text: Breeze has an annual assessment of the Company's cyber risk management program performed by a third-party specialist. The cyber risk management assessment incorporates recognized best practices and standards for cybersecurity and information technology of the National Institute of Standards and Technology Cybersecurity Framework. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Breeze Holdings Acquisition Corp.


text: Our Vice President of Information Technology provides principal oversight and guidance of our cybersecurity risk management strategy, programs, and processes. The Vice President of Information Technology has over 30 years of experience in information technology, leading organizations through strategic technology and process improvement initiatives, including over 15 years of extensive experience in cybersecurity. He is supported by a team of technical experts who have received formal training and possess relevant experience in addition to managed cybersecurity service providers who specialize in preventing, identifying, and responding to cybersecurity threats.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI

secItem: Item 1C


text: We face a number of cybersecurity risks in connection with our business (see Part I, Item 1A. "Risk Factors – Risks Related to our Operations – Our business depends on our information systems. A cyber-attack, security breach or our inability to effectively integrate, manage and keep our information systems secure and operational could disrupt our operations."). Although such risks have not materially impacted our business strategy, results of operations or financial condition to date, we have experienced threats to and breaches of our data and systems, including malware and computer virus attacks.

companyName: AMEDISYS INC


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with the ISAT in an effort to continuously improve our cybersecurity risk posture. Examples of third-party actions include risk assessments and penetration testing of our systems.

companyName: MARA Holdings, Inc.

ticker: MARA


text: Cybersecurity Risk Management Strategy We have developed and implemented policies, procedures and practices designed to protect the information and systems that support our operations and assets. In developing our policies and procedures, we were informed by certain industry standards and guidelines. We routinely train our employees on cybersecurity awareness and our information security and data protection policies.

companyName: COMPASS Pathways plc

ticker: CMPS


text: The Company maintains a process to escalate certain cybersecurity incidents promptly so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Strategic Education, Inc.

ticker: STRA


text: Certain of our systems and those of our third-party service providers have experienced cybersecurity threats. Based on the information available as of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Although cybersecurity risks have not materially affected us, including our business strategy, results of operations, or financial condition, during the period covered by this report, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors – Risks Related to Our Operations"

companyName: Spirit AeroSystems Holdings, Inc.


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to materially affect the company, see the risk factor titled "A significant disruption in, or breach in security of, our information technology systems or violations of data protection laws could materially adversely affect our business and reputation" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: ROGERS CORP

ticker: ROG


text: We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: however, we remain potentially vulnerable to known or unknown threats. In some instances, we and the law firms that represent us in litigation can be unaware of a threat or incident or its magnitude and effects. Further, there are increasing regulation requirements regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise IT environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats;

companyName: American Bitcoin Corp.

ticker: ABTC


text: As part of the assessment of the protections we have in place to mitigate risks from cybersecurity threats, we engage third parties to conduct risk assessments on our systems. To assess the effectiveness of our program, we also have engaged consultants to conduct penetration testing and other vulnerability analyses. Over a cycle of several years, our Internal Audit function, with the assistance of outside technical advisors, will conduct an assessment of different systems to provide the Enterprise Risk Management Committee with information on our risk management processes, including cybersecurity risk.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: We have created an Information Security Team to implement and administer our Cybersecurity Policy. Among the duties and responsibility of our Information Security Team are the following: Ensuring that all CINV personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Company is stored on encrypted cloud-based servers accessible only by authorized CINV personnel;

companyName: Crucial Innovations, Corp.


text: Additionally, we've also appointed a Data Protection Officer ("DPO") who advises and monitors data protection functions at the Company. Our DPO has 15 years of experience working in cybersecurity, IT, governance, risk management, regulatory compliance, and data protection and privacy program design and implementation. Our DPO previously served as the DPO for several large companies, including ecommerce, life sciences, ESG, and legal services businesses. Our DPO is also a Certified Information Systems Security Professional.

companyName: ContextLogic Inc.


text: As a global company serving consumers in more than 175 countries and territories, we routinely experience a wide variety of cybersecurity incidents. However, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect our business strategy, results of operation or financial condition. For a more detailed discussion of the risks we face, see Item 1A, "Risk Factors."

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: We believe that our third-party vendors and service providers have their own respective cybersecurity protocols which our management believes to be adequate for protecting any of the Company's data that might be in their possession from time to time.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: We have engaged a third-party consultant to manage risks associated with network protection and workstation management. Our consultant performs an annual assessment of our cybersecurity risk policies and procedures.

companyName: TECOGEN INC.

ticker: TGEN


text: As part of our risk management program, we reference security industry frameworks and other guidance to help us assess, identify and manage cybersecurity risks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Atai Beckley N.V.

ticker: ATAI


text: Board Governance and Management As described above, our CDIO leads management's assessment and management of cybersecurity with the assistance of our CISO, who reports directly to the CDIO and meets with the CDIO on a regular basis to discuss pertinent risks, mitigation factors, remediation status, and risk acceptance. The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Executive Leadership Team (the "ELT") and provides updates to the ELT about cybersecurity matters. Our CDIO has more than 25 plus years of experience managing technology and risks and advising on cybersecurity issues, and our CISO has more than 25 plus years of IT and relevant cybersecurity experience.

companyName: Cencora, Inc.

ticker: COR


text: A dedicated CISO leads the IT/OT Security Team and is responsible for our cybersecurity risk management and strategy. The CISO has over 20 years of experience in security, of which 15 years is specific to cybersecurity and has served as a CISO since 2013, having joined ConocoPhillips as CISO in 2022. The CISO holds a master's degree and is a Certified Information Security Professional. The CISO reports to the CD&IO, who holds a master's degree in information technology and has served as Chief Information Officer/Chief Technology Officer and various roles in information technology for over 27 years. The CD&IO reports to the Executive Vice President, Strategy, Sustainability and Technology. This management team assesses and manages risks associated with cybersecurity.

