text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Cipher Digital Inc.

ticker: CIFR


text: Additionally, we maintain a cybersecurity insurance policy to mitigate certain risks associated with cybersecurity incidents. However, the costs, damages, and expenses arising from cybersecurity incidents may not be completely covered by such insurance.

companyName: Peakstone Realty Trust

ticker: PKST

secItem: Item 1C


text: The CDTO and CISO regularly review cybersecurity matters with members of our senior management. These discussions include the latest cybersecurity risks and threats, the status of our cybersecurity incident response plan, and our overall process relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Board of Directors, through its Audit Committee, is responsible for overseeing our cybersecurity risk management. On a regular basis, the Board of Directors or Audit Committee receive and review reports from the CDTO and CISO relating to the status of cybersecurity planning and protections, the overall state of our cybersecurity program, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks.

companyName: AAR CORP

ticker: AIR


text: Description of Cybersecurity Risk Management and Strategy To assess, identify and manage material cybersecurity risks, we have endeavored to implement policies, standards and technical controls with the aim of protecting our information and operations systems (collectively, "IT systems"). These standards are guided, in part, by the relevant National Institute of Standards and Technology and American Petroleum Institute frameworks. We use various internal and third-party tools, security measures and technologies to aid in seeking to protect our network perimeter and internal systems from unauthorized access, intrusion or disruption. Regular assessments are conducted across our systems, networks and data infrastructure to identify potential cybersecurity threats and vulnerabilities. In addition, a monitoring and detection system has been implemented to help identify cybersecurity threats and incidents. Our cybersecurity program also focuses on providing training and awareness to our employees and contractors on cybersecurity best practices.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. – See Item 1A. Risk Factors – "We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss." for more information about these and other risks related to information security.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: The Cybersecurity and Privacy Committee receives quarterly reports from the Chief Information Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Cybersecurity and Privacy Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: The CISO has experience with FDIC regulated financial institutions and holds the certification as a Certified Banking Chief Information Security Officer (CBISO) and participates in various Information Security peer groups and serves on the Mississippi Bankers Associations - Information Security Committee. The Company's Cybersecurity Manager oversees the day-to-day cybersecurity operations.

companyName: FIRST BANCSHARES INC /MS/


text: We implement and maintain various technical, physical and organizational controls designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address information security, including external assessments to consider our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of data; network security controls; physical and electronic access controls; asset management, tracking and disposal; systems monitoring; and employee security training. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees are tested routinely through simulated phishing attempts.

companyName: GTJ REIT, INC.


text: Our Chief Administrative Officer ("CAO") oversees these risk assessments and meets regularly with the security and compliance team to review cybersecurity risks and threats, and also participates in our enterprise risk management process. In addition, the Company engages several third-party consultants in connection with the risk assessments, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments are required to provide reports designed to allow us to monitor and assess such third parties' security controls.

companyName: Antero Midstream Corp

ticker: AM


text: With respect to incident response, we maintain a Global Information Security & Privacy Incident Response Plan ("IRP"), which applies to information security incidents involving properties owned, leased, or managed by Marriott, as well as our above-property business locations. Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Oversight and Governance Weatherford is committed to protecting its information systems. These efforts are led by the Chief Information Officer ("CIO"). Our program is designed to align with international best practices used in our industry, such as the Cyber Security Framework from the National Institute of Standards and Technology ("NIST").

companyName: Weatherford International plc

ticker: WFRD


text: The Company ensures that all third party vendors that process or have access to sensitive information have appropriate cybersecurity risk controls in place.

companyName: Farmland Partners Inc.

ticker: FPI


text: Our Enterprise Information Security Policy contains existing controls to protect information systems (and the data hosted within) and to educate personnel as to the proper use, disclosure, modification, or destruction of that data. The Policy is further intended to reasonably protect our systems and data against internal and external threats that could impact it. We periodically review this Policy for improvements and request each account user to read and attest to the Policy as updates are made. We employ a Defense-in-Depth approach to information security, which includes adoption of network perimeter, endpoint, and end-user controls in accordance with the Policy. We are focused on improvement of our security posture; we are periodically assessed by internal and external audits, as well as third-party security experts, such that our program continues to address and respond to evolving threats.

companyName: Evercore Inc.

ticker: EVR


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing the Trust. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to the Trust.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: Further, in the spring of 2022, the Federal Reserve, OCC, and FDIC adopted a new regulation that requires a banking organization to notify its primary federal regulators as soon as possible and within 36 hours after identifying a "computer-security incident" that the banking organization believes in good faith is reasonably likely to materially disrupt or degrade its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the financial stability of the United States. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Board of Directors Our Board of Directors oversees our risk management process, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit and Corporate Governance Committee. The Chief Financial Officer presents updates to the Audit and Corporate Governance Committee and the full Board of Directors, on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: We recognize that cybersecurity is critical to the success of our business. We regularly contract with the U.S. government on programs classified for national security purposes. To adequately safeguard classified and controlled unclassified information, our Cybersecurity Program operates across the enterprise, strongly supported and overseen by our management and the Board. Employees are regularly trained on potential cyber threats and are expected to maintain a high level of cybersecurity awareness.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Our Senior Director, Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above and, along with and informed by the Information Technology organization and our Incident Response Team, monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Depending on the severity of the security incident, the Incident Response Team will report the security incident to our Audit Committee, including the financial impact of the security incident and any regulatory violations. As our Information Technology organization monitors the security and effectiveness of our policies and procedures, they also work to keep the Senior Director, Information Technology and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: While our Board of Directors provides oversight of our information technology environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management. The CIO, with assistance from internal and external resources, is responsible for the implementation and providing oversight to our organization and maintaining the appropriate level of expertise to manage and implement cybersecurity policies, programs and strategies. The CIO has served for over 30 years in information technology and various roles within the Company.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to a complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: Stirling Hotels & Resorts, Inc.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: NOVANTA INC

ticker: NOVT


text: Our Chief Security and Cash Operations Officer has extensive expertise in a wide array of information and physical security operations, emphasizing threat and vulnerability management, malware protection and cyber forensics. He has served in various security leadership roles and holds multiple patents for systems and methods related to information security risk assessment. He holds a bachelor's degree from Midwestern State University.

