text: To manage risks to our Company, including information and security risks, our Board oversees our enterprise-wide approach to risk management with a fundamental belief that the key components of risk management are: • Identifying potential risks that we face; • Assessing the likelihood and potential impact of the risks; • Adopting strategies and controls designed to manage the risks; • Reporting on a regular basis regarding the assessment and management of the risks; • Monitoring these potential risks on a regular basis; and • Evaluating whether there are new potential risks to assess.

companyName: DAVITA INC.

ticker: DVA


text: Cybersecurity Incidents We maintain an active process to detect and respond to cybersecurity incidents. While we have experienced routine threats and minor incidents in the normal course of operations, to date, we have not identified any cybersecurity incidents that have materially impacted our business, operations, or financial results.

companyName: PETMED EXPRESS INC

ticker: PETS

secItem: Item 1C


text: The Company leverages the expertise of independent consultants, legal advisors, and audit firms to evaluate the effectiveness of our risk management systems and address potential cybersecurity incidents efficiently. Training: The Company conducts periodic cybersecurity training for its workforce.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Continuous Monitoring: The IT department has implemented monitoring tools and processes to detect and respond to cybersecurity threats in real time.

companyName: DallasNews Corp


text: Our management team is informed and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CTO has over 25 years of information technology experience, including leadership experience managing global product development, information security, IT infrastructure and engineering. He holds a M.S. in information systems from George Washington University and a B.A. in computer science from State University of New York. The VPCS has over 20 years of information security and technology experience, including 10 years in senior leadership roles in service provider, enterprise, and military environments. He holds an MBA from Georgetown University, a M.S. in information systems from Virginia Tech University, and a B.S. in computer information technology from Purdue University. Additionally, our management team's experience includes industry-recognized certifications, such as CISSP, CISM, and CISA, decades of experience as part of our IT team, and previous cybersecurity leadership positions at various Fortune 500 companies and U.S. Defense contractors.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. The Sponsor has an information security program and policy in place, as mandated by new Regulation S-K Item 106. This program is designed to assess, identify, and manage material risks from cybersecurity threats. Regular reviews of cybersecurity and information technology plans are conducted for key service providers, as part of the Sponsor's disaster recovery and business continuity planning process. Additionally, the Sponsor evaluates whether any cybersecurity threats, including those resulting from previous incidents, have materially affected or are reasonably likely to materially affect the Trust and the Fund.

companyName: Hashdex Commodities Trust

ticker: DEFI


text: Monitor Cybersecurity Incidents The Vice President of IT Security and Sr. Director of Security implement and oversees processes for the monitoring of our information systems. This includes the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have implemented an incident response plan, which includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: In the event of a reported potential cybersecurity incident, our IT Team decides whether such incident triggers our Cybersecurity Threat Evaluation and Response Plan (the "Response Plan"). If triggered, the Company's cybersecurity response team, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team, as appropriate and as set forth in the Response Plan, are responsible for developing, recommending and implementing measures to address the cybersecurity incident, including when appropriate, assessing, containing and mitigating its impact, notifying members of the Company's management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The IT Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of the cybersecurity incident.

companyName: CTS CORP

ticker: CTS


text: While we have experienced cybersecurity incidents in the past, as of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material effect on the Company, including our business strategy, results of operations or financial position. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors-- More General Risks Applicable to Our Industry."

companyName: SHYFT GROUP, INC.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: CARGO Therapeutics, Inc.


text: Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee of the Board of Directors. The Audit Committee oversees the implementation of the cybersecurity risk management program.

companyName: Vestand Inc.

ticker: VSTD


text: Cybersecurity is an integral part of our overall risk management efforts and is integrated with John Deere's overall risk management framework. We take a comprehensive approach by incorporating industry best practices to guide and evaluate our cybersecurity strategy and posture, involving key stakeholders in oversight and decision making, and assessing the program regularly within a dynamically changing environment. We leverage a multifaceted approach to cybersecurity including measures designed to prevent, detect, and respond to cyberthreats while monitoring and adapting to the evolving threat and technology landscapes.

companyName: DEERE JOHN CAPITAL CORP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A."Risk Factors – We are exposed to cybersecurity and data privacy risks that, if realized, could expose us to legal liability, damage our reputation, and harm our business."

companyName: Vertex, Inc.

ticker: VERX


text: Board Oversight: a The Board holds ultimate oversight responsibility for our cybersecurity risk management program. It receives regular updates from management on cybersecurity risks, incidents, and the overall effectiveness of the program.

companyName: IREN Ltd

ticker: IREN


text: Management and Board Reporting Cybersecurity incidents are reported directly to the CISO in accordance with the applicable incident response plan. The CISO, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Executive Vice President Corporate Affairs and Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee. The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the F&RM Committee provided further updates regarding root causes and remediation efforts.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Risk Assessment and Management We manage material risks from cybersecurity threats through a cross-functional and layered approach that is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents and is informed by industry recognized standards.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Our Board and its committees are engaged in the oversight of our most significant enterprise risks, including cybersecurity risks. We assign a member of our executive management team to report material information to our Board regarding these risks. The Audit Committee, working with the Chief Information Officer, provides oversight of the enterprise cybersecurity program. The SET Committee, working with the Chief Technical Officer, provides oversight of the product cybersecurity program.

companyName: CUMMINS INC

ticker: CMI


text: Cybersecurity incidents could result from unintentional events, or from deliberate attacks by unauthorized entities or individuals attempting to gain access to Investview's System Technology for the purposes of misappropriating assets or information or causing operational disruption and damage. To mitigate the risk of an impact to our business operations and/or damage from cybersecurity incidents or cyberattacks, Investview invests in multiple forms of cybersecurity and operational safeguards.

companyName: Investview, Inc.