companyName: CONOCOPHILLIPS

ticker: COP


text: Our cybersecurity program is overseen by our head of cybersecurity, with guidance from our Chief Technical Officer and our Vice President of Information Technology. Our head of cybersecurity has more than ten years of experience managing cybersecurity matters, holds an undergraduate degree in information systems with a focus on information security, and holds numerous certificates across the cybersecurity landscape. Our head of cybersecurity is also responsible for providing the Audit Committee with quarterly updates on cybersecurity risks and developments.

companyName: IES Holdings, Inc.

ticker: IESC


text: We also engage consultants and other third-party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with our third-party providers, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response.

companyName: BROADWIND, INC.

ticker: BWEN


text: The Company maintains an Information Security Program to safeguard all WSFS information assets against unauthorized use, disclosure, modification, damage, or loss. Information Security, in conjunction with Operations, Technology, and Executive Leadership, work together to provide and maintain security processes and procedures pursuant to which the Company will: • Ensure the security and confidentiality of client and bank records covered by law. • Protect against any anticipated threats or hazards to the security of such records. • Protect against the unauthorized access or use of such records or information in ways that could result in substantial harm to the Company, our Clients, and Associates. • Establish guidelines and practices for ensuring Information Technology compliance to external and regulatory requirements. • Ensure proper and effective Business Continuity and Disaster Recovery programs are implemented and tested.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: Our cybersecurity risk management program comprises one component of our overall enterprise risk management program which is organized by discipline areas. Our cybersecurity risk management program shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Playtika Holding Corp.

ticker: PLTK


text: In an era marked by rapid technological evolution, the business landscape is increasingly data-driven. Companies, including ours, collect, store, and leverage data to glean valuable insights about our members and travel trends; deliver relevant content to our members, suppliers, and business partners and enhance operational efficiency. This collection and leverage of data exposes us to potential cybersecurity threats. As a result, we have implemented a cybersecurity risk management framework that is designed to identify, assess, and mitigate risks from cybersecurity threats related to this data and systems and our business operations.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Our board of directors does not have a standing risk management committee, but rather directly administers its oversight function as a whole. Our board of directors will (i) lead in a direction that minimizes the risk of unauthorized and malicious use, disclosure, potential theft, alteration or damaging effects of our operations while concurrently enabling the sharing of information in cyberspace, and (ii) ensure that risks to the confidentiality, integrity or availability of Company-owned information assets are managed appropriately, and (iii) review disclosure concerning cybersecurity matters in our annual report on 10-K presented by our chief executive officer, chief financial officer, and other personnel in charge of cybersecurity matters.

companyName: Lakeside Holding Ltd

ticker: LSH


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Board regularly engages in discussions with management regarding the Company's risk assessment and risk management policies. In addition, the Audit Committee of our Board of Directors (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence tools.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from our executive team, informed by our Vice President, Information & Technology, on our cybersecurity risk management program, on a periodic basis.

companyName: Mersana Therapeutics, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the IT Lead. The IT Lead has 4 years of experience in roles that include oversight of cybersecurity risk management programs.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Our management team, including our CTO and Senior Director of Information Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. Our management team, including our CTO and Senior Director of Information Security, also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: FIGS, Inc.

ticker: FIGS


text: The Company uses a sophisticated backup and recovery methodology that supports the replication of data across multiple secure data centers with the intent to prevent local and cloud backup data from accidental destruction and unavailability in the event of data loss or a major cyber event. Magnolia has a cybersecurity Incident Response Plan ("IRP") in place that was established to help protect the integrity, availability, and confidentiality of information, prevent loss of service, and adhere to industry best practices. The IRP is reviewed annually and specifies the process for identifying a cybersecurity incident, conducting the initial investigation, classifying incident severity, documenting and communicating information to the appropriate parties, responding to and remediating the incident, and ongoing training. In the event of a cybersecurity incident, the IRP would be initiated to inform management, the Audit Committee, and the board of directors. The Company also has contracted retainers with third party vendors in the event they are required to assist during a major cybersecurity incident.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: The Company maintains a cybersecurity and risk management program called the Information Security Management Program ("ISMP") designed to identify, assess, manage, mitigate and respond to cybersecurity threats and attacks. The ISMP is overseen by the Company's Chief Compliance and Privacy Officer, who oversees the Company's information technology security team as it relates to the ISMP and is responsible for assessing and managing the ISMP, informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Company.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: We ensure continuous endpoint monitoring in collaboration with a third-party cybersecurity firm. For high or critical severity incidents, rapid response protocols are in place, including isolation, segmentation and forensic analysis by our cybersecurity team. Additionally, we have engaged a dedicated third-party threat hunter to assist in identifying Indicators of Compromise.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Security Awareness. Quarterly training is conducted for continuing education for all employees and monthly phishing tests are administered. We also email and post articles on our intranet of common attack schemes for our employees awareness. An annual cyber report is presented to the Board of Directors with monthly cyber reports.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Each quarter or as needed, the Board of Directors receives an overview from management of our cybersecurity program and strategy covering topics such as cybersecurity incidents and response, progress towards pre-determined risk-mitigation-related goals, results from third-party assessments, cybersecurity staffing, compliance status, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to any such risks. In such sessions, our Chief Information Security Officer is available to the Board of Directors to discuss any relevant cybersecurity matters. In addition, at least bi-annually, the Chief Information Security Officer and Chief Technology Officer report to the Board of Directors about cybersecurity threat risks, among other cybersecurity related matters.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: Our board of directors has delegated oversight of the Company's risk management process to the Audit Committee of our board of directors (the "Audit Committee"). Among its duties, the Audit Committee reviews with management the Company's policies with respect to risk assessment and management of risks that may be material to us, including cybersecurity risk management. The Audit Committee receives, at a minimum, quarterly reports about legal and compliance matters, which can include reporting on cybersecurity incidents occurring or threats that have been thwarted or are being monitored during the prior period, as reported internally by the Chief Information Technology Officer ("CITO").