companyName: NCR Atleos Corp

ticker: NATL


text: As of December 31, 2023, cybersecurity and data protection policies and procedures have been implemented. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: TABLE TRAC INC

ticker: TBTC


text: Third-Party Risk conduct annual assessments of the SOC reports of our providers because we are aware of the risks associated with third-party service providers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: These measures are to be integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy strategy will have a comprehensive cybersecurity crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, senior management and the Enterprise Risk Management Council (a taskforce comprised of senior representatives from primary corporate functions as well as senior representatives from field operations) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into six categories: govern, identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology ("IT") security team reviews enterprise risk management-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the Enterprise Risk Management Council's framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. In the event we identify a cybersecurity incident, we have defined procedures to respond to and remediate such incident. These policies and procedures go through an internal review process and are approved by appropriate members of management.

companyName: UNITED RENTALS NORTH AMERICA INC


text: Threat Disclosure date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.

companyName: Village Bank & Trust Financial Corp.


text: Encryption. Data is encrypted both at rest and in transit using industry-standard encryption algorithms. This ensures that data remains secure even if it's intercepted or compromised.

companyName: AIRWA INC.

ticker: YYAI


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Enstar Group LTD


text: IT Staff Authorization for Software Installations and Updates: To maintain the integrity of our IT environment, only authorized IT staff are permitted to install or update software on the company's computers. This control prevents the introduction of unauthorized or potentially malicious software.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Our Chief Executive Officer and General Counsel are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: IMMUNIC, INC.

ticker: IMUX


text: Risks from Cybersecurity Threats While we are subject to ongoing cybersecurity threats, the risks from these threats have not materially affected, or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors-Risks Related to Our Operations" in this Annual Report.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: The Vice President of Information Technology reports to our Chief Digital Officer and provides semi-annual cybersecurity updates to the Audit Committee of our Board of Directors. In the event of the detection of an actual or suspected cybersecurity incident, a designated management committee is engaged to investigate the incident, manage response, and report the incident to securities counsel to assist with assessment of materiality. A member of the executive team would inform our Board of Directors as warranted.

companyName: CareMax, Inc.


text: The Vice President of Information Technology meets regularly with members of our information technology team, which includes a security architect whose responsibilities are dedicated solely to cybersecurity matters, a network engineer, and infrastructure director to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our cybersecurity team also works with our Chief Legal Officer to oversee compliance with legal, regulatory and contractual security requirements.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: We regularly engage external parties, inclusive of but not limited to, service vendors, consultants, independent privacy assessors, peer companies, industry groups, and governance experts to enhance our understanding and application of oversight of the cybersecurity landscape. For example, we provide an annual assessment of our cybersecurity program, completed by our third-party Chief Information Security Officer ("CISO"), to our Audit Committee for review and feedback. These external parties provide an industry perspective on appropriate risk management and investment in our cybersecurity efforts that is reviewed and approved by company management and the Board of Directors.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: The Revelyst Board is expected to receive an annual report on the enterprise risk management review overseen by the Revelyst Audit Committee, which will include, among other things, an evaluation of cybersecurity risks (including cybersecurity risks that Revelyst may have exposure to via its suppliers and service providers), mitigation efforts, incident response preparedness and adequacy of internal controls. In addition, the Revelyst Board is expected to receive in-depth updates from Revelyst's information technology team on cybersecurity risks on a regular basis.

companyName: Revelyst, Inc.


text: Our cybersecurity program is aligned with our company strategy and governance processes. Our program is designed to deploy and monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents through various means, including: • A security team responsible for monitoring our infrastructure and managing our cybersecurity risk assessment processes, our security controls, and response to cybersecurity incidents. • Periodic use of outside independent advisors to evaluate the maturity of our cybersecurity program, review processes and policies, conduct penetration and vulnerability tests, and to monitor and help identify potential cybersecurity incidents. • An incident response plan that includes procedures for identifying, evaluating and responding to cybersecurity incidents. • A training and awareness communication series addressed to our employees to help them identify potential cybersecurity threats and attacks. • A risk management process using independent third-party service providers that process and store data. We assess the risks from cybersecurity threats posed by such services.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: We conduct at least quarterly assessments of risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. In addition to these quarterly risk assessments, we conduct assessments when there is a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: The Program includes the following key elements: • Network, Systems, and Data Security – Corebridge deploys technical and organizational safeguards that are designed to protect Corebridge's networks, systems, and data from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, software security assessments, data leak protection, and access and identity management controls; • Threat and Vulnerability Management –Corebridge maintains a threat and vulnerability management program that leverages threat intelligence to proactively identify, assess, and address cybersecurity risks. This program incorporates vulnerability scanning, risk-based remediation and mitigation, penetration testing, and threat response capabilities to safeguard our information assets and ensure business continuity; • Cybersecurity Incident Monitoring and Response – Corebridge has established and maintains incident response plans that address Corebridge's response to a cybersecurity incident, utilizing a cross-functional approach; • Third Party Assessment and Oversight – Corebridge maintains a third-party risk management program to identify and manage risks from third-party service providers, including initial due diligence, an assessment of the service provider's control environment and periodic re-assessments; and • Security Training and Awareness – Corebridge provides ongoing education and training to employees regarding information security policies, procedures and best practices, including cyber threats, and their roles and responsibilities in identifying, reporting and responding to such threats.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on a regular basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: Our commitment to the overall security of our information technology systems starts at the highest levels of our Company, the Board of Directors and management. Management and the Board of Directors provide oversight surrounding cybersecurity. Management oversees internal controls and the company-wide risk assessment process. The Audit Committee is provided with regular updates by management regarding the control framework and whether any significant deficiencies or material weaknesses exist in the IT control environment. The Audit Committee is also tasked with determining the appropriate response to any submissions through the corporate whistleblower policy. The whistleblower policy includes the opportunity for employees of the Company to notify the Audit Committee confidentially and anonymously of any concerns regarding cybersecurity, in addition to any accounting, internal accounting controls or auditing matters. The audit committee will report any significant matters to the Board of Directors.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: In addition, we regularly review cybersecurity trends and, partially as a result of our prior cybersecurity exposure, have moved some of our internal servers to off-site locations.