ticker: INVU


text: Program and Strategy Cybersecurity risk management strategy is an integral component of our operations and our overall risk management process. Recognizing the dynamic nature of cybersecurity threats, we have implemented a comprehensive risk management program that aims to identify, assess, and mitigate potential risks. Our strategy involves a proactive approach, incorporating preventative measures, continuous monitoring, and adaptive response mechanisms. We prioritize the safeguarding of our operational network environment, sensitive data, including confidential business information and personal details of our customers and employees. Regular assessments conducted both internally and by third parties ensure our cybersecurity program aligns with industry standards. In addition to a dedicated cybersecurity team, we employ a defense-in-depth strategy, utilizing multiple security measures to protect our information technology system. Collaboration with third-party experts, industry peers and ongoing training initiatives ensures our cybersecurity strategy remains robust and responsive to evolving threats. We understand the importance of maintaining a vigilant and adaptive stance in the ever-evolving landscape of cybersecurity to safeguard our business operations, financial stability, and as a direct result, our overall success. A dedicated cybersecurity team; Collaboration with a third-party managed detection and response company for 24/7 monitoring and response; Cybersecurity insurance to cover a portion of losses and damages resulting from cyber-attacks or security breaches; An incident response team that is comprised of various departments required for an effective response; Conducting periodic drills and exercises, including industry collaborations and participation from the executive team; Continuous information security awareness training and phishing simulation exercises; Regular security assessments to address evolving risks and threats;

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including our President and CFO. Our President and CFO works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our CFO. As part of those processes, members of management, including our CFO, would work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes are designed to report certain cybersecurity incidents to the audit committee of the board of directors.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program consistent with other legal, compliance, strategic, operational, and financial risk areas. Our program is guided by cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), although we also look to other standards to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SMITH A O CORP

ticker: AOS


text: Current Cybersecurity Events In late May 2023, we experienced a ransomware attack relating to certain systems on our network (the "Cybersecurity Incident"). We promptly initiated an investigation, engaged the services of cybersecurity experts and outside advisors and worked with appropriate law enforcement authorities to contain, assess and remediate the Cybersecurity Incident.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: We have not identified risks from known cybersecurity threats that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Cyberattacks, data breaches or malware may disrupt our operations and trigger significant liability for us, which could harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business."

companyName: TERAWULF INC.

ticker: WULF


text: The full Board of Directors oversees the company's cybersecurity risk management, assisted by the Risk Policy and Capital Committee of the Board. The Board has delegated management-level risk oversight, including for cybersecurity risk matters, to the Enterprise Risk Committee, as described under "Management Role" below.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition. For further information, see "We will continue to face cybersecurity and similar risks, which could result in the disclosure of confidential information, disruption of operations, damage to our brands and reputation, legal exposure and financial losses" in Item 1A, Risk Factors of this Annual Report. In the event an attack or other intrusion were to be successful, we have a trained response team of internal and external resources that are prepared to respond.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: We engage assessors or other third-party service providers in connection with our risk assessment and cybersecurity assessment or audit processes. These service providers assist us to evaluate risks and identify where our current security program may be improved. We consult with these service providers as required to verify mitigation approaches, to compare Blend's security posture against industry peers, and to provide overall feedback for the security program. Additionally, we utilize outside service providers, as well as a bug bounty program, to penetration test our network infrastructure and applications and provide prioritized security vulnerability findings reports. Some Blend customers also perform annual security testing on Blend's infrastructure and applications.

companyName: Blend Labs, Inc.

ticker: BLND


text: In 2024, the Board held an education session with outside experts on cybersecurity. The Company has also implemented a cybersecurity training and compliance program to ensure regular education for all employees. In addition, external parties are engaged to assess Company information security programs and practices, including incident management, service continuity, and information security compliance programs.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The Board of Directors maintains oversight of the Company's cybersecurity risk management practices. MWYN has engaged an external information technology specialist to monitor and assess the Company's cybersecurity posture. This external service provider is responsible for identifying potential threats, conducting regular system reviews, and reporting material cybersecurity risks or incidents directly to the Board. The Board is informed of relevant cybersecurity developments on an as-needed basis and plays a role in reviewing and approving significant changes to the Company's cybersecurity strategies.

companyName: Marwynn Holdings, Inc.

ticker: MWYN


text: The GM Board of Directors established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. Our Global Chief Information Security Officer provides the Risk and Cybersecurity Committee periodic reports on our cybersecurity risks and any material cybersecurity incidents. In addition, our cybersecurity team provides periodic reports to our Board of Directors.

companyName: General Motors Financial Company, Inc.


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Our CISO, under the supervision and direction of the CIO, is responsible for developing and implementing our information security program. Our Executive Committee, made up of senior leaders throughout the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: The Company's processes to identify material risks from cybersecurity threats associated with our use of third-party service providers are included within our service provider management policy. The policy provides guidelines in performing cyber risk assessments on our critical and material third party service providers during onboarding and periodically thereafter.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: Through strategic investments over several years, we have established and enhanced a comprehensive cybersecurity program consisting of security toolsets, people, policies, and contracted third-party service providers that provide technical, organizational, and administrative safeguards to protect against and timely respond to cybersecurity threats and incidents. Our cybersecurity strategy is based foremost on defense in depth, and secondarily on resilience. Defense in depth is a strategy of layered security, in which we employ a variety of overlapping controls, tools, and processes to defend against threat actors. Resilience is a strategy focused on business continuity and disaster recovery, with the goal of rapidly restoring, rebuilding, and recovering from any adverse cyber impacts to our business. These controls, tools and processes include technologies designed to detect and defend against unauthorized access to our systems and infrastructure, relevant corporate policies, periodic cybersecurity and privacy training programs, and incident response protocols for preventing, detecting, responding to and recovering from cybersecurity incidents. We use the National Institute for Standards in Technology (NIST) security framework to evaluate our cybersecurity controls, which we work to continuously enhance.

companyName: COPART INC

ticker: CPRT


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors may experience threats and security incidents that could affect our information or systems. For more information about the cybersecurity risks we face, please see Section 1A. Risk Factors.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Ginkgo incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, Ginkgo has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, "Significant disruptions to our and our service providers' information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us."

