as well as with our enterprise information security policies and standards. He previously led strategic IT projects and teams responsible for delivering global IT solutions for several large U.S. based companies.

companyName: TEXTRON INC

ticker: TXT


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.

companyName: Invesco Real Estate Income Trust Inc.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that our ERM process evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process annual risk assessment is presented to the Audit Committee of the Board of Directors.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: The CIO, Security Officer has over three decades of technology experience, working for leading technology and consulting companies and previously served as CIO, Security Officer for both public and private medical device and healthcare organizations. Our cybersecurity team includes a former chief information security officer for large healthcare organizations, a former head of global security for a major enterprise cybersecurity platform, and other similarly credentialed professionals. Our CIO, Security Officer reports to the Chief Financial Officer and provides regular reports to the Audit Committee on cybersecurity policies, procedures, and risk and remediation efforts. Our CIO, Security Officer also serves on our Disclosure Committee and has regular dialogue with the senior management team on information security matters and risk management practices.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: Our systems periodically experience attacks intended to lead to interruptions and delays in our services and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, no cybersecurity incidents have had a material impact on our business, financial condition or results of operations, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us. Any significant disruption to our service or access to our systems could result in a loss of customer data and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a material adverse effect on our business, financial condition and results of operations. See "Risk Factors — Cyber-attacks involving our systems and data could expose us to liability or harm our reputation and have a material adverse effect on our business."

companyName: AGILYSYS INC

ticker: AGYS


text: Our board of directors has final oversight responsibility over cybersecurity-related matters. The full board of directors participates in interactive sessions with management, typically twice a year, dedicated to cybersecurity risks. These sessions, led by our Chief Information Security Officer (CISO), address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, internal audits, technological trends and information security considerations arising with respect to our peers and third parties.

companyName: HUBSPOT INC

ticker: HUBS


text: We have implemented a cybersecurity process that is designed to assess, identify, manage and govern material risks from cybersecurity threats and requires a firewall for outside connections.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: We have established a cybersecurity committee, composed of members of senior management, to provide guidance, management and oversight of our cybersecurity and data responsibility initiatives and risk assessment and mitigation protocols, including those described in the "Risk Management and Strategy" section above. Our chief architect, who has over 15 years of experience in software engineering and has served as our chief architect for eight years, is a member of our cybersecurity committee and works to manage our cybersecurity policies and processes. Our chief architect and cybersecurity committee stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. This is done through regular checks of our systems, tests to identify security weaknesses and maintaining our incident response plan.

companyName: Revolve Group, Inc.

ticker: RVLV


text: As part of our enterprise risk management program, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets, and our cybersecurity risk management processes include physical, procedural and technical safeguards. Our cybersecurity policies, standards and procedures include incident response plans designed to help coordinate our response to cybersecurity incidents. We seek to enhance our policies and practices, as appropriate, to adapt to changes in regulations and evolving cybersecurity risks, including by conducting cybersecurity incident tabletop exercises with our management team.

companyName: KADANT INC

ticker: KAI


text: Valley maintains incident response and recovery plans that are intended to assist in Valley's response to a cyber or information security incident, and such plans are evaluated on a regular basis. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, including notifying functional areas (e.g., legal), as well as senior management and the Board, as appropriate. As part of these plans, we have also implemented controls and procedures providing for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents, including to regulators and governmental agencies, can be made by management in a timely manner.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, Governance

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise IT environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; a cybersecurity risk assessment to evaluate our readiness if the risks were to materialize; risk is addressed and tracking any necessary remediation through an action plan.

companyName: American Bitcoin Corp.

ticker: ABTC


text: The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. At least twice a year, the Audit Committee receives a report from the head of Information Technology of our cybersecurity threat risk management and mitigation strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the company's plans to mitigate those risks, and discusses such matters with our head of IT and other members of senior management. Potentially material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management. Two members of our Board, including one member of the Audit Committee, have earned cybersecurity certifications to help them identify cybersecurity threats and oversee management's efforts to manage and mitigate them.