companyName: Hempacco Co., Inc.

ticker: HPCO


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer each hold degrees in their respective fields, and have approximately 20 years or more of experience managing risks at the Company and similar companies, including risks arising from cybersecurity threats.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Our VP of IT and Facilities is responsible for preparing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data, or otherwise had a material impact on Avantor's strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on how material cybersecurity attacks may impact our business.

companyName: Avantor, Inc.

ticker: AVTR


text: We are in the process of developing a cybersecurity risk management program, consisting of cybersecurity policies, procedures, compliance and awareness programs to mitigate risk and to ensure compliance with security, availability and confidentiality trust principles. Following the completion of the development of our cybersecurity risk management program, the cybersecurity process will be integrated into our overall risk management system and process, and, initially, will be solely internally managed. Management is responsible for identifying risks that threaten achievement of the control activities stated in the management's description of the services organizations systems.

companyName: Charging Robotics Inc.

ticker: CHEV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. In the event we experience a cybersecurity incident we consider to be material, we will disclose such incident consistent with the requirements of Item 1.05 of Form 8-K.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Our IT department is responsible for day-to-day management of potential cybersecurity risks. As part of its management of cybersecurity risks, the IT department conducts regular cybersecurity training of our employees, which includes an annual training given to all employees and internal contractors, targeted trainings for employees and internal contractors with specific roles within the Company and simulated cyber threats, including phishing exercises that spoof common and novel tactics used by threat actors. The IT department, through our head of IT, provides regular updates and reports to our executive officers and the Risk Committee regarding cybersecurity threats, risks from such threats, strategies and recommendations to mitigate risk from such threats, cybersecurity incidents that have occurred, industry updates, and policy and process recommendations. Our executive officers and the Risk Committee provide guidance and approval of such items to ensure that such risks are mitigated and in line with our overall risk management systems and processes.

companyName: Orion Properties Inc.

ticker: ONL


text: Our business strategy, results of operations and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see Item 1A, Risk Factors, elsewhere in this Annual Report on Form 10-K.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: On a periodic basis, the Company engages independent third-party subject matter experts to conduct a cybersecurity maturity assessment based on the National Institute of Standards Technology framework, focused on risk assessment, global payment card industry audits, and compliance audits to help identify gaps and improve existing processes. In addition, the Company has a cybersecurity risk program that includes policies and procedures around onboarding of third-parties, contractual agreement review, risk assessment and on-going monitoring of high-risk vendors.

companyName: TAPESTRY, INC.

ticker: TPR


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer. Key members of management are embedded into the Incident Response Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Preparation —perform a risk assessment and identify sensitive assets. Our team includes an outside security/information systems team that provides managed services on a regular basis.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: The Board of Directors ("the Board") regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.

companyName: SERVOTRONICS INC /DE/


text: Our Technology organization, led by our Chief Technology Officer, is accountable for our overall cybersecurity program in partnership with other business leaders. Our Chief Technology Officer has extensive experience leading global technology and IT organizations. Team members and outside experts supporting our program have relevant education and information security experience, including security for large multi-national, publicly traded companies. Our CTO has a master's degree in Software Engineering, and expertise in both private and public companies within the technology sector. Our information security team remains abreast of the latest cybersecurity advancements, staying informed about potential threats and emerging risk management strategies. This continuous learning is vital for proactively preventing, detecting, mitigating, and remediating cybersecurity incidents. Our information security team is responsible for implementing and supervising processes for ongoing monitoring of our information systems, incorporating advanced security measures and regular system audits to pinpoint vulnerabilities. In the event of a cybersecurity incident, our information security team employs a well-defined incident response plan, comprising immediate actions to minimize impact and long-term strategies for remediation and prevention of future incidents.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Cybersecurity, compliance, data privacy, and data protection are essential to our business. In the ordinary course of business, we collect and store certain confidential information, such as the specifications of our products, information about our employees, customers, contractors, vendors, and suppliers, and information about TCAR procedures, which in some instances may include identifiable patient information. To safeguard this information, we have implemented a cybersecurity defense-in-depth approach leveraging the Center for Internet Security, Inc. (CIS) Critical Security Controls (CSC) framework designed to identify, meet, and defeat dangerous cyber attacks in order to protect confidential information, mitigate data compromise and breaches, and provide IT resiliency. The CIS CSC framework defines five critical areas to build robust cybersecurity defense posture. We have developed and maintain a collection of policies and procedures to implement and support this cybersecurity framework.