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST and the International Organization for Standardization, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: a.monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: Inhibrx, Inc.


text: We recognize the importance cybersecurity has to the success of our business, as well as recognize the need to continually assess cybersecurity risks and evolve our responses in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, records and information against known and evolving cybersecurity threats.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams. For a discussion of these risks, see Item 1A. Risk Factors — The occurrence of cyber incidents, or a deficiency in our cyber security, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.

companyName: W. P. Carey Inc.

ticker: WPC


text: Our Chief Information Officer, who oversees our cybersecurity team, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer and our cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel dedicated to cybersecurity as well as our engaged and retained external cybersecurity consultants. Our cybersecurity team is supported by the information technology department as well as our engaged third parties and our retained service providers and, in addition, is informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has over 20 years of experience in managing large-scale information technology infrastructure and associated technologies and other members of our cybersecurity team have experience and certifications relevant to cybersecurity. In addition, all personnel involved in cybersecurity engage in regular training on cybersecurity matters.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), which are reflected in our related policies, standards, processes and practices. We may implement changes to our cybersecurity program when deemed appropriate based on updates to laws or industry standards among other things. We have multiple layers of security designed to detect and prevent cybersecurity events, as well as dedicated teams of cybersecurity personnel and professionals, which assist our CISO in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. We collaborate with public and private entities and industry groups and engage third-party service providers to expand the capabilities and capacity of our cybersecurity program when deemed appropriate. Certain key components of our cybersecurity program include the following:

companyName: Walmart Inc.

ticker: WMT


text: As part of the ISP that is applicable to the Company, the Investment Manager also performs cyber risk assessments on the Company's critical and material third party vendors during onboarding and periodically thereafter.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: The Program is supported by regular training of information security employees and awareness training and activities for executives, directors, and employees through which we communicate our cybersecurity policies, standards, processes, and practices to foster a culture of cybersecurity risk management across the Company.

companyName: F&M BANK CORP

ticker: FMBM


text: Cybersecurity Risk Management and Strategy Cybersecurity Risk Assessment and Management We take a multilayered approach to cybersecurity risk management and strategy. Our IT/OT Security Program integrates administrative, technical, and physical controls against evolving cybersecurity threats, and includes enterprise IT and OT security architecture, cybersecurity operations, data privacy and governance, supply chain security, and governance, risk, and compliance. Additionally, it is designed to identify, assess, and manage cybersecurity risks and protect the confidentiality, integrity, and availability of our data, IT, and OT.

companyName: CONOCOPHILLIPS

ticker: COP


text: The Company has implemented detective and preventative controls designed to ensure the appropriate level of protection for the confidentiality, integrity, and availability of data stored on or transferred through our information technology resources. The Company has a risk assessment process to identify risks associated with our use of third-party service providers and has implemented specific processes and controls designed to mitigate those identified risks. Both internal and third-party audits are performed routinely to verify that these controls are effective. Additionally, the Company has implemented companywide security awareness training programs designed to provide best practices for protecting our network and systems, and routinely leads exercises for employees to reinforce the risk and proper handling of targeted emails. The Company's Head of Information Security is responsible for developing and implementing these controls and training exercises with support from our information technology department.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: The CISO is also responsible for the ongoing cybersecurity awareness, training and education of the employees of Clean Harbors and any other parties that may interact with the Company's information technology systems. Awareness activities include cybersecurity training, simulated exercises, cross functional tabletop exercises and internal communication updates. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan which has been communicated to the IT and operational organization. This plan includes immediate actions to mitigate the impact, solutions to enable the restoration of business critical technology and long-term strategies for remediation and prevention of future incidents.

companyName: CLEAN HARBORS INC

ticker: CLH


text: Notwithstanding the focus we place on cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: In 2021 the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.

companyName: Delek US Holdings, Inc.

ticker: DK


text: While the board of directors has overall responsibility for risk oversight, it is supported in this regard by the outside consultants we have hired to help manage our cybersecurity policies and procedures and our internal cybersecurity team. The cybersecurity team and our outside consultants assist the board of directors in monitoring cybersecurity risk by receiving updates from and engaging in discussions as needed with the Chief Financial Officer, that cover, among other things, our cybersecurity risk management program, response readiness and training efforts. The Chief Financial Officer updates the full board of directors on cybersecurity matters as appropriate. We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents.

companyName: HUMBL, INC.

ticker: HMBL


text: The Company has also engaged a third-party managed service provider to manage server, network, and email security, including continuous monitoring and industry-leading antivirus software. Presidio Property Trust has robust business continuity and disaster recovery procedures in place, and an insurance policy that provides for network security liability, event response and recovery, direct business interruption, contingent business interruption, cyber extortion, social engineering, and computer fraud should an incident occur.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data. Management's approach to assessing, identifying and managing cybersecurity and information security risks and threats is embedded in our overall Enterprise Risk Management ("ERM") program. Management, in turn, reports up to our Board of Directors (the "Board"), which is responsible for oversight of risk, including with respect to cybersecurity threats and information security.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Adviser has contracted with Salt Cybersecurity, LLC to serve as a virtual Chief Information Security Officer ("vCISO") and perform an annual information security program risk assessment and gap analysis based on the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) standard (ISO/IEC 27001:2013). In addition, our vCISO conducts due diligence on each vendor we utilize to assess their levels of security when working with Lafayette Square data. The Adviser has also engaged a third-party cybersecurity firm, AG1, Inc. (dba AgileBlue), to act as Lafayette Square's outsourced security operation center ("SOC") and provide continuous monitoring of Lafayette Square issued devices for potential vulnerabilities with any threats escalated to the CTO.