companyName: Paramount Group, Inc.

ticker: PGRE


text: We face significant and persistent cybersecurity risks due to the widespread use of our websites and mobile applications; the attractiveness of our websites and mobile applications to threat actors, including state-sponsored actors; the fact that we operate globally and must defend against cybersecurity attacks in thirteen countries; the substantial level of harm that could occur to our business, our customers, or our merchants if we were to suffer a material cybersecurity incident; and our use of third-party products and services. Protecting our systems, networks, data and confidential information is a priority at Groupon. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies and processes designed to help us identify, assess and manage these risks.

companyName: Groupon, Inc.

ticker: GRPN


text: The COO notifies the Key Principals of our cybersecurity and information security posture as appropriate and the Key Principals are apprised of cybersecurity incidents deemed to have any relevant business impact. The Key Principals, COO, our Chief Financial Officer, and our Executive Managing Principal maintain an open dialogue regarding emerging or potential cybersecurity risks. The COO keeps them appraised of updates on any significant developments in the cybersecurity domain, ensuring the Key Principals' oversight is both proactive and responsive.

companyName: ExchangeRight Income Fund


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation processes.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Identifying and assessing cybersecurity risks and threats is integrated into our overall enterprise risk management program. Our Enterprise Cybersecurity Committee defines the strategy, prioritizes, and sets the expectations for execution of the cybersecurity program, leveraging an industry-standard cybersecurity framework, the National Institute of Standards and Technology cybersecurity framework (NIST CSF). (i) strategic development and continuous iteration of a risk strategy in line with our information services and business goals; (ii) engineering and architecture of cybersecurity preventative and response solutions and capabilities;

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Company's cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. Our cybersecurity program is a key component of our broader risk management strategy in which cyber risk has been identified and is actively managed with preventive and mitigating measures. We design and assess our cybersecurity program based on the National Institute of Standards and Technology's Cybersecurity Framework, ISO 27001, and industry-specific regulations. This does not imply that we meet any particular technical standards, specifications or requirements, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Investview, Inc.

ticker: INVU


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a cybersecurity awareness program, which covers timely and relevant topics, including social engineering and phishing, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks throughout our information security systems. These tools are integrated into our comprehensive security framework, used to bolster our employee-based cybersecurity programs and are regularly updated to respond to evolving threats.

companyName: Schrodinger, Inc.

ticker: SDGR


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT manager works with our management team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our management team evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to the Audit Committee of our board of directors, which evaluates our overall enterprise risk.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: The Company's executive leadership team meets regularly to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discuss with the Board changes in assessment of these risks and mitigation plans.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: Cybersecurity is managed as part of the Company's enterprise risk management program. We have integrated cybersecurity risk management into our enterprise-wide risk assessment through evaluations of IT infrastructure, compliance audits and aligning cybersecurity goals with overall business objectives. We work with cybersecurity experts to better understand potential cybersecurity threats.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Our Senior Director of Information Systems and our Director of Information Systems are responsible for day-to-day oversight of cybersecurity risk. The individual currently holding the position of Senior Director of Information Systems has held the role for two years, has sixteen years of experience in IT and software development (with eight of those years in management roles), and holds certification from MIT Sloan School of Management in cybersecurity risk management. The individual currently holding the position of Director of Information Systems—who reports directly to the Senior Director of Information Systems—was formerly an IT Audit Senior Associate at PricewaterhouseCoopers, performed security assessments as a consultant at PricewaterhouseCoopers, and passed his CISA exam (though certification is currently pending). These individuals are responsible for coordinating resources internally and externally regarding cybersecurity risk management and incident response, and they report directly to our Chief Administrative Officer.

companyName: MAXCYTE, INC.

ticker: MXCT


text: The Board of Directors, through the efforts of its Risk Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. As part of its oversight of operational risk, the Risk Committee is responsible for the oversight of information security and cybersecurity risk management. Our Chief Information Security Officer regularly reports to the Risk Committee on security events and incidents, testing, training, audits, new system assessments and the identification and remediation of cybersecurity risks. These reports also include topics such as the threat environment and vulnerability assessments, results of penetration testing, results of key cyber risk indicators and performance metrics, and our efforts to detect, prevent and respond to internal and external critical threats. The Risk Committee receives periodic updates on information security risk, the maturity of our information security program, and related investments and results. On an annual basis, the Risk Committee reviews and approves our information security program and information security policy.

companyName: SANDY SPRING BANCORP INC


text: Like other financial institutions, the Bank is targeted with malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access and implantation of computer viruses or malware. The Bank is also targeted with large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. Notwithstanding the breadth of our information security and privacy program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Unauthorized access to our computer systems or stored data could result in theft, including cyber theft, or improper disclosure of confidential information, and the deletion or modification of records could cause interruptions in our operations. The impact of a material information technology event could have a materially adverse effect on our competitive position, reputation, results of operations, financial condition or cash flows.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis;