companyName: Silk Road Medical Inc


text: Our Cybersecurity Committee is comprised of information technology, finance, legal, human resources and data privacy employees. It meets regularly to review and oversee the Company's data security programs, policies, and strategies, including with respect to cybersecurity risk mitigation, business continuity, and business resiliency. Our Cybersecurity Committee (along with the Chief Financial Officer and Chief Legal Officer) also reviews, analyzes, and responds to cybersecurity incidents and breaches.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: The CONSOL Energy Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, CONSOL Energy's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: The Company's Information Technology Director and Chief Financial Officer, along with cybersecurity personnel on their respective teams, are responsible for developing cybersecurity programs, as may be required by applicable law or regulation. Our cybersecurity personnel have the appropriate expertise in IT and cybersecurity, which generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: Our information security policy is based on recognized industry standards and cover areas such as risk management, data backup, and data recovery. We engage consultants and IT managed service providers (IT MSP), to help us design and implement our cybersecurity policies and procedures. IT MSP assist us with monitoring security threats and vulnerabilities and responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee. We conduct cybersecurity penetration testing as warranted to identify and remediate cybersecurity gaps.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: We build our security program with the intent of a global reach and a global customer base at the top of our minds. Cybersecurity risk factors are evaluated, prioritized, and connected to annual strategic priorities. Strategic priorities are comprised of critical cybersecurity efforts in an ongoing effort to mitigate internal or external risks factors, and drive maturity objectives. We have developed and continue to develop strategic and tactical cyber capabilities to provide a modern approach to protecting the partnerships we have built our business around. This is, and will continue to be, an ongoing effort to provide and implement cyber best practices. Our Audit Committee is briefed semi-annually by our management team to provide awareness around IT environmental risk factors, cyber posture, global threat landscape, and changing regulatory requirements. Decisions are then made based on all assessed risk factors, including cyber maturity growth, strategic personnel, and appropriate cyber capability. All critical response activities are assessed and communicated from executive management to the Audit Committee which then reports to the Board of Directors.

companyName: CONMED Corp

ticker: CNMD


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer and Chief Business and Legal Officer. Our information technology team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the Board of Directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems.

companyName: PlayAGS, Inc.


text: Our management team, including our Chief Executive Officer, Chief Financial Officer, Chief Information Officer (the "CIO"), and Vice President and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CIO has over 20 years' experience managing the cybersecurity function across multiple companies. The information security team's experience includes security certifications in International Information System Security Certification Consortium ("ISC2"), Information Systems Audit and Control Association ("ISACA") and The International Council of E-Commerce Consultants ("EC-Council").

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: Our Board of Directors recognizes the importance of maintaining the privacy and security of customer information, as well as the availability and integrity of our systems, and consequently dedicates meaningful time and attention to the oversight of cybersecurity risk. In light of these risks, our Board of Directors is actively engaged in the oversight of the Company's information technology, which includes periodic briefings on cybersecurity threats and participation in cybersecurity preparedness exercises. Furthermore, under its charter, the Board's risk committee has primary responsibility for information technology risk oversight, including as it relates to cybersecurity and data security matters. In this capacity, the risk committee oversees the Company's processes for identifying, assessing and managing technology and cybersecurity risk, including a risk-based escalation process, which requires that the risk committee be notified by management and, as necessary, receive regular briefings on the matter, and work with management, including Genworth's CISO and Chief Risk Officer ("CRO"), to assess and manage the risk and implement the Company's response to the incident, as appropriate.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Our President and Chief Operating Officer is responsible for reviewing, maintaining and enforcing our policies and procedures to ensure we meet our overall cybersecurity goals and objectives, while at a minimum, ensuring compliance with applicable federal and state laws and regulations.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: IBM has a third party supplier risk management program to oversee and identify risks from cybersecurity threats associated with its use of third party service providers and vendors. Risks are assessed and prioritized based, among other things, on the type of offering/engagement, supplier assessments, threat intelligence, and industry practices.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Board Oversight of Cybersecurity Matters Our Board has established oversight mechanisms to help ensure effective governance in managing risks associated with cybersecurity threats. In addition to the updates that our Board receives on cybersecurity matters, the Board's Finance, Risk Management and Audit Committee (the "FRMA Committee") is tasked with overseeing enterprise risk management. The FRMA Committee reviews and discusses major risk exposures with management, including cybersecurity risks, and steps management has taken to monitor and control such exposures, including our guidelines and policies concerning risk assessment and management.

companyName: INSPERITY, INC.

ticker: NSP


text: Our cybersecurity risk management program is integrated into our overall risk management system and processes. Together with the Board's standing committees, the Company's Board of Directors is responsible for ensuring that material risks, including material cybersecurity risks, are identified and managed appropriately. The Board receives updates at least bi-annually from our Chief Information Officer concerning our information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness and cybersecurity risk assessments. The Chief Information Officer has extensive IT and program management experience and works closely with our Chief Information Security Officer, who oversees our cybersecurity program on a day-to-day basis. The Chief Information Security Officer has extensive cybersecurity experience, including more than 15 years working in senior IT infrastructure and IT security roles in the healthcare sector (seven of which years were spent as the Chief Information Security Officer). Our cybersecurity incident response plan provides that the Chief Information Security Officer will work with our IT Department and the impacted segment of our business to investigate and respond to any identified incident (including by escalating the incident to the Company's senior management and the Board depending on the nature and scope).