companyName: Lafayette Square USA, Inc.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, due to evolving cybersecurity threats, we may not be able to protect all information systems. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information. Governance.

companyName: Leatt Corp

ticker: LEAT


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company systems.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Policies and processes are also in place for the review and identification of risks from cybersecurity threats associated with third-party service providers and vendors. Cybersecurity reviews are required prior to initiating any engagements with third-party service providers and vendors who receive access to IAS systems and infrastructure. Additionally, recurring annual audits of such critical third-party service providers and vendors are completed by our Information Security team.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Business Officer, Chief Accounting Officer, and Head of Legal, working closely with our third-party information technology team; the senior staff members of our third-party information technology team have been in business providing services to similarly situated companies in our industry for more than 27 years, including extensive experience addressing complex information technology and cybersecurity matters.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: We employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. We currently carry cybersecurity insurance, however, we cannot assure you that we will be able to maintain such policies in the future or that they will be sufficient to cover all potential cybersecurity events or losses we incur in connection with such events.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Our cybersecurity program is overseen by our Head of Information Technology ("IT"), and is managed by our CISO and other leaders from our IT and legal departments. Our Head of IT, CISO and Cybersecurity Manager have an average of over 20 years of prior work experience in various roles involving IT, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to senior management and the Audit Committee on any appropriate items.

companyName: iTeos Therapeutics, Inc.


text: We have not identified risks from known cybersecurity threats, or experienced any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. In the event of any significant cybersecurity incidents, we will publicly disclose the nature, scope, and impact of the incident, as well as the remediation measures we implement. of directors oversees the management of risks associated with cybersecurity threats.

companyName: Toppoint Holdings Inc.

ticker: TOPP


text: Our dedication to maintaining the trust and confidence of our customers, franchisees, and employees is fundamental to our operations. This commitment is reflected in our cybersecurity program, which encompasses policies, standards, processes, and practices and is fully integrated into our Corporate Security Policy and Enterprise Risk Management Program. Our Cybersecurity Program promotes a proactive and resilient approach to protecting the integrity, confidentiality, and availability of our systems and data.

companyName: POTBELLY CORP

ticker: PBPB


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) ("Information Systems and Data").

companyName: Fastly, Inc.

ticker: FSLY


text: We maintain a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our Cybersecurity Program also includes an annual risk assessment which is generally based on frameworks established by the National Institute of Standards and Technology ("NIST").

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: We assess, identify and manage material risks from cybersecurity threats through various policies, procedures and processes, including through our Enterprise Risk Management program (ERM), our information security policies and standards, workforce cybersecurity trainings and third-party assessments and programs.

companyName: STEPAN CO

ticker: SCL


text: Board oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Board regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Like other companies with a large technology footprint and high-profile client base, our Sponsor and Advisor are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact to our operations. In the future, it is possible such attacks could be successful and have a material impact on our operations. Our Sponsor's and Advisor's cybersecurity program strategy is to implement layered controls to reduce their and our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events. These controls are aligned with the National Institute of Standards and Technology cybersecurity framework.

companyName: JLL Income Property Trust, Inc.


text: • We perform risk assessments periodically at both an enterprise level and system level in addition to assessments performed by third parties; • Our information security team performs threat monitoring services; • Our Internal Audit function performs annual reviews of selected systems and applications to test certain controls; • Independent consultants and auditors evaluate selected systems and applications on an annual basis; • We perform risk assessments of third-party vendors and perform ongoing risk-based monitoring of those third parties; and • We maintain a business continuity plan for execution in the event of a cybersecurity incident.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: As part of the risk management program, responsibility is assigned to Information Technology (IT) Department, systems owners, department managers, and executive management.

companyName: CXApp Inc.

ticker: CXAI


text: We employ a risk management framework to identify, assess, monitor, and test cyber risk and controls, and perform comprehensive due diligence and ongoing oversight of third-party relationships, including vendors. We have made and will continue to make ongoing investments in developing and enhancing our security processes and controls and in maintaining our technology infrastructure, including the maintenance of a business continuity and disaster recovery program, which is tested on a regular basis. We have also implemented processes to help identify, assess and manage cybersecurity risks associated with our use of a third-party service provider. We also provide regular education and training to our employees and contractors on cybersecurity and the protection of our information systems in order to mitigate risk associated with protection against threats to the confidentiality, availability, and integrity of our information systems. We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See Item 1A – Risk Factors above for additional information on risks related to cyber-attacks.

companyName: RiceBran Technologies

ticker: RIBT


text: If and when we commence any operations, our board of directors will consider what they deem as a reasonable cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: ATLANTICA INC

ticker: ALDA


text: As part of the Company's cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, engaging independent third-party consultants to conduct regular assessments of its cyber security maturity against industry best practice frameworks and recommend program enhancements, and conducting tabletop exercises. The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements. The assessment summaries and action plans are shared with the Board as part of the regular briefings provided by the CIO and CISO.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: We have no t encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: In the event of an incident, we leverage a multi-layered set of plans that include Endpoint Detection and Response software, Security Information and Event Management tools for detection, a Cybersecurity Incident Response Plan, and a Disaster Recovery Response Plan for recovery. The recovery plans outline the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying designated functional leadership teams, the Disclosure Committee, the General Counsel, other senior leadership, and the Board of Directors, as appropriate. These designated leaders assess various factors, including operational, financial, legal, regulatory, and reputational impacts on the Company to determine the materiality of the incident and the appropriate response.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: In addition, our Chief Information Officer (CIO) is responsible for leading the assessment and management of cybersecurity risks. Our CIO has over 20 years of experience in information security and holds an MBA from The George B. Delaplaine School of Business and Economics. Our CIO regularly receives reports from our Head of IT Operations on cybersecurity threats and incidents, as applicable.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: Providing that all of the Company's information systems are backed up daily, with offline copies available in the event that a major security issue arises; Testing and evaluating cybersecurity safeguards via the use of third-party information technology service providers;