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized cybersecurity industry frameworks established by the National Institute of Standards and Technology, and other applicable industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Additionally, we utilize internal and external independent controls to monitor and mitigate the risk of these threats, including a Security Incident Response Plan ("SIRP") and periodic Information Technology training for all employees.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: Senior management oversees our annual enterprise risk assessment, where we assess key risks within our company, including security and technology risks and cybersecurity threats, oversees our cybersecurity risk, and receives regular reports from our Vice President - Communications on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Moody National REIT II, Inc.


text: As part of our overall Enterprise Risk Management strategy, we maintain a robust Information Technology and Security Management Program ("ITSM") which includes processes to assess, identify, monitor and manage cybersecurity risks. The program includes provisions for annual cybersecurity risk assessments, ongoing monitoring and testing, as well as annual training for employees, executives, and Board Members. We use the Federal Financial Institutions Examination Council's ("FFIEC") cybersecurity assessment tool to identify risks and ascertain cybersecurity preparedness and the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework to benchmark our internal policies and procedures against best practices. We engage consultants and auditors to assist in the completion of our annual risk assessment and review of controls related to the ITSM.

companyName: Provident Bancorp, Inc. /MD/


text: Cybersecurity is of critical importance to our success. We are susceptible to significant and persistent cybersecurity threats, including data breaches, ransomware, and phishing attacks. These threats, which are constantly evolving, include attempts by malicious actors to breach our security and compromise our information technology systems, as well as those of our vendors and suppliers. A cybersecurity incident impacting us or any third party could disrupt operations, damage our reputation, and result in costly litigation and/or government enforcement action. We are committed to maintaining robust cybersecurity and data protection practices and continuously evaluate cybersecurity threats, considering their immediate and long-term effects on our business strategy, operations, and financial condition.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: Because a substantial portion of our current and past assets are maintained in the form of digital assets such as DOG Coin, and as of June 30, 2025, Cardano (ADA) tokens, our exposure to cybersecurity threats is significant. If the systems of our third-party wallet providers, custodians, or other service providers are compromised, or if our own limited internal protections fail, we could suffer an immediate and total loss of such assets. Unlike traditional bank accounts or securities held with registered brokers, digital assets may not be recoverable if stolen or rendered inaccessible due to a cyber incident. Any such loss could have a material adverse effect on our financial condition, business prospects, and results of operations.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the Cyber Security Framework of the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") Critical Security Controls. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: Varex Imaging Corp

ticker: VREX


text: Education and Awareness The Company launched a security awareness campaign, Be Cyber Smart, that helps employees make sure valuable data remains private, keep physical and digital workspaces secure with good security hygiene, spot potential phishing and malware threats, and avoid risky behaviors. The Be Cyber Smart campaign provides employees with tools and tips for proactive protection measures such as password management, the importance of computer restarts and software updates, security measures when working from home, recognizing and avoiding phishing and maintaining data privacy. In addition, annual compliance, security awareness and acceptable use training, as well as regular phish testing, is delivered to all employees.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: Management and Strategy recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have developed the following processes as part of our strategy for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: CleanCore Solutions, Inc.

ticker: ZONE


text: Our Board of Directors, executive management and Audit Committee are actively engaged in the oversight of IT risk management, including cybersecurity risk. Executive management and the Audit Committee share responsibility for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposure. The Board of Directors, executive management and the Audit Committee receive quarterly reports on IT controls and information security. Additionally, on at least an annual basis, the Audit Committee reviews and discusses with management our policies and programs with respect to the oversight of IT risk and cybersecurity threats.

companyName: A10 Networks, Inc.

ticker: ATEN


text: We engage in the ERM Program process semi-annually, which addresses, among other matters, emerging cybersecurity threats and models our exposure to the threat landscape against the overall strategic objectives of our Company. We regularly engage cybersecurity industry experts to assess, audit and consult on our cybersecurity practices. Further, we engage Managed Security Service Providers to monitor our information technology ("IT") environment, help identify attacks, forensically investigate and remediate breaches, and assess and test our IT system security. We also operate a cyber controls assessment program to monitor our internal program in between external assessments. We have also implemented a cybersecurity awareness training program to facilitate initial and continuing education for employees on cybersecurity and related matters. Regular reviews are conducted to assess our information security programs and practices, including incident management, service continuity, information security compliance programs and related achievements.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages third-party experts, including assessors, auditors, and consultants, in evaluating and testing our risk management systems. Such engagements include: managed security services, regular audits, penetration testing, threat assessments, and consultation on security enhancements. The Company has processes in place to oversee and manage its use of third-party vendors. We conduct security assessments of third-party vendors engaged, limit the information systems of the Company available to the third party, and maintain monitoring to ensure compliance with our cybersecurity standards.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: As part of our strategy to cease deploying capital into new opportunities in order to focus on supporting our existing ownership interests and maximizing monetization and other strategic opportunities to enable us to return value to our shareholders, we eliminated our internal management of technology and cybersecurity and outsourced this function to a third-party service provider. Our third-party service provider monitors and tests our safeguards, including through the use of automated tools and manual processes, such as vulnerability scanning, penetration tests, and assessments of our technology infrastructure, and offers training to our employees on these safeguards, including through phishing tests and other processes.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: The Company has an Information Security Program ("Program") to protect personal and proprietary information in compliance with applicable federal and state requirements. The Program is designed to: Ensure the security and confidentiality of employee and customer personal information and Company proprietary information;

companyName: STURM RUGER & CO INC

ticker: RGR


text: We employ a range of measures, processes, standards, and policies tailored to specific environments designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include data encryption, network security controls, secure physical facilities, employee training, access management, change management and comprehensive asset management, tracking, and disposal procedures.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: We regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face, and the security, performance, and reliability of our products may be disrupted by third parties, including nation-states, fraudsters, criminal syndicates, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures may not always function as expected and may not always detect or prevent all unauthorized activity, prevent all security breaches or incidents, mitigate all security breaches or incidents, or protect against all attacks or incidents.