companyName: Addus HomeCare Corp

ticker: ADUS


text: The Bank's cyber incident response plan includes third party cybersecurity incidents and threats. The Bank undertakes due diligence of third-party systems with whom the Bank will interact with, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of these service providers, including performance and technological reviews and escalation of any unsatisfactory reviews.

companyName: Federal Home Loan Bank of New York


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks Governance

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Particularly in light of the extensive cybersecurity risks facing our company and the fact that we provide crypto digital asset products to our clients, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our internal systems and our clients' data. We have established a multi-layered approach to manage our cybersecurity risks with preventative and detective capabilities enabled in our network and internal systems that are designed to protect against identified cyber threats. This approach to cybersecurity includes, among other things, annual and periodic risk assessments; ongoing collaboration with our product and engineering teams for the purpose of securing our products, systems, and data; a vulnerability management program focused on proactively identifying, triaging and mitigating security vulnerabilities within our systems, penetration tests and other simulations; regularly required security training for all employees; and a comprehensive incident response process to identify, contain, and remediate cybersecurity incidents. We also engage with external cybersecurity assessors and consultants in evaluating and testing the design and operating effectiveness of controls.

companyName: Bakkt, Inc.

ticker: BKKT


text: Material Effect from Cybersecurity Threats To date, no known cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, due to our limited cybersecurity measures, we acknowledge that our company could be at higher risk of material impact from cybersecurity threats. We are actively working to mitigate these risks.

companyName: T3 Defense Inc.

ticker: DFNS


text: As of and for the year ended December 31, 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: SCIENTIFIC INDUSTRIES INC

ticker: SCND


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by Ford's Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. The team provides cybersecurity services for Ford and its affiliates, including Ford Credit. The services provided to Ford Credit and its affiliates are governed by appropriate service agreements with Ford. Local regional teams and designated responsible individuals work with the enterprise-wide team to provide cybersecurity-related services in compliance with local requirements. The team's responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining the cybersecurity program. To do so, the program leverages both internal and external techniques and expertise. Internally, among other things, we perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals (often referred to as "white hackers" or a "Red Team") to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company email and access to Company assets. On a monthly basis, we disseminate security awareness newsletters to employees to highlight emerging or urgent cybersecurity threats and best practices. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT") and various Information Sharing and Analysis Centers (each an "ISAC"); review customer, media, and third-party cybersecurity reports; and offer bounties to responsible third-parties who notify us of vulnerabilities they are able to detect in our cyber defenses (commonly referred to as a "Bug Bounty"). Our capabilities, processes, and other security measures also include, without limitation: • Security Information and Event Management ("SIEM") software, which provides a threat detection, compliance, and security incident management system; • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on external-facing endpoints (e.g., Windows workstations, servers, MAC clients, and Linux endpoints); • Cloud monitoring, running on primary public and private cloud environments; and • Disaster recovery and incident response plans, including a ransomware response plan.

companyName: FORD MOTOR CREDIT CO LLC


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. IT leadership reports to our Chief Executive Officer (CEO) to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We promote a company-wide culture of cybersecurity risk management.

companyName: Ainos, Inc.

ticker: AIMD


text: To date, we have not experienced any cybersecurity attacks. However, any such attack could adversely affect our business. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: CO2 Energy Transition Corp.

ticker: NOEM


text: Our Audit Committee has primary responsibility for the oversight of risks from cybersecurity threats. Management, including members of the IT Committee, reports at least annually to the Audit Committee regarding cybersecurity risks and mitigation strategies. We consider each member of our Audit Committee to possess information security experience by way of their oversight responsibilities over this area. In addition to ensuring adequate safeguards are in place to minimize the chance of a successful cyber attack, we have established a cybersecurity incident response plan to effectively address any cybersecurity threat that may occur despite these safeguards. We believe our cybersecurity incident response plan will help ensure timely, consistent and compliant responses to actual or attempted data incidents impacting our company. The cybersecurity incident response plan includes an escalation framework, including processes for informing the board of trustees of material cybersecurity incidents.

companyName: RLJ Lodging Trust

ticker: RLJ


text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Quality Committee of the Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Audit Committee receives regular updates on the Company's cybersecurity risk management program from the CISO and CIO, and our procedures specify escalation of certain cybersecurity events to the Audit Committee chair and full Audit Committee.

companyName: Medtronic plc

ticker: MDT


text: We have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive annual cybersecurity awareness training, including specific topics related to social engineering and email frauds. We utilize an outsourced information technology firm and consultants with significant expertise in cybersecurity. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: UNITED GUARDIAN INC

ticker: UG


text: With respect to third-party service providers with access to our information systems, assets or data, our security policies and procedures are designed so that diligence is conducted as appropriate on the cybersecurity controls maintained by such third parties and to ensure that the Company has cybersecurity measures in place with respect to their access to our information systems, assets or data.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: The Advisor and its Information Security Team, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its shareholders. The Fund does not currently have any employees and relies upon the Advisor and its Information Security team for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: The CISO provides our AFC with quarterly updates about our cybersecurity program and material risks. This includes updates on cybersecurity practices, programs, and the status of projects designed to strengthen internal cybersecurity and data protection.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. awareness training of our employees, incident response personnel, and senior management. incident response plan that includes procedures for responding to cybersecurity incidents. risk management process for service providers, suppliers, and vendors.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information about the cybersecurity risks we face, see the risk factors in Item 1A- Risk Factors.

companyName: MeridianLink, Inc.


text: The Board delegates certain aspects of enterprise risk oversight to its committees as appropriate; however, cybersecurity risk management is primarily monitored at the full Board level. The Board regularly reviews management's assessment of cybersecurity risks, key controls in place to mitigate those risks, and the Company's overall cyber readiness.