companyName: GLAUKOS Corp

ticker: GKOS


text: For the evaluation of our security controls, ISG engages third-parties services to conduct penetration testing, independent audits or provide consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of our security controls. We also share and receive threat intelligence which we utilize to bolster defenses against active threats. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across the security domain.

companyName: Information Services Group Inc.

ticker: III


text: As of June 30, 2024, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: Day-to-day management of our cybersecurity program is led by our Chief Information Security Officer, or CISO, who is responsible for overseeing information security policies, threat mitigation strategies, and compliance initiatives. The CISO provides periodic updates to management and the Audit Committee of the Board of Directors, ensuring that cybersecurity remains a key focus of our risk management framework. Our incident response protocols are structured to provide clear escalation pathways for cybersecurity incidents, ensuring that appropriate leadership is engaged in a timely manner to coordinate an effective response.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: We have also designed procedures to implement our cybersecurity policy, minimize cybersecurity threats to our clients and conduct reviews to monitor and ensure our policy is observed, properly implemented and amended or updated as necessary, including cybersecurity oversight, periodic risk assessments and external consultant reviews, access restrictions, ongoing training, governance policies and procedures, authentication protocols, secure access measures, and policies for elevating suspicious activities.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Our Chief Information Security Officer ("CISO"), Chief Information Officer ("CIO"), Chief Technology Officer ("CTO"), Chief Legal and Compliance Officer ("CLCO") and Director of Information and Cybersecurity ("DC") have primary responsibility for assessing and managing material cybersecurity risks and are members of an internal committee that reviews issues and initiatives related to data security and privacy (the "Security Committee"), which drives alignment on security decisions across the Company. The CISO has over 20 years of experience in various roles related to information security and related technology, including roles specific to managing security requirements related to organizations operating in the payment card industry. The CIO, CTO and DC also each have over 20 years of experience serving in various roles in information technology fields; the CIO has over 25 years of global technology leadership across fintech, software, and payments industries, leading technology, product, and engineering organizations for multinational companies, with extensive experience in implementing software solutions and managing risk across the entire technology lifecycle. The CTO has been with the Company since 2014 and the DC previously served as the Chief Information Security Officer at an IT services and consulting company. The CLCO has over 20 years of experience managing risks and related disclosure requirements, including risks arising from cybersecurity threats, at publicly traded companies. The Security Committee meets at least quarterly to evaluate security performance metrics, prioritize risks identified through threat intelligence, vulnerability and risk assessments, external audits, and incident response insights, and review the progress of approved security enhancements. The Security Committee also considers and makes recommendations to the Audit Committee on security policies and procedures, security service requirements and risk mitigation strategies.

companyName: CPI Card Group Inc.

ticker: PMTS


text: The Board, which includes a director with cybersecurity expertise, has delegated responsibility for primary oversight of the Program to the ARC, including oversight of the Company's cyber- and technology-related risks and the steps management has taken to identify, assess, monitor, and manage those risks. In addition, the Board has established a reporting structure and cadence related to oversight of the Program, which includes respective oversight responsibilities for the Board, the ARC and management risk committees, including the Technology Risk Committee, the Operational Risk Oversight Committee and the Risk Oversight Committee. Each of the Board and the ARC receive periodic reports on the Program's effectiveness and progress on at least an annual basis.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: Cybersecurity risk management is the direct responsibility of our IT security team, which is led by our chief information officer (CIO) and our chief information security officer (CISO). The IT security team develops, maintains, and enforces our information security program and information security policies, which are reviewed at least annually and are subject to approval by our information security committee. Additionally, we complete the following: • an annual enterprise risk assessment; • an annual threat and vulnerability assessment conducted in accordance with NIST guidance which considers adversarial and non-adversarial threat events that could impact our environment; • periodic IT risk assessments; • quarterly vulnerability management reviews; and • periodic cloud risk assessments.

companyName: Essent Group Ltd.