companyName: Bakkt, Inc.

ticker: BKKT


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of Silvercrest assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive Silvercrest data. We have implemented and maintain a written proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures to follow in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, and client data in the event of an emergency or natural disaster.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K. Disclosure.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: As an asset manager, our business is highly dependent on information technology networks and systems. In addition, we believe that our position as an investment manager in the digital infrastructure space makes the security of these systems even more important to our Company and various stakeholders. See "Risk Factors—Risks Related to our Organizational Structure and Business Operations". The occurrence of a cybersecurity incident or a failure to implement effective information and cybersecurity policies, procedures and capabilities has the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships. Accordingly, we have invested significant time and resources into maintaining effective cybersecurity defenses and response plans. We have not experienced any material cybersecurity incidents to date.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: BOYD GAMING CORP

ticker: BYD


text: We perform diligence on high-risk third-parties that provide us software or have access to our systems or highly sensitive information, and monitor cybersecurity threat risks identified through such diligence. New software is evaluated for risk and approved by our internal Software Approval Board before purchase or installation on our systems. We formed a Software Approval Board, which is made up of cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D, to help determine risk and impact of any potential newly proposed software. Additionally, we generally require those high risk third parties to agree by contract to manage their cybersecurity risks in specified ways. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: GLAUKOS Corp

ticker: GKOS


text: The audit committee assists the board of directors by overseeing the steps management has taken to monitor and mitigate cybersecurity threats and risks. The audit committee receives reports annually from management on our cybersecurity strategy and program. Significant changes are reported to the audit committee from time to time. Cybersecurity incidents which are determined by management to be material will be reported immediately to the audit committee.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: As a result of these and other initiatives, we believe we have appropriate processes in place, including in many cases, related contractual provisions, as well as appropriate physical and administrative controls, that are designed to allow oversight and identification of cybersecurity threats related to our use of third-party service providers.

companyName: GRAYBAR ELECTRIC CO INC


text: Our Head of IT oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance and regulation concerns Our Head of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports; the Head of IT may be called upon to brief the board as well.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including events perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, which includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including network and endpoint monitoring, audits, vulnerability assessments, penetration testing and threat modeling to inform our risk identification and assessment. We also work with trusted third-party information security providers to deploy technologies designed to detect any unusual activities in our systems, attempts to access our systems, and guard against other security threats. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Head of Information Technology ("IT").

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Our cybersecurity program under the Chief Information Officer ("CIO") is led by our Chief Information Security Officer ("CISO"), both of whom have over 20 years of experience managing and securing global enterprises. The Board of Directors delegates oversight of cybersecurity risks to the Audit Committee, which receives updates from the CISO and CIO at least annually. Cybersecurity is integrated into the risk management process for the company through various mechanisms, including quarterly business reviews, annual budget planning, and linkage to the Enterprise Risk Management ("ERM") process.

companyName: AGILENT TECHNOLOGIES, INC.

ticker: A


text: These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Our reactive processes are captured primarily by the IRP, which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All these procedures and practices are tailored to our technology environment and are refined iteratively. Further, we have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to its use of third-party service providers.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: Our VP of Integration and IT Operations collaborates closely with our information technology partners to pinpoint new risks and evaluate our risk management framework. This team includes employees familiar with our products and systems who also possess experience in managing cybersecurity risks.

companyName: Lowell Farms Inc.

ticker: LOWLF


text: The Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The Audit Committee of the Board of Directors (the "Audit Committee") has been designated to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Prospect Capital Management also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: We believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: MAIA Biotechnology, Inc.

ticker: MAIA


text: Third Parties on Risk Management the complexity and evolving nature of cybersecurity threats, SideChannel, Inc. has relationships with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights as needed, to ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties may include audits, threat assessments, and consultation on security enhancements.

companyName: SideChannel, Inc.

ticker: SDCH


text: At the management level, the SDIT and his team are responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes, including the assessment and management of material risks from cybersecurity threats. The Company's SDIT reports to the Chief Financial Officer. The SDIT has extensive cybersecurity knowledge and skills, gained from over 25 years of relevant work experience. The SDIT is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the CIRP, which may include reports from the IT team. The SDIT also regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.

companyName: Valaris Ltd

ticker: VAL


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, the Company also maintains cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it's important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. For further discussion of risks from cybersecurity threats, see the section captioned "Operational Risks" in Item 1A. Risk Factors.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: Risk Management and Strategy Farmer Mac recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Farmer Mac's process to identify and assess material risks from cybersecurity threats operates alongside Farmer Mac's broader overall risk assessment process that contemplates all company risks. As part of this process, appropriate personnel collaborate with subject matter specialists, as necessary, to gather information to identify and assess material cybersecurity threat risks, their severity, and potential mitigations.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Our risk manager, along with the CEO, oversee our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The Audit Committee of our Board is tasked with oversight of the management of risks related to cybersecurity. The Audit Committee administers its risk oversight function by receiving periodic reports from members of senior management, including the risk manager and CEO, on areas of identified significant risk to the Company.

companyName: SWK Holdings Corp

ticker: SWKH


text: The Cybersecurity Committee also has authority to retain cybersecurity and other consultants and advisors to assist and advise the committee in its evaluation of the Company's cybersecurity program.