companyName: DevvStream Corp.

ticker: DEVS


text: If these systems or their functionality do not operate as we expect them to, we may be required to expend significant resources to make corrections or find alternative sources for performing these functions.

companyName: Cenntro Inc.

ticker: CENN


text: One of the key responsibilities of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly and through the Audit Committee, which conducts regular risk assessments related to all matters affecting the enterprise, including cybersecurity, and receives periodic reports on the Company's cybersecurity risks and activities. Our Chief Financial Officer and our Senior Director, Head of IT are the Company employees responsible for developing and implementing a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We partner with external cybersecurity vendors to enact a layered defense approach with controls deployed that seek to meet the requirements of the NIST Cybersecurity Framework.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our directors, officers, employees, temporary workers, business partners, contractors, vendors, service providers, and individuals affiliated with third parties. The Information Security Program includes a dedicated Cybersecurity Incident Response Plan (the "CIRP"), which sets forth the rules and requirements for detecting, investigating, containing, eradicating, and resolving information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) a collection of Security Incident Forms (the "Security Incident Forms"), which delineate the processes for reporting, classifying, investigating, documenting, and communicating information security incidents and (ii) Security Guidelines and Baseline Protections, that establish the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual) in connection with security incidents.

companyName: COMMUNITY WEST BANCSHARES /


text: We rely on information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: Pharma-Bio Serv, Inc.

ticker: PBSV


text: We regularly engage independent third parties to assess our cybersecurity program and practices and to assist with risk mitigation. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third parties. These assessments are performed in conformance with ISO standards and requirements. Enhancements to our cybersecurity program and practices are identified from assessment findings, and if deemed appropriate, implemented.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Company recognizes that cybersecurity threats may pose significant business risks and has developed processes for identifying, assessing, and managing these threats. The Company has implemented a plan for cybersecurity and cyber-related management across its varied business units. This plan allows each business unit to tailor solutions to identify, manage, and mitigate risks based on their own assessment of their unique cybersecurity risks in conjunction with each business unit's overall risk management process. Having each business unit implement its own plan helps enable appropriate compliance in reporting material cyber events and risks across the Company.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls such as the CIS 18 Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: Nextpower Inc.

ticker: NXT


text: We maintain an Incident Response Plan ("IRP"), which applies to information security incidents. Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, as well as the communication protocol of such incidents to senior management and other key stakeholders pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.

companyName: VAIL RESORTS INC

ticker: MTN


text: The Company also maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through internal management and external service providers. Our cybersecurity risk management and strategy processes are led by our Chief Administrative Officer. This individual has over 30 years of prior work experience in various roles involving managing information systems and security, developing information security strategy, implementing effective information and cybersecurity programs, as well as a degree focusing on computer science. The Chief Administrative Officer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management and participation in the Company's cybersecurity risk management and strategy processes including the operation of our incident response plan. This management team member routinely discusses trends in cyber risks and our strategy with management and reports to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: Our CTO receives status reports from our cybersecurity department regularly and reports to our Chief Executive Officer, who receives updates on incidents, trends, projects and other relevant information regularly. In addition, as part of our incident response planning, we maintain cross-functional response teams to be prepared to respond to an incident.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Our cybersecurity program leverages various industry standards like the National Institute of Standards and Technology ("NIST") and Center for Internet Security Program framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our enterprise risk management team reviews cybersecurity risks, and key cybersecurity risks are incorporated into the enterprise risk management ("ERM") reports reviewed and discussed internally and with the Board. In addition, we have several avenues to gather risk intelligence, and potential threats identified by various services and capabilities to adjust our security strategy. We also have a set of Company-wide policies and procedures concerning cybersecurity and technology standards, which include a Technology Use policy, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to endpoint and network protection, encryption standards, malware/ransomware protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: HASBRO, INC.

ticker: HAS


text: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. We have adopted a Cybersecurity Incident Response Plan that applies if a security event occurs. Our Incident Response Plan provides a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting, and responding to security events that are identified by or reported to the Chief Information Officer ( "CIO "). Our Incident Response Plan applies to our personnel including contractors and partners that perform functions or services that require securing our information assets, and to all devices and networks that we own. The Incident Response Plan details the coordinated, multi-functional approach for investigating, containing, and mitigating incidents. Under our Incident Response Plan, cybersecurity incidents are escalated based on a defined incident categorization to the CIO and the General Counsel. Regular updates are provided by the Cybersecurity team to the CIO, who will maintain communication and information flow to senior leadership including the General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders as well as the Audit Committee and/or the Board of Directors as appropriate. Generally, our incident response process follows the National Institute of Standards and Technology (NIST) framework and focuses on preparation; detection and analysis; containment, eradication, recovery and post-incident remediation.

companyName: W&T OFFSHORE INC

ticker: WTI


text: As a global company with operations and customers in 25 markets, we encounter a variety of cybersecurity threats. However, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. Nevertheless, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors." of this Annual Report on Form 10-K.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: To meet our business objectives, we rely on both internal information technology (IT) systems and networks, and those of third parties and their vendors, to process and store sensitive data, including confidential research, business plans, financial information, intellectual property, and personal data of ours and our customers that may be subject to legal protection, and promote the continuity of our Company's business operations. In the ordinary course of our business, we receive, process, use, store, and share digitally certain data, including user data as well as confidential, sensitive, proprietary, and personal information.