ticker: ESNT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors or consultants upon which we rely, or our data are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences."

companyName: ACELYRIN, Inc.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats (including any previous cybersecurity incidents) that could be reasonably likely to materially affect us, please refer to our Risk Factors discussion under the heading 'We may be subject to disruptions, breaches or cyber-attacks of our secured networks and information technology systems that could damage our reputation, harm our business, expose us to liability and materially adversely affect our results of operations' in Item 1A of this Annual Report on Form 10-K.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.

companyName: Ceribell, Inc.

ticker: CBLL


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall ERM process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. The ERM process's annual risk assessment is presented to the Board of Directors.

companyName: Clearwater Paper Corp

ticker: CLW


text: The assessment of cybersecurity incidents are integrated as part of the Company's business continuity and disaster recovery program ("BCDR"). Our BCDR includes an incident response protocol that provides a framework for the assessment, response, and recovery phases for any business disruption, including cybersecurity incidents. It also incorporates various event, incident and response teams that comprise the Company's information security, risk management, compliance, legal and other functions as needed in response to any cybersecurity incidents. Our incident response protocol also provides for reporting mechanisms to senior management and our Board of Directors ("Board") in the event of a material cybersecurity incident.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: We engaged an outside consulting firm to conduct a review of our information systems environment and make recommendations to improve security where appropriate. Management shared the report's findings with the Board and periodically updates the Board regarding our progress on implementing the report's recommendations.

companyName: iCoreConnect Inc.


text: Accordingly, our Board of Directors provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from our Chief Compliance Officer (or more frequently, as needed) regarding the overall state of our Cybersecurity Program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.

companyName: SURO CAPITAL CORP.

ticker: SSSS


text: Board of Directors Our cybersecurity program is overseen by the independent Audit Committee of our Board. Our Chief Information Security Officer ("CISO") presents a quarterly report of cybersecurity updates to the Audit Committee. Each quarter, the Board receives a report from the Audit Committee chair on items covered during that quarter's meeting. In 2024, the topics included, among other items, our focus on cybersecurity resilience, new cybersecurity initiatives and our approach to responsible use of artificial intelligence. Our Board's and Audit Committee's inputs are key components in the development of our long-term cybersecurity strategy, aligning the program's goals within our risk tolerance.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1.A – Risk Factors – Risks Related to Our Business Operations – If our internal company cyber-security measures are breached or fail and unauthorized access is obtained to our IT environment, we may incur significant losses of data, which we may not be able to recover and may experience a delay in our ability to conduct our day-to-day business" in this Annual Report.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: The Board of Directors is central to oversight of cybersecurity risks. The Board of Directors is composed of members with diverse expertise, including risk management, technology, finance and legal, and they have appropriate access to management and third parties (as deemed necessary), equipping them to oversee cybersecurity risks effectively. Day-to-day cybersecurity monitoring and oversight activities are delegated to management.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: Cybersecurity risks remain a persistent challenge, as the threat landscape continues to evolve alongside technological advancements. While diligent efforts are made, complete risk elimination or incident assurances are not feasible.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: We are committed to our privacy and security programs, and our security team strives to protect our customer and employee data from cybersecurity risks. From time to time, and at least annually, we review and update if necessary our privacy standards and policies in response to evolving regulatory requirements and internal Unity requirements. Unity personnel are provided annual privacy training, with additional targeted training for key participants in our privacy program. We have procedures in place to address suspected personal-data breaches and notify users determined to be affected and applicable regulator of a breach where we are legally required to do so.

companyName: Unity Software Inc.