companyName: APA Corp

ticker: APA


text: We employ a layered defensive strategy when designing our cybersecurity controls. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations, and tabletop exercises. We engage in regular monitoring and assessments of our technology infrastructure using internal staff and third-party specialists.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: The General Administrative Leadership team provides regular briefings regarding cybersecurity risk and related matters to our Audit Committee. Such briefings may include a discussion of cybersecurity risks and applicable risk assessments, key updates regarding our cyber strategy and related initiatives, and the emerging cybersecurity threats that may impact our business. We also provided the full board of directors with updates on matters relating to cybersecurity risk management, as necessary.

companyName: Septerna, Inc.

ticker: SEPN


text: Our senior leadership team, which includes Mr. Austin and Ms. Hodges, has established a risk management framework to actively manage, mitigate and report on the various risks faced by Oncor. Pursuant to that framework, as frequently as necessary, but not less than quarterly, members of our senior leadership team and additional members of management meet to review and assess various operational, functional, legal and other types of risks facing the company, including risks related to cybersecurity. Discussions at these risk management forums include mitigation strategies and actions to provide oversight and assign responsibility for ongoing treatment and monitoring each specific risk. Risk management information collected at these meetings is then distributed at least quarterly to the Audit Committee of our board of directors and/or our full board of directors. Our risk management efforts, including risks related to cybersecurity, are reported on to the Audit Committee and/or the full board of directors at least quarterly. Mr. Austin and Ms. Hodges also provide separate written reports on cybersecurity risks and activities to both the Audit Committee and the full board of directors, with specific discussion time devoted to cybersecurity at the Audit Committee and/or the full board of directors at least quarterly.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: For additional discussion of risks associated with cybersecurity, see "Risk Factors – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Our Audit Committee, which consists solely of independent directors, oversees the Company's overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. Our Audit Committee reviews, discusses with management at least annually and oversees the Company's information security and data protection programs. In particular, the Audit Committee receives periodic updates from the CISO, internal audit function and other members of management on significant cybersecurity and data privacy threats to our systems and the potential impact on the Company's business, financial results, operations, and reputation, risk management strategies, including information governance and security policies and programs, program assessments, planned improvements, major legislative and regulatory developments that could materially impact the Company's cybersecurity and data privacy policies and programs, and status of information security initiatives, including an appropriate threat assessment relating to information technology risks. After each such update, the Chair of the Audit Committee updates the full Board. The Board also receives similar cybersecurity updates directly from the CISO and other members of management at least annually, and as needed from time to time.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: Cybersecurity events and data incidents are evaluated, assessed based on severity and prioritized for response and remediation. Under our incident response policies, incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: Cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats that we face, and regarding our likelihood of being materially affected by risks from cybersecurity threats, please see item 1A, "Risk Factors."

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given the nature and size of our Company, we do not have a dedicated enterprise risk function, but our executives regularly consider and evaluate risks to our Company.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal IT audit, IT security, governance, risk, and compliance reviews. To protect, detect, and respond to cybersecurity threats, we aim to conduct the following activities at various intervals during the year, which vary in maturity across our business: • Regular network and endpoint monitoring; •24x7 security operations monitoring of our systems, networks, and services to detect and act on weaknesses and potential intrusions;

companyName: Jamf Holding Corp.

ticker: JAMF


text: Cybersecurity is a critical part of our enterprise risk management. The Board, through its Audit Committee, oversees enterprise risk management, including cybersecurity. To more effectively address cybersecurity threats, we have numerous security layers within our least privilege network approach which is managed by our Information Technology Department. Our cybersecurity programs align with numerous standards and continues to grow and develop as new technologies emerge. Further, we have regular user awareness testing and trainings in place which helps keep all end users and executive leadership up-to-date on the most current threats. The global head of Information Security, possessing credentials in both information technology ("IT") and cybersecurity, provides regular updates to senior management. Additionally, they provide at least an annual update, or more frequently if necessary, to both the Audit Committee and the full Board regarding the current threat landscape at Balchem, cybersecurity technologies, mitigation strategies, industry trends and best practices that we follow, major cybersecurity incidents (if any), and other areas of importance. The global head of Information Security has responsibility over cybersecurity management globally and reports directly to the Chief Financial Officer. Additional activities to maintain and enhance information security are discussed below.

companyName: BALCHEM CORP

ticker: BCPC


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity component of our risk management program and is a key member of the risk management organization, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the Information Technology Committee of our board of directors.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity risks are integral to our enterprise risk management activities. Our cybersecurity program leverages people, processes, and technology to timely identify and respond to cybersecurity threats. The Company has access control systems to limit physical and virtual access into our system to authorized users. In addition, we utilize services and software from third-party providers to monitor the Company's network and obtain expeditious alerts of anomalous activity. The Company takes a risk-based approach to manage cybersecurity risks and reviews third-party reports to oversee and identify cybersecurity threats. The Company maintains cybersecurity insurance to defray costs associated with an information security incident.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Our board of directors has ultimate oversight of and is charged of cybersecurity matters and receives reports from the CTO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. In accordance with our cyber incident response plan, the board of directors is promptly informed by management of cybersecurity incidents with the potential to materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. At least annually, the board of directors reviews and discusses the Company's technology strategy in combination with the Company's strategic objectives with Management.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: Blackstone has a process designed to assess, the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as us. This assessment is conducted on the basis of, among other factors, the types of services provided, and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Cutting-edge Data Backup: Deployment of our new data backup system is underway, offering robust protection against catastrophic failures, early detection of data loss prevention events, and near real-time mitigation of ransomware attacks. Full implementation is anticipated by the end of the first quarter of 2024.

companyName: SES AI Corp

ticker: SES


text: Execution of the Company's cybersecurity program is delegated by the Board to the Senior Director of Information Security, who has over 25 years of relevant experience in information security, including 14 years at the Company, and is further supported by a team of security professionals within the Information Systems & Informatics department. The Senior Director of Information Security reports to the Vice President, Treasury & Head of Information Systems, and they meet periodically with senior leadership and the Audit Committee to review metrics on cybersecurity preparedness, incidents, mitigations and remediation efforts.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: The Board recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. The Company's cybersecurity processes and practices are integrated into our risk management and oversight program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We utilize a third-party managed IT service provider (the "MSP") to provide comprehensive cybersecurity services for the Company, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery, and cybersecurity education and awareness. The Company has adopted a written information security incident response plan, which, as discussed below, is overseen by the Audit Committee of the Board (the "Audit Committee").