companyName: GD Culture Group Ltd

ticker: GDC


text: Evaluating the ability of each of our third party service providers to implement and maintain appropriate security measures for the personal information to which we have permitted them access, and requiring such third party service providers by contract to implement and maintain appropriate security measures.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Our Chief Information Security Officer ("CISO"), our information security team, and third-party service providers help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our CISO along with this team, as applicable, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services.

companyName: Fossil Group, Inc.

ticker: FOSL


text: Our IT risk management processes are integrated into our Enterprise Risk Management ("ERM") program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. Our ERM program is overseen by our Enterprise Risk Committee ("ERC"). Our ERC is comprised of various members of senior management, including our CIO and internal audit and compliance department leaders. The ERC is responsible for the governance of enterprise risks assessments, identification and management of internal risks, and development of related mitigation strategies.

companyName: Excelerate Energy, Inc.

ticker: EE


text: As cybersecurity risks arise, our Information Security team executes the incident response procedure and communicates the appropriate details to management in alignment with the escalation steps in the procedure. In addition, our Chief Information Officer, Vice President, Information Security, and Manager, Information Security, conduct monthly cybersecurity program status reviews with the Information Security team that includes key performance indicator ("KPI") tracking, risk assessment, escalation actions, and project status.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our Chief Technology Officer is the primary point of responsibility for cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: LANDS' END, INC.

ticker: LE


text: To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Our Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. To date, our Vice President of Operations has not had to report any cybersecurity incidents to the Board. Our Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years. Among other things, he has been responsible for day-to-day access management, network security and data protection solutions. Our Board of Directors has oversight of management to eliminate cybersecurity risks.

companyName: Birchtech Corp.

ticker: BCHT


text: Our executive staff, supported by external IT, currently serves as our CISO. The CISO regularly reviews and assesses cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training, and risk management efforts.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and seek to strengthen the Company's defenses against cyber threats. Management also monitors AI usage and has implemented a framework that tracks use and is governed by CVR Energy's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Management also monitors AI usage and has implemented a framework that tracks use and is governed by the Company's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.

companyName: CVR ENERGY INC

ticker: CVI


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Audit Committee.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: As with all institutions involved in financial services, information security represents a significant operational risk. To mitigate this risk, we have developed and manage a comprehensive information security program dedicated to protecting data entrusted to us by our clients as well as our own proprietary corporate information and the information technology infrastructure we use to process this data and information. Our approach is considered to be a defense-in-depth strategy, with multiple tiers of security controls and monitoring. Our security program is benchmarked against the National Institute of Standards and Technology Cybersecurity Framework ("NIST"), including, among other things, with respect to application security, vulnerability management and data protection, threat detection and incident response.

companyName: Essent Group Ltd.

ticker: ESNT


text: The CICSO is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity team implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the cybersecurity team follows a written security incident response runbook, which includes procedures to, among other things, respond to the incident, mitigate its impact, and evaluate and satisfy applicable obligations.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: The Company and each of its consolidated subsidiaries are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access, and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee training; (vi) disaster recovery testing and (vii) security assessments of third-party service providers.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: First Guaranty's Information Security and Learning and Development departments facilitate annual company-wide security awareness training, regular phishing exercises, and provide regular updates across the organization to keep employees informed on ways to mitigate cybersecurity risk. Information Security has developed and distributed a procedure to inform its employees how to escalate potential cybersecurity risks.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: Upon identifying vulnerabilities, we commit to addressing them promptly, prioritizing based on their criticality. High-priority remediation efforts will be coordinated with the collaboration of Enterprise IT and DevOps teams to ensure swift and effective resolution. While the Company's LeapTM quantum cloud system holds SOC 2 Type 2 compliance, it's noteworthy that the correlation extends to all our IT systems, even though they are not explicitly within the defined scope. As a result, these interconnected IT systems align with SOC 2 Type 2 standards. Similarly, our policies regarding cybersecurity and IT systems are relevant for SOC 2 Type 2 compliance, but also apply to everyone in the entire organization.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We are not currently aware of any known cybersecurity risks that may materially impact our operations, though we may not be able to determine the likelihood of such risks. See Part I, Item 1A, "Risk Factors—Risks Relating to Our Business and Operations—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of businesses in which we invest, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business, financial condition, and operating results," for a discussion of risks related to cybersecurity and cyber incidents.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Our Board of Directors oversees cybersecurity-related policy and strategy. As part of this oversight, our CISO provides a cybersecurity dashboard that is reviewed by the Board at every regularly scheduled Board meeting, which includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward Transportation Security Administration (TSA) compliance. Additionally, our CIO and/or CISO presents to the Board bi-annually regarding our cybersecurity risks and strategies, including as part of our annual long-term strategy session. The Audit Committee, comprised of independent directors, reviews the implementation and effectiveness of cybersecurity risk management protocols and reviews the effectiveness of cybersecurity as part of the Company's accounting and internal control policies. As part of this oversight, our CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with any internal audits related to cybersecurity. Additionally, we have protocols by which cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, are reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: The security of our information technology systems and Company data is important to our operations and reputation. Accordingly, we are committed to identifying and managing cybersecurity risks. Our Cybersecurity team performs periodic risk assessments and, on a quarterly basis, provides to our Enterprise Risk Management Committee ("ERM") information related to the Company's cybersecurity, including statistics on attempted cyber-attacks, status of employee information security training awareness, and information on any security investigations. The Cybersecurity team advises the ERM of significant global cyber events that occurred during the quarter and whether they impacted DIRTT. The Cybersecurity team regularly discusses with the ERM the Company's cybersecurity posture and whether the Company should implement additional protections and controls to assist the Company in protecting, responding to, or mitigating potential future cyber-attacks.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: The Company has policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. All Company employees are required to complete annual cybersecurity training programs.