ticker: U


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third-party reviews. Other key components of our cybersecurity program include, but are not limited to, asset management, encryption, data loss prevention technology, access controls, identity and access management (IAM), such as multi-factor authentication (MFA), vulnerability management, endpoint threat detection and response (EDR), logging and monitoring involving the use of security information and event management (SIEM), privileged access management (PAM), email and web gateway protection, multi-faceted backup and data recovery solutions, anti-malware, firewalls, IDS and IPS, auditing and monitoring, regular policy updates, security awareness training, anti-phishing campaigns, intrusion detection and prevention, vulnerability and patch management, and third-party risk management. We also subscribe to third-party threat intelligence tools and services that support monitoring, analyzing, and responding to emerging risks and threats. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards, although currently we do not audit this. While we believe our cybersecurity practices are comparable to those of similarly situated companies, the Company does not currently audit its third-party service providers' cybersecurity practices, except through annual SOC-1 reviews and its regulatory and quality control auditing of vendors engaged in clinical trials or the manufacture of products used in the assembly of our medical devices. We also rely on industry leading third party service providers to provide the systems required to effectively run our clinical trials and require that these third-party service providers implement and maintain standard cybersecurity practices. We have business continuity plans that we regularly review and update in line with our evolving applications architecture. We believe our cybersecurity practices comply with applicable legal requirements, including those established by the FDA.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: Our board of directors has ultimate oversight responsibility for our overall enterprise risk management and, with input from our senior management, oversees our cybersecurity risk management. As part of its enterprise risk management efforts, our board of directors regularly receives reports from management on our cybersecurity programs with regard to any risks that may arise from specific cybersecurity threats and incidents. The board of directors oversees management's programs, policies and processes in place that identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which we are exposed.

companyName: AstroNova, Inc.

ticker: ALOT


text: As part of our annual review of our cybersecurity risk management, we engage third-parties for a variety of processes including external audits, vulnerability assessments, and penetration tests. These processes help ensure our overarching strategy remains effective over time.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: At the management level, BNY Mellon's Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon's significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the "CIO") and its members include the CISO.

companyName: VOC Energy Trust

ticker: VOC


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of data, network security controls, access controls, asset management and disposal, physical security, systems monitoring, employee training, penetration testing, and cybersecurity insurance.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: We are in the process of establishing controls and procedures designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. We intend to continue to review and enhance our incident response and recovery plan for the Company Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. Our incident response and recovery plans and policies will address — and guide our employees, management and the Board on our response to a cybersecurity incident.

companyName: VerifyMe, Inc.

ticker: VRME


text: Under agreements with NEE Management and NEER, NEE's affiliates provide or arrange for the provision to XPLR of substantially all of XPLR's information technology functions, including those relating to cybersecurity. XPLR's board oversees the provision of these services.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: WTW's management is responsible for the day-to-day management of risks, and the board, including through its committees, is responsible for understanding and overseeing the various risks facing WTW.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Cybersecurity risks are among the enterprise risks that our Board of Directors oversees, primarily through delegation to the Audit Committee of the Board. The Audit Committee assists the Board in overseeing our privacy and information policies and reviewing our cybersecurity program. The Audit Committee engages with our management team, including our Director of IT and our Chief Financial Officer, and receives periodic reports on cybersecurity. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. These cybersecurity reviews by the Audit Committee or Board of Directors generally occur at least once annually, or more frequently as determined to be necessary.

companyName: AEye, Inc.

ticker: LIDR


text: Overseeing Third-party Risk Before partnering with third-party providers, we conduct a thorough examination of their cybersecurity program, policies, and practices. This includes a review of their SOC 2 reports and any available penetration tests. Additionally, we actively monitor our primary service providers and regularly obtain security control reports from them. We also employ real-time monitoring to detect any suspicious activity promptly. This approach is implemented to minimize risks associated with data breaches or other security incidents that may arise from third-party sources.

companyName: NERDWALLET, INC.

ticker: NRDS


text: The Board oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats and the steps that management has taken to protect against threats to the Company's information systems and security. Our management team works to conceive, implement and monitor the program designed to protect information systems from cybersecurity threats and to promptly respond to any security incidents. Our management team will promptly notify the General Counsel and other executive officers of any cybersecurity events, with material cybersecurity events promptly communicated to the Board and publicly disclosed as deemed necessary.