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably likely to have a material effect on the organization. The Company and its service providers have experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place. Notwithstanding the cybersecurity protections we have in place, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Risk Assessment and Management We have become increasingly dependent upon digital technologies, including information systems, infrastructure and cloud applications and services, to operate our businesses, process and record financial and operating data, communicate with our employees and business partners, analyze seismic and drilling information, estimate quantities of met coal reserves, as well as other activities related to our businesses. We own and operate some of these systems and applications while others are owned and operated by third-party service providers.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: Our management and the Board recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cyber security risks as part of our larger risk management program. While all of our personnel play a part in managing cyber security risks, one of the key functions of our Board is informed oversight of our risk management process, including risks from cyber security threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. In general, we seek to address cyber security risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cyber security threats and effectively responding to cyber security incidents when they occur.

companyName: ZION OIL & GAS INC

ticker: ZNOG


text: Integral elements of the Plans related to the Company's response to cybersecurity vulnerabilities include the following: • Identifying the appropriate team and any appropriate sub-teams to address specific system failures, interruptions, or cybersecurity breaches, or categories thereof. • Coordinating incident or crisis management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified system failures, interruptions, or cybersecurity breaches. • Conducting post-incident reviews to gather feedback on incident response procedures and address any identified gaps in cybersecurity measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plans. • Reviewing the Plans at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its incident response procedures.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Our cybersecurity risk management framework includes (1) procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including risk assessments and contractual protections), (2) technical IT controls designed to manage risks associated with cybersecurity incidents (such as multi-factor authentication and requirements for VPN or private channel access to our systems), and (3) formal policies and procedures designed to address cybersecurity incidents. Our formal policies and procedures designed to address cybersecurity incidents include steps for verifying and assessing the severity of a cybersecurity incident, identifying the source of a cybersecurity incident (including whether it is associated with a third-party service provider) and implementing cybersecurity countermeasures and mitigation strategies. Additionally, we have procedures for informing senior management and our Board of Directors of potentially material cybersecurity incidents. We also periodically engage third-party security consultants to assess our cybersecurity program and to perform penetration testing on our security environment and controls. In addition, cybersecurity training is provided to all newly hired colleagues and then at least annually for all colleagues. We also conduct regular ongoing cybersecurity awareness campaigns and phishing tests and provide training in response to such tests as appropriate.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: The business continuity program is overseen by the Finance Committee of our board of directors and includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Our Operational Risk Committee, a management level committee, including leadership representatives from our operational risk, information security, information technology, legal, operations, and other departments throughout the Bank, is responsible for oversight of operational risk and oversees the implementation of the business continuity program as approved by the board of directors.

companyName: Federal Home Loan Bank of Boston


text: Accordingly, we have developed an informational security program and devoted resources for assessing, identifying and managing risks associated with cybersecurity threats, including: • established a dedicated internal cybersecurity team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • implemented continuous monitoring tools and a third-party Security Operations Center that can detect and respond to cybersecurity threats in real-time; • perform ongoing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain measures to mitigate their cybersecurity risk; • retain third-party cybersecurity consultants who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; • conduct frequent cybersecurity training and testing for our workforce; • provide our board of directors with regular updates regarding threat levels, including analyses that demonstrate the overall cybersecurity posture and health of the organization; • engage in periodic assessments of our cyber resilience with the Cybersecurity and Infrastructure Security Agency (CISA); • conduct scheduled reviews of our Incident Response Plan to assess the responsiveness during a cybersecurity event or Ransomware attack; and • maintain third party vendor management program, which includes requirements for how our partners transmit, store and use bank information.

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: Management is responsible for day-to-day cyber risk management activities, including proactively identifying, assessing, prioritizing, managing and mitigating enterprise cybersecurity risks. Our Chief Financial Officer ("CFO") is the accountable leader in executive management for Zebra's IT and cybersecurity programs.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of IT to manage the risk assessment and mitigation process.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of outside experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity and IT risk management systems. Engaging outside vendors enables us to leverage specialized knowledge and insights, ensuring our cybersecurity and IT risk management strategies and processes remain sound. Our collaboration with these third-parties includes threat assessments, consultation on security enhancements and regular audits, the results of these threat assessments and audits are reported to the Audit Committee. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: Fidelity and its Enterprise Cybersecurity organization, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its Members. The Fund does not currently have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Private Credit Co LLC


text: Cybersecurity is critical to the delivery of our services to our clients. We face cybersecurity threats that are common to most industries. We have a cybersecurity risk management program in place that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. This program is a key component of our enterprise risk management program. The Company's Board is responsible for oversight of the Company's information technology systems, including cybersecurity, and has delegated such oversight to the Audit Committee. The Audit Committee regularly reviews the status of the initiatives such as the seeking of certifications associated with our information technology systems and receives regular updates on matters relating to information technology and cybersecurity. Our corporate information security organization, led by our Senior Director of IT who reports to our Chief Financial Officer, is responsible for our overall information security strategy, policy, security, operations and cyber threat detection and response. Our current Senior Director of IT has an extensive background and experience in information technology management and design, and data security. An integral part of our cybersecurity framework is our Security Response Team which is responsible for the detection, review, and response to cybersecurity incidents. In the event of a security incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas as well as senior leadership and the Board, as appropriate.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Peakstone Realty Trust

ticker: PKST


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards. We work with a third-party provider to monitor for threats and potential cybersecurity breaches.