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: All employees have recently (subsequent to June 30, 2024) begun receiving cybersecurity training and other education regarding their use of computers, information technology, and sensitive data including specifically how to recognize common attack strategies. As many of our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our information security program, including the Company's technology and information security policies and practices, the internal controls relating to information security, and the steps taken by management to identify, monitor, and control any risk exposures. Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and employee training. Role or project specific employee training, as well as other training, may also occur, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer ("CIO"), who is assisted by other members of our senior management team. The team engaged in the cybersecurity risk management process, including the CIO, has risk management backgrounds, certifications, and/or cyber experience in prior professional roles and at the Company. The team also maintains expertise on cyber risk management through third party consultants, external training, and affiliations with relevant organizations.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: While we believe that our cybersecurity programs are appropriate to our risks, cybersecurity threats are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.

companyName: Capital Bancorp Inc

ticker: CBNK


text: We have formed an Incident Response Team that monitors and mitigates material risks from cybersecurity threats. This team is composed of members from the information security, engineering and legal teams. The Incident Response Team and our internal legal team work in tandem to estimate the severity and materiality of a cybersecurity incident, create a response plan and inform other stakeholders as appropriate, including the Audit Committee or the full Board. In addition, we engage several third party service providers to monitor cybersecurity threats in the market more broadly, including in relation to phishing, data leaks on the dark web, firewalls, code security and endpoint protection. To identify risks from cybersecurity threats associated with these third-party service providers, we conduct pre-contract screening and due diligence and post-contract monitoring.

companyName: TheRealReal, Inc.

ticker: REAL


text: Our Head of Information Technology and our Head of Information Security are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Head of Information Technology's experience includes 25 years in managing information technology departments, including four years specifically in cybersecurity and five years with the Company. Our Head of Information Security's experience includes 13 years in managing information technology departments, including 12 years specifically in cybersecurity and seven months with the Company.

companyName: bluebird bio, Inc.


text: The Board will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments.

companyName: CEVA INC

ticker: CEVA


text: Our Chief Technology Officer has over 15 years of information technology experience, including over a decade in leadership positions. He is supported by IT, cybersecurity and data protection professionals from our Technology Leadership Centre with extensive IT, cybersecurity and data protection education and experience, including from regulatory agencies. At the subsidiary level our IT and cybersecurity management team has varying degrees of technology, operational and cybersecurity experience, including experience in mitigating and responding to cybersecurity incidents and managing cyber risks.

companyName: Freedom Holding Corp.

ticker: FRHC


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of our Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: In the event of a cybersecurity incident, we have established incident response protocols designed to facilitate swift and effective remediation efforts. These protocols outline clear escalation procedures, delineate responsibilities among key stakeholders, and emphasize transparency and communication with internal teams, regulatory authorities, and affected parties.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Our incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Executive Director of Information Technology/Information Security, Data Protection Officer, and the Vice President, Legal. These individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of Information Technology. Our Vice President of Information Technology has over 25 years of experience in the information technology field and has been a member of and led numerous teams responsible for cybersecurity operations. In addition, all Company employees are required to complete mandatory cybersecurity training each year.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: The Company has adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP. Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board and the Audit Committee when appropriate, as discussed above. In general, the IRP leverages the National Institute of Standards and Technology guidance. The IRP applies to all Company personnel who provide or deliver technology systems (including employees or contractors and service providers).

companyName: STANLEY BLACK & DECKER, INC.


text: We publicly disclosed this breach and provided appropriate notifications to potentially impacted customers. We now understand that the SEC is conducting an investigation into data breaches resulting from the failures in the Progress software and on or about February 26, 2024, we received a request from the SEC to preserve and provide various documents and information relating to the SEC's investigation. The fact that the SEC has begun an investigation does not mean that the SEC believes that anyone (including FirstSun) has violated federal securities laws, nor does it mean that the SEC has a negative opinion of any person, entity, or security. It is a non-public fact-finding inquiry, with which we intend to fully cooperate.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Morgan Stanley Management's role in assessing and managing material risks from cybersecurity threats The Cybersecurity Program is operated and maintained by management, including Morgan Stanley's Chief Information Officer of Cyber, Data, Risk and Resilience ("CIO") and Morgan Stanley's Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks. The General Partner adheres to the Cybersecurity Program's policies and participates in periodic testing. The Cybersecurity Program strategy, which is set by the CISO and overseen by the Head of the Operational Risk Department, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. The Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact Morgan Stanley and its affiliates, including escalation to senior management and the Board, which are periodically tested through tabletop exercises.

companyName: Ceres Tactical Commodity L.P.


text: We carry a cybersecurity insurance policy to help cover any costs that may occur from a cybersecurity incident. Although risks from cybersecurity threats and implementation of our cybersecurity program have not materially affected our business strategy, business operations or our financial condition, a cybersecurity incident could have a material adverse effect in the future if it were to cause business disruption or data loss.

companyName: RADNOSTIX INC

ticker: INIS


text: We have processes in place to assess, identify, manage and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness training for employees, mechanisms to detect and monitor unusual network activity, use of encryption and authentication technologies, penetration testing and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities.

companyName: Forward Industries, Inc.

ticker: FWDI


text: Risks from Material Cybersecurity Threats Cybersecurity risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, consolidated financial condition, results of operations, or cash flows. Refer to Part I, Item 1A, "Risk Factors," for more information on Sealed Air's risks relating to our technologies, systems, and networks.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: In the event our Information Security team classifies a cybersecurity incident as posing a "critical risk," our Disclosure Committee, which includes our General Counsel and Chief Accounting Officer, is immediately notified of such classification via functions within our digital work environment. The Disclosure Committee, in consultation with our Information Security team and Chief Information Officer, engages in an assessment of the materiality of the cybersecurity incident, under applicable disclosure standards, including material developments throughout the incident response process. Our Board of Directors would be promptly informed upon identification of any material cybersecurity event.