companyName: Hi-Great Group Holding Co

ticker: HIGR


text: We monitor our websites and online accounts frequently to manage risks associated with cyber-security risks. Our website is monitored by a third party to check if the website or email server is secure. Our webmaster informs us of any issues that may arise in the cyber sector. We are prepared to inform all parties necessary if any breach of cyber-security were to happen. We have never had this problem and so we have never had to inform consultants, auditors, or other third parties.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: The deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. necessary, the use of third-party security experts if and when an incident is detected.

companyName: SOLESENCE, INC.

ticker: SLSN


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises and other exercises focused on evaluating effectiveness. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness and adjusts its cybersecurity processes and practices as necessary.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Information from the risk management process is managed by the Information Security Team and is reported to the Board of Directors on a regular basis. We provide cybersecurity updates to our Audit Committee on a quarterly basis. In the case of an incident, relevant members of the Information Security Team are involved to assess and oversee Incident Response operations as needed, including adequate reporting of material incidents if/when appropriate.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: Our cybersecurity risk management program includes: • We leverage third-party cybersecurity vendors to test our systems, identify previously undiscovered risks in the environment and validate existing cybersecurity controls. We maintain a process to oversee and identify risks from cybersecurity threats associated with our use of third-party vendors with access to our resources. • We educate our users on cybersecurity prevention tactics through monthly security awareness training and ongoing phishing tests. • Email is protected through multiple layers of security that cover all internal and external communication. • We have a robust patching and remediation process for our systems. We use a managed risk service to help detect and prioritize vulnerabilities found in the environment and track them for remediation. • We have a disaster recovery plan and controls designed to protect against business interruption, including multiple backups of our critical systems. • We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, access controls, extended detection and response, and event monitoring.

companyName: CARROLS RESTAURANT GROUP, INC.


text: We are committed to maintaining robust governance and oversight of our information technology and security systems to maintain our facilities' physical security and to protect proprietary and confidential information, including that of our customers, suppliers and employees. Information about information technology and security risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "A breach of our information technology and security systems could materially adversely affect our business."

companyName: NLIGHT, INC.

ticker: LASR


text: Our IT department, lead by our Chief Information Officer ("CIO"), maintains and is responsible for our cybersecurity incident response plans. Our cybersecurity incident response plans include processes for evaluating and escalating our response to cybersecurity incidents across our organization, up to and including our senior executive management and Board, and, where required, making public disclosures. Cybersecurity threats and incidents (including potential cybersecurity threats and incidents) are identified through our cybersecurity detection, prevention, and mitigation tools and procedures. These plans are reviewed and updated at least annually and we maintain third-party cybersecur ity insurance. We have not identified any material cybersecurity incidents during the fiscal years covered by this report. For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A - " Risk Factors – Operational Risks – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K.

companyName: Meritage Homes CORP

ticker: MTH


text: Our cybersecurity risk management program includes the following key elements: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (IT) environment;

companyName: SIMON PROPERTY GROUP L P


text: Our approach to cybersecurity risk management is multi-faceted and includes, but is not limited to, engaging third-party information technology and cybersecurity providers and consultants for support as appropriate, including to conduct annual penetration testing and cybersecurity risk assessments, as well as other vulnerability analyses on a periodic basis. We also utilize a third-party to implement and manage automated tools designed to conduct ongoing monitoring for potential critical risks from cybersecurity threats. Additionally, we have implemented an employee education and training program, offered during onboarding and on an ongoing, periodic basis thereafter, that is designed to raise awareness of cybersecurity threats. As part of this employee training, we engage in periodic phishing simulations designed to raise employee awareness of such risks.

companyName: Societal CDMO, Inc.