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: The Company maintains an Information Security Incident Response Policy ("Incident Response Policy") and related procedures that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely escalation of incidents to the Crisis Management Team and notification to the appropriate regulatory and governmental authorities. As needed, the notification may include the CEO and/or the Company's and Bank's Board of Directors. The Incident Response Policy and related procedures are coordinated through the Chief Risk Officer and key members of management, including but not limited to representatives from the information security, information technology and legal teams that are embedded into the procedures by design. The Incident Response Policy facilitates coordination across multiple parts of the organization and is evaluated at least annually.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: The Audit Committee of the Board of Directors is responsible for oversight of our cybersecurity risk assessment, risk management, incident response procedures and cybersecurity risks and provides updates to the Board of Directors regarding such oversight. Periodically during each year, the Audit Committee receives an overview from our Vice President, Head of Technology of our cybersecurity threat risk management and strategy processes, including potential impact on us, the efforts of management to manage the risks that are identified and our incident response preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk assessment, risk management and strategy programs.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: Our commitment extends to various programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. This includes regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. We also conduct "tabletop" exercises to simulate cybersecurity incidents to enhance our readiness and resilience in the face of potential cybersecurity threats. These exercises are conducted at both the technical level and senior management level. We have engaged external service providers, where appropriate, including leading cybersecurity firms, to assess, test or otherwise assist with aspects of our security processes.

companyName: Knowles Corp

ticker: KN


text: Notably, our cybersecurity strategy and incident response plan intentionally prioritize frequent and automated backup and recovery processes in an attempt to minimize the potential for critical data loss and/or business interruption. In doing so, we use systems that provide immutable backup and recovery of files and virtual machines, encryption of data at rest and in transit to protect against unauthorized access, and transmission of copies offsite at predetermined, recurring, and frequent intervals.

companyName: HURCO COMPANIES INC

ticker: HURC


text: The Board and Audit Committee are supported in their oversight capacity by the Company's ERM Committee, and internal audit and information technology functions. On a quarterly basis, the ERM Committee evaluates past, existing, and future risks to the Company; the likelihood, severity, and velocity of such risks; and the controls and mitigation tools implemented to address such risk. Several members of the ERM Committee have functional responsibility for the Company's information technology and cybersecurity risk monitoring activities and provide expertise to the ERM Committee in those areas.


text: Monitor Cybersecurity Incidents The CSO implements and oversees processes for the regular monitoring of our information systems, primarily through Security's Threat Detection & Response (TDR) team. This includes the deployment of technical security monitoring and alerting measures to identify potential incidents. In the event of a cybersecurity incident, the Security organization and relevant teams throughout the company follow a formalized, documented incident response plan. This plan includes immediate actions to assess and mitigate the impact of an incident, as well as subsequent actions to remediate and help prevent future incidents of a similar nature.

companyName: HashiCorp, Inc.


text: In the last ten years, we have not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "We face continually evolving cybersecurity and similar risks, which could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption to our business, damage to our brands and reputation, legal exposure and financial losses," which is incorporated by reference into this Item 1C.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Cybersecurity risk is identified and tracked through TEP's Enterprise Risk Management (ERM) program that consists of formal vetting and quarterly reporting to the UNS Energy Audit and Risk Committee and the UNS Energy Board. The UNS Energy Board Environmental, Safety, and Security Committee oversees cybersecurity strategy, performance, and risk, and timely reviews cybersecurity events, depending on severity, even if not material to TEP. The UNS Energy Board is notified of significant cybersecurity events as outlined in UNS Energy's Cybersecurity Incident Response and Reporting Plan.

companyName: TUCSON ELECTRIC POWER CO


text: Our CIO/CISO, who has more than 25 years of experience in technology and information security risk management across a number of organizations, is responsible for overseeing the risks related to cybersecurity. He is responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing senior leadership with regular updates on cybersecurity-related matters.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: The Company's information technology and risk management function is highly centralized, with the Corporate Controller and Vice President of Information Technology involved in most of the risk related activities which provides a consistent input throughout risk management activities as well as aiding in identifying dependencies and duplications. The Company engaged a third party to conduct phishing and penetration tests in 2024. The Company continues to evolve its processes, procedures, and tools as a result of the observations from these tests.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Our management cybersecurity committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Plymouth Industrial REIT, Inc.


text: We manage our cybersecurity risk as an integral part of our enterprise risk management programs. Accordingly, the disclosures in this Item 1C should be reviewed in conjunction with the disclosure in the Risk Management section in Item 7 of this Report.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Risks from Cybersecurity Threats To date, the Company believes that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have no t materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Refer to the risk factor captioned "A failure in the Company's operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company's business, its reputation, and / or cause losses which would have a material effect on the Company's business operations and financial results" in Part I, Item 1A. "Risk Factors" for additional information on cybersecurity risks that could adversely impact the Company's business, results of operations or financial condition.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or patients, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: Risks from Cybersecurity Threats Brighthouse Financial systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. Based on the information available as of the filing date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, directly or indirectly, that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in our cybersecurity risk management program, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning, could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, associates, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Oversight and Governance The Board of Directors is responsible for overseeing management's processes for managing cybersecurity risks and has delegated this function to the Audit Committee. The Audit Committee regularly reviews and discusses with management the processes to identify, assess and manage cybersecurity threats, as well as to identify, assess and, to the extent required, disclose whether risks from cybersecurity threats have materially affected the Company or if material cybersecurity incidents have occurred.

companyName: TripAdvisor, Inc.

ticker: TRIP