companyName: EQT Corp

ticker: EQT


text: The CISO provides regular briefings to our senior management and the Cybersecurity Risk Committee concerning relevant cybersecurity risks and the processes we have implemented to address them. The Cybersecurity Risk Committee and the Board also receive various reports, summaries, and presentations related to cybersecurity threats, risks, and mitigations.

companyName: Zoom Communications, Inc.

ticker: ZM


text: We have implemented incident response and breach management processes which have overarching and interconnected stages, including (i) preparation for a cybersecurity incident, (ii) detection and analysis of an incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. An internal committee of senior management (the "Response Team") is responsible for overseeing our incident response and breach management processes. The Response Team is tasked with reporting to the Audit and Risk Committee incidents and other cybersecurity matters deemed important or to have a business impact, even if immaterial to the Company as a whole. The Response Team, as necessary and appropriate, is briefed by our information security and engineering teams with respect to risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Sezzle Inc.

ticker: SEZL


text: We place the utmost importance on information security and privacy, including protecting the personal medical, financial and insurance information of our patients and employees, and have a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including through monitoring and assessing our threat environment; vulnerability assessments; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness and incident response plans; and investments in cybersecurity infrastructure and technology intended to reduce cybersecurity risk. Key aspects of our cybersecurity risk management program include the following: • adoption of the National Institute of Standards and Technology, or NIST, Cybersecurity Framework to assess the maturity of our cybersecurity programs; • periodic comprehensive Cybersecurity Program Assessments conducted by an external cybersecurity consultant; • enterprise-wide security and privacy policies that are reviewed and updated annually; • information security and privacy trainings included in mandatory onboarding and annual compliance training for all personnel; • regular testing, both by internal and external resources, of information security defenses; • incident response procedures; • Third Party Cyber Risk Program to assess cybersecurity and information security risk associated with third parties that perform contracted services using information on our network; and • a Security Operations Center that is designed to continuously monitor information on our network, investigate potential cyber threats and report on information security incidents.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats.

companyName: CFN Enterprises Inc.

ticker: CNFN


text: Security assessments are an ongoing activity within the Bank, and the Security Assessment Policy identifies security assessment requirements and those individuals accountable for ensuring the assessments comply with the requirements. All assessment activities must be approved by the Chief Risk Officer. The coverage of assessments includes, but is not limited to, physical security assessment, information technology general controls audit, vulnerability assessment, penetration testing, and social engineering testing. Results are shared with the ITSC, executive management and the Board of Directors.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.

companyName: Mountain Lake Acquisition Corp.

ticker: MLAC


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our dedicated Information Security Team is responsible for identifying, assessing, detecting, and responding to any threats and vulnerabilities. The team routinely collects and processes information from a variety of sources, including from media reporting, commercial threat intelligence providers (FSARC, FS-ISAC), the Federal Bureau of Investigation and other government and law enforcement agencies. The team provides ongoing global mitigation of known cybersecurity threats to help ensure that our data and systems are protected.

companyName: Perella Weinberg Partners

ticker: PWP


text: The Company leverages a variety of industry frameworks and regulatory guidance to develop and maintain its information systems and cyber security program, including but not limited to Interagency Guidelines Establishing Information Security Standards, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook (with particular emphasis on the FFIEC's Information Security and Business Continuity Management handbooks), FFIEC Cybersecurity Assessment Tool, Gramm-Leach-Bliley Act ("GLBA") 501(b), and National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, the program leverages certain industry and government associations, third-party benchmarking, audits, and third-party threat intelligence sources to facilitate and enhance the effectiveness of the program.

companyName: LAKELAND BANCORP INC


text: Management Oversight and Governance Management plays an important role in assessing and managing WTW's material risks from cybersecurity threats. The CISO is responsible for designing and implementing a security program and strategy. WTW's CISO has served in various roles in information technology and information security for over 33 years, including serving as CISO of several public companies. The CISO holds undergraduate and graduate degrees in mathematics and strategic information systems and has attained the professional certification of Certified Information Systems Security Professional. The CISO reports to the Global Head of Technology. WTW's Global Head of Technology has served in various roles in information technology for over 25 years. The Global Head of Technology holds a graduate degree in business.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Day-to-day responsibility for assessing, monitoring, and managing our cybersecurity risk management program rests with our IT Department, who consults with our MSP as well as members of our finance and legal teams as appropriate, and our Head of Compliance on cyber matters. Our Head of Compliance oversees our risk management governance and periodic compliance testing and works with our IT Department and other functions, as appropriate, on the mitigation and management of identified cyber risks. The IT Department, together with our MSP executes the cybersecurity strategy. The IT Department and Head of Compliance report periodically to the General Counsel as well as to our Governance, Risk Management, and Compliance Committee ("GRC Committee") on cyber matters. Our GRC Committee is responsible for monitoring and overseeing our overall enterprise risk management process, including assessing, identifying, and managing cybersecurity related risks as part of its annual assessment of critical risks facing the Company.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the audit committee and chief executive officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board's oversight is proactive and responsive. The audit committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of NeuroBo.

companyName: MetaVia Inc.

ticker: MTVA


text: We also engage third parties in connection with our cybersecurity risk management processes, including cybersecurity consultants and auditors, to conduct evaluations of our security controls and provide certifications for industry-standard security frameworks, such as ISO 27001 and SOC, Type 2. In addition to monitoring risks from threats to our own assets, we administer a third-party risk management program that helps identify and manage risks from cybersecurity threats arising from attacks against our suppliers and other service provider organizations. This program seeks to combine a methodology for risk ratings with targeted cybersecurity assessments, security-focused contractual requirements, and monitoring activities based on the risk profile of covered suppliers and service providers.