text: Our Audit Committee, in connection with management led by our Chief Financial Officer, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Board of Directors on a quarterly basis, reviews the processes and performance indicators related to prevention, detection, mitigation, and remediation of cybersecurity incidents that could adversely impact business operations. The purpose of those reviews is to help the Company to maintain a cyber incident response plan with defined roles, responsibilities, and reporting protocols, which focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: Our approach to designing, operating and measuring the effectiveness of our program leverages experienced internal resources, industry-recognized cybersecurity consultants, assessors, healthcare and industry-specific cybersecurity working groups and threat-intelligence platforms, federal law enforcement and CISA partnerships. We use these resources and partnerships, along with our internal expertise, to develop specialized insights pertinent to our business's cyber-risk, and tailor our cybersecurity strategy to best safeguard our systems and data.

companyName: RadNet, Inc.

ticker: RDNT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws, other litigation and legal risks, and reputational risks. To aid in our efforts to assess, identify, and manage any material risks, we have implemented several cybersecurity processes, technologies, and controls.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Based on the information available as of the date of this Form 10-K, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see Item 1A, "Risk Factors" in this Form 10-K.

companyName: Arhaus, Inc.

ticker: ARHS


text: The Company will designate a Chief Information Security Officer (the "CISO"). The Program will be implemented and managed by the Company's executive management under the leadership of the CISO. The Company will contract with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: At the Board of Directors level, our Audit Committee oversees our risks related to information security and privacy. To accomplish this responsibility, the Audit Committee meets quarterly with our CTO and CISO to receive and discuss updates on our cybersecurity program. Top risks, key initiatives, any material cyber incidents, remediation activity and security metrics are shared to report the overall loss potential, program effectiveness, risk management conditions and current threat landscape.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: Our management team, including our CSO, Chief Financial Officer (CFO), Chief Operating Officer (COO) and Chief Legal Officer (CLO), are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program. Our management team works closely with our CSO who has over 20 years experience in information technology and operational technology security, and specialized training, including graduating from the Federal Bureau of Investigation Chief Information Security Officer Academy.

companyName: Beachbody Company, Inc.

ticker: BODI


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also strives to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.

companyName: Sabine Pass Liquefaction, LLC


text: Our Chief Financial Officer and the head of our IT department oversee our cybersecurity policies and processes, including those described above. The Company's overall risks and assessments are monitored by a cross functional team composed of members of senior management, security, legal, information technology and financial reporting, which evaluates risks associated with assets such as infrastructure, software, people, processes, and data. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required. The Company's incident response plan is tested and adjusted regularly or in response to a particular incident or significant threats where appropriate.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Board of Directors receives regular reports from the SMIS and Cybersecurity Committee on, among other things, the Company's cyber risks and threats, the status of projects to strengths of the Company's information security systems, assessments of the Company's security program, insurance, and the emerging threat landscape. In accordance with our cyber incident response plan, the Cybersecurity committee s promptly informed by SMIS's team of cybersecurity incidents that could adversely affect the Company or its information systems and is also regularly updated about incidents with lesser impact potential. The Board of Directors and Audit committee are informed of any incidents that could adversely affect the Company by the Cybersecurity committee and SMIS's team.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: In addition, we have an employee awareness program to regularly educate our workforce on the cybersecurity risks they face and how they can operate safely. We provide all associates that have network access with annual data-security training. Our training and education programs include specialized training for associates handling confidential information, information security awareness training, periodic anti-phishing campaigns, one-click email-enabled phish alert reporting functionality and advisory emails on emerging threats.

companyName: US Foods Holding Corp.

ticker: USFD


text: At a management level, our cybersecurity risk management efforts are led by our CISO. Our current CISO was appointed as our Vice President and Chief Information Security Officer in 2021. Our current CISO has expertise in cybersecurity risk management through his more than 25 years of experience in cybersecurity, technology and data privacy roles, including his service with the Company since 2021 and his service as chief information security officer at another large organization prior to being employed by us. In addition, other individuals on our IT security team have cybersecurity experience or certifications relevant to their respective role.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our first line of defense includes our cybersecurity team lead by our Director, Information Security, who work to ensure that the day-to-day execution of the company's technology and security operations are in alignment with corporate policies and procedures. Our Director, Information Security, who reports to our Chief Operating Officer ( " COO"), has over a decade of information security management experience and is a Certified Information Systems Security Professional. Our COO and Director, Information Security are also responsible for information security policies, organizational readiness and the escalation of certain cybersecurity incidents from our cybersecurity personnel to senior management based on our incident response procedures.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: We have established processes and policies for assessing, identifying, and managing material risks arising from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Blend Labs, Inc.