companyName: MetaVia Inc.

ticker: MTVA


text: In July 2023, the SEC implemented cybersecurity amendments effective for annual reports with fiscal years ending on or after December 15, 2023, which was effective for Navitas beginning in 2023. The board of directors oversees our cybersecurity program, which is managed by our director of IT in collaboration with management of our businesses and functions. During the year ended December 31, 2023, we experienced no material cybersecurity incidents. Our approach to identifying and managing cybersecurity risks involves maintaining an updated firewall, monitored by our director of IT, coupled with annual cybersecurity awareness training for all our employees. We also have email filters to prevent spam and phishing attacks, while anti-virus software on employee computers alerts out IT department to potential threats. We have performed an annual penetration test, conducted by consultants, to ensure the robustness of our cybersecurity. To date, to our knowledge no external entity has successfully breached our system. If a breach is discovered, the director of IT informs our chief financial officer and chief executive officer, who would then communicate the information to our board of directors.

companyName: Navitas Semiconductor Corp

ticker: NVTS


text: Our cybersecurity program and supporting ISMS are governed by our Cybersecurity Steering Committee, which is includes our Chief Information Officer ("CIO") and is comprised of other members of our management team, including individuals from our finance, supply chain, product, information technology ("IT"), and legal departments. The Cybersecurity Steering Committee convenes quarterly to review the ISMS, identify new material risks and potential treatment plans that are recorded in our cybersecurity risk register, and review the overall health of security key risk indicators, technical key performance indicators, and roadmaps for the expected delivery of new and updated controls.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the Defense Federal Acquisition Regulation Supplement and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain information security controls. Additionally, we gather information and review the SOC-2 reports of certain third-parties who integrate with our systems, such as our payroll processor, managed solutions provider and software as a service providers on an annual basis to identify and manage risk. We continuously evaluate and seek to improve and mature our cybersecurity processes. We apply lessons learned from our defense and monitoring efforts to help prevent future attacks and utilize data analytics to detect anomalies and search for cyber threats. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of systems and processes to help maintain compliance with policies.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: While we have experienced, and expect to continue to experience, cybersecurity threats, we did not experience any material cybersecurity incident in the year ended December 31, 2024. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional information regarding cybersecurity risks, see "Risk Factors - Risks Related to Cybersecurity and Technology".

companyName: Finwise Bancorp

ticker: FINW


text: Although we may face a number of cybersecurity risks in connection with our business, we have not experienced any cybersecurity threats, incidents, or challenges that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors," in this Governance

companyName: Xenetic Biosciences, Inc.

ticker: XBIO


text: Management Committee ("RMC"), which is responsible for the oversight of the Corporation's overall risk framework, and assists the Board in the monitoring, review and approval of the policies that measure, limit and manage the Corporation's risks, including cybersecurity risk. The RMC holds periodic meetings in which management provides overview of Popular's cybersecurity threat risk management incident status.

companyName: POPULAR, INC.

ticker: BPOP


text: The Company's VP of Business Operations and Strategy reports directly to the CEO and leads the Information Technology team (collectively, the " IT Security Team ").

companyName: USA Rare Earth, Inc.

ticker: USAR


text: We have no employees. Our business is externally managed by the Advisor, an affiliate of the Sponsor. We are dependent on the Advisor and affiliates of our Sponsor (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT IV, Inc.

ticker: LTSV


text: Our board of directors delegates the cybersecurity risk oversight function to its audit committee. The audit committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program. Management has overall responsibility for assessing, identifying, and managing material cybersecurity risks.

companyName: Maplebear Inc.

ticker: CART


text: There have been no material cybersecurity threats or incidents nor are we aware of any cybersecurity risks reasonably likely to affect us, our business strategy, results of operations, or financial condition. However, future cybersecurity incidents could have a material impact on our business strategy, results of operations, or financial condition.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to the discussions under the headings "Significant disruptions in, or breaches in security of, our information technology systems have adversely affected, and in the future could adversely affect, our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and "Overview-Other Matters" included as part of our Management's Discussion and Analysis of Financial Condition and Results of Operations ("MD&A") at Item 7 of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Fortive Corp

ticker: FTV


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: Our IT management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our IT management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: SUNLINK HEALTH SYSTEMS INC


text: Our information security policy is based on recognized industry standards and cover areas such as risk management, data backup, and data recovery. We engage consultants and IT managed service providers (IT MSP), to help us design and implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities and responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee. We conduct cybersecurity penetration testing as warranted to identify and remediate cybersecurity gaps.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Third-Party and Vendor Management Review Processes — We have implemented processes to assess cybersecurity controls while on-boarding and managing third-party vendors. Additionally, we have implemented a process for annual review and enforcement of the cybersecurity controls for third-party vendors that provide essential services and/or store data that presents a business risk to us and/or our customers.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Our systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, to date, we are not aware of any incident or cybersecurity risks having a material impact on our business, results of operations or financial condition.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: We rely on the Adviser to engage external experts, including cybersecurity consultants, to evaluate cybersecurity measures and risk management processes, and depends on and engages various third parties, including suppliers, vendors, and service providers. The Adviser conducts ongoing due diligence of its significant service providers to determine whether the cybersecurity programs of service providers include, among other things, procedures and safeguards designed to ensure the protection of Critical Information.

companyName: Willow Tree Capital Corp