companyName: Dell Technologies Inc.

ticker: DELL


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Lexaria Bioscience Corp.

ticker: LEXX


text: Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Our cybersecurity efforts involve regular engagement with external assessors, consultants, and auditors, including periodic reviews by an independent qualified security assessor to identify areas for improvement and support compliance, as well as assessments and audits by our insurer and our external auditing firm.

companyName: ARTIVION, INC.

ticker: AORT


text: Our cybersecurity program has established processes to identify and categorize cybersecurity threats and vulnerabilities as part of our risk identification process, pursuant to which we regularly seek to obtain, monitor, assess and respond to evolving threat and vulnerability information. Information about threats and vulnerabilities generally originates from multiple sources, including, but not limited to, government, information-sharing organizations, industry threat intelligence sources, and third parties. The identification of risks is supported through various security controls and testing to help minimize exposure to reported cybersecurity threats and vulnerabilities. These security controls include, but are not limited to, penetration testing, compromise assessments, vulnerability scanning, and various additional internal and external security audits and assessments. In addition, we maintain a third-party risk management program that includes an initial and periodic cybersecurity assessment on critical vendors' security posture and controls.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: Blackstone has a comprehensive Security Incident Response Plan, the IRP, designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of our Manager or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: All of our employees also have a responsibility to protect the privacy of Company and Bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture. Additionally, the Company carries out regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: As of the date of this Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business, strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see Part I, Item 1A of this Form 10-K under the risk factor entitled " We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively. "

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: The Company follows an established process to identify and evaluate risks from cybersecurity threats that may arise internally or through the introduction of third parties to the ISMS. This evaluation is part of the Company's risk management process. The process may include, but is not limited to, evaluating the third party's cybersecurity maturity and/or imposing certain contractual conditions.

companyName: TUCOWS INC /PA/

ticker: TCX


text: The Bank maintains policies, controls and training programs concerning customer information security, including transaction processing. The Bank deploys universal conditional access policies, requires multi-factor authentication for external network access and on-line banking access by Bank customers, and maintains additional access controls for network security and transaction processing. The Bank also has policies and controls to identify, classify and limit access to non-public customer information, including a comprehensive third -party vendor management cyber/information security risk management program.

companyName: BankFinancial CORP


text: Our information security team is led by our Senior Vice President & Chief Information Security Officer, who reports directly to our Executive Vice President - Chief Information Officer. Leadership of the information security team has extensive dedicated cybersecurity experience. Additionally, the collective leadership team holds 21 certifications in cybersecurity and related fields, including Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Information Systems Auditor.

companyName: DELTA AIR LINES, INC.

ticker: DAL


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: BCP Investment Corp

ticker: BCIC


text: We maintain a data protection and cybersecurity risk management program to assess, identify and manage cybersecurity risks. We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate. As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with industry standards and best practices. As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.

companyName: SOUTH 8 ENERGY, LLC


text: Cybersecurity incident response plan and testing – We have a global incident response process and a dedicated team responsible for monitoring, detecting and responding to cybersecurity threats and attacks, whether external or internal, coordinating across multiple functions, periodically testing our protocols and regularly communicating and providing reports to our CISO.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Our Board of Directors oversees our general risk management, including cybersecurity. Policies, practices and potential risks associated with cybersecurity are discussed and managed by the Board of Directors and management.

companyName: Pharma-Bio Serv, Inc.

ticker: PBSV


text: Third parties play an important role in our cybersecurity program. We engage third-party services to conduct evaluations of our security controls, including penetration testing and consulting on best practices. The third-party services include testing both the design and operational effectiveness of security controls.

companyName: Quantum Computing Inc.

ticker: QUBT


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced cybersecurity challenges (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding risks from cybersecurity threats, please refer to "Item 1A. Risk Factors" of this annual report on Form 10-K.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We have three management-level committees that support our cybersecurity, privacy and data governance efforts. They are led by our Data Security and Privacy Governance Committee, which provides management-level governance over cybersecurity matters, including discussion of cybersecurity priorities, emerging risks, awareness and training programs, risk mitigation efforts, and regulatory compliance. This committee is chaired by our Vice President – Internal Audit and Corporate Compliance and is composed of a cross-functional team of senior leaders, including our CEO. The committee generally meets quarterly and is supported by our Security and Technology Risk Leadership Committee and our Privacy and Data Governance Committee. The activities of the Data Security and Privacy Governance Committee are reported to the Audit Committee and/or the full Board by the Chair of the committee, as appropriate.

companyName: HOME DEPOT, INC.

ticker: HD


text: At the management level, our Data Protection & Cybersecurity Steering Committee ("DPCSC") meets on a quarterly basis. The DPCSC includes representatives from communications, ethics and compliance, human resources, information technology, corporate audit, legal, risk, privacy, and sourcing. This committee is responsible for overseeing LII's data protection and cybersecurity policies and procedures. These cybersecurity policies and procedures include an IT security and privacy incident response plan to notify the appropriate parties, including our Chief Technology Officer, our Disclosure Committee, and our Board of Directors, in a timely manner.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Our Head of IT, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Head of IT and the executive management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: The Board, as part of its general oversight function, participates in discussions with senior management and amongst themselves regarding cybersecurity risks. With the assistance of the Company's most senior IT manager, we review annually the cyber and data security risks of our overall IT environment. We assess cybersecurity risk and the overall environment which includes devices, IT systems, websites, social media accounts, manufacturing technology/systems and suppliers/vendors. The oversight from the Board includes material changes to relevant policies, procedures, employee training and elements of the overall environment, as necessary, and senior management provides an update to the Board on emerging cyber threats. The Board has access, as requested, to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Our cybersecurity program is spearheaded by our cybersecurity department, with support from external advisors and approval from executive management. The stakeholders have been identified and know their roles within the documented cybersecurity process.