ticker: BLND


text: The Board has overall responsibility for the oversight of risk management at the Company, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, strategic, cybersecurity and other risks that may affect the Company. Our Chief Information Officer, or CIO, leads our cybersecurity program and our Director, Cybersecurity leads our cybersecurity team. Our CIO provides periodic reports relating to cybersecurity matters to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Our executive leadership team and Board provide principal oversight and guidance of our cybersecurity risk management programs and processes. We have established a cybersecurity executive steering committee to review and discuss cybersecurity issues and review our security metrics. The committee is comprised of a cross-functional group of senior executives, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director, Cybersecurity, and is responsible for the implementation and oversight of the processes and systems we use to assess and manage risk from cybersecurity threats as well as cybersecurity incidents. Our CIO and committee members have significant work experience related to cybersecurity issues or oversight and members of our cybersecurity team hold vendor-neutral and vendor-specific certifications from organizations such as the Information Systems Audit and Control Association (ISACA), the Computing Technology Industry Association (CTIA) and the International Information System Security Certification Consortium (ISC2). In addition, we require all new employees to complete cybersecurity training so they are better able to understand how to identify, protect, and preserve sensitive data and minimize risks related to cybersecurity matters. We supplement this new hire training with annual training and certification programs, which includes social engineering simulations. We continue to expand and improve our global training programs to raise employee awareness of security obligations and members of senior management regularly provide employees with communications regarding the cybersecurity environment to increase employee awareness of cybersecurity trends and emerging risks.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: Technological safeguards that are designed to protect the Company's information systems from cybersecurity threats, including the prevention and detection of systems, access controls, and firewalls, which the Company assesses the vulnerability and cybersecurity threat and makes necessary improvements. Utilization of third parties as part of the Company's risk-based approach in identifying and overseeing cybersecurity risks.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item IA. Risk Factors for potential risks related to our information technology systems that we are subject to and that may materially adversely affect our business ("We are subject to risks surrounding our information technology systems failures, network disruptions, breaches in data security and compliance with data privacy laws or regulations.").

companyName: HUBBELL INC

ticker: HUBB


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee along with our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Marpai, Inc.

ticker: MRAI


text: Cybersecurity Risk Assessment Strategy, Policies and Standards The Company's cybersecurity program is primarily structured based upon national and international security protocols and frameworks. The Company has implemented a strategy to address threats to Company assets. The Company's Information Security program balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Company and customer information. The Company conducts benchmark reports of its Information Security program to assess its strength as measured against recommended industry security best practice entities.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Our security program is designed to align with the ISO 27001 (International Organization for Standardization) standard, incorporates elements from the National Institute of Standards and Technology (NIST), and is regularly reviewed and audited by independent external third-party auditors. Depending on the environment, as part of our security program, we have implemented and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: Sprout Social, Inc.

ticker: SPT


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk management process. As part of our overall risk management process, our Vice President of Internal Audit collaborates with subject matter specialists throughout the Company, as necessary, to gather insights for identifying and assessing material risks throughout the Company, including cybersecurity threat risks.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Although we have taken significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. As of December 31, 2023, management has determined that none of the cyberattacks we have experienced, individually or in the aggregate, have had a material adverse effect on our business, financial condition, or results of operations, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information about these risks, see the risk factor titled "Risks associated with information technology can expose Brink's to business disruptions, cybersecurity breaches and regulatory violations" under Item 1A of this Annual Report on Form 10-K and incorporated by reference herein.

companyName: BRINKS CO

ticker: BCO