companyName: USBC, Inc.

ticker: USBC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including a Chief Information Officer, who reports to the CFO. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Our Board is responsible for overseeing enterprise-wide risk management and is actively involved in the monitoring of risks that could affect us, including cybersecurity risks. Pursuant to its charter, one of the key responsibilities of the Audit Committee of our Board is oversight of our information and cybersecurity programs and it receives regular reports on cybersecurity, information security, technology and other related matters and risks. The Audit Committee regularly briefs the Board on matters relating to its information technology and cybersecurity risk oversight.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO is part of the senior management team at the company and regularly updates the Audit & Risk Oversight Committee on the company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.

companyName: Meta Platforms, Inc.

ticker: META


text: We identify material risks from cybersecurity threats through various sources, including, but not limited to, controls testing, compliance testing of our security standards, independent penetration testing, open-source threat intelligence feeds, and lessons learned and assessments against control frameworks. These threats are assessed by applying our Risk and Control Self-Assessment ("RCSA"), information technology risk and cybersecurity risk management processes, each of which we review regularly. Based on the RCSA, risks from cybersecurity threats that exceed established risk tolerance thresholds are recorded and incorporated into our reporting to the Risk Committee and senior management as described in more detail below. We also engage third -party assessors, consultants and auditors to assist in the administration, assessment and improvement of our cybersecurity risk management program.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: The Company maintains robust processes for identifying, assessing and managing cybersecurity threats. Cybersecurity threats are prevented and detected by the Company's security operations center using multiple approaches, including perimeter defense, vulnerability management, intrusion testing, asset management, multifactor authentication and data protection. The Company leverages third parties in its cybersecurity activities, including threat awareness, penetration testing and routine program assessments.

companyName: BURLINGTON NORTHERN SANTA FE, LLC


text: Farmer Mac's board of directors is actively involved in overseeing the company's cybersecurity risk management. At least once a year, the full board of directors meets with Farmer Mac's Chief Information Security Officer ("CISO") to discuss and approve Farmer Mac's programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Farmer Mac's business strategy.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board of Directors with the annual assessment by a third party on the Company's cybersecurity program.

companyName: Vuzix Corp

ticker: VUZI


text: Ashland recognizes the importance of cybersecurity in safeguarding sensitive information and maintaining operational integrity. To that end, Ashland maintains an information security program as part of its overall Enterprise Risk Management ("ERM") program. The Company's information security program includes an incident response plan, which has been reviewed by third-party consultants and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0. The information security program, led by the Company's Vice President of Cyber Security, is designed to provide a framework for assessing, identifying, managing, mitigating and responding to cybersecurity threats and incidents and to facilitate cross-functional coordination within Ashland.

companyName: ASHLAND INC.

ticker: ASH


text: We maintain continuous and near-real-time security monitoring of the AT&T network for investigation, action and response to network security events. This security monitoring leverages tools, where available, such as near-real-time data correlation, situational awareness reporting, active incident investigation, case management, trend analysis and predictive security alerting. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests and engaging third parties to conduct analyses of our information security program. We conduct vulnerability testing and assess identified vulnerabilities for severity, the potential impact to AT&T and our customers, and likelihood of occurrence. We regularly evaluate security controls to maintain their functionality in accordance with security policy. We also obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. In addition, as a critical infrastructure entity, we collaborate with numerous agencies in the U.S. government to help protect U.S. communications networks and critical infrastructure, which, in turn, informs our cybersecurity threat intelligence. AT&T Inc.

companyName: AT&T INC.

ticker: T


text: The Risk and Compliance Committee of our Board of Directors (the "Board"), in consultation with and regular reporting to our full Board, oversees enterprise technology and its associated risks including cybersecurity. The Board and Risk and Compliance Committee regularly reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats on an annual basis. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, are reported to the Board and Risk and Compliance Committee in a timely manner.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: We also continue to invest in developing and enhancing our security processes and controls and in maintaining our technology infrastructure. These programs provide for an intentional and deliberate plan for notifying, informing, consulting, analyzing, and communicating any risks or incidents as necessary and appropriate under the circumstances to various internal stakeholders (such as executive management and the Board) and external stakeholders (such as our regulators, impacted individuals, and the investment community) as necessary and appropriate.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: We seek to identify and manage risks from cyber threat intelligence and lessons learned from known cyber incidents with our cyber risk management process and include these within our cyber risk strategy through major information security and technology enhancements and projects. As of the date of this 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity threats continue to increase, and as set out in our risk factors our services may be affected by cybersecurity and data security incidents, which could be material to the Company. See "Item 1A. Risk Factors" in this Form 10-K for additional discussion on the risks of future cyber incidents to our results of operations and financial condition.

companyName: Coupang, Inc.

ticker: CPNG


text: Our Cybersecurity organization proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: a. A formal enterprise-wide cybersecurity policy and related standards; b. Cybersecurity training and employee phishing simulations; c. Scheduled and ad hoc internal and external penetration tests; d. Cyber incident response, IT disaster recovery, and business continuity plans; e. Cybersecurity assessments and remediation planning as part of our M&A due diligence process; f. Identity and access management controls;

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: Since January 1, 2022, we have not experienced any cybersecurity incidents that have resulted in material financial loss. We are not aware of any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: CubeSmart

ticker: CUBE


text: The Bank is subject to cybersecurity incident and threat risk. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of the Bank's information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by the Bank, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the Bank's information to maintain or support the Bank's operations. Please refer to Item 1A. Risk Factors for a description of cybersecurity incident and threat risk. The Bank has implemented processes for assessing, identifying, and managing material risks from cybersecurity threats or incidents that may directly or indirectly impact the Bank's business strategy, results of operations, or financial condition.

companyName: Federal Home Loan Bank of New York


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation," for additional discussion about cybersecurity-related risks.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR