text: We have certain processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our enterprise risk management processes. Specifically, we have processes for: • Identifying and Managing Cybersecurity Risks — We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. We periodically review, assess, update and test our policies, standards, processes and practices in a manner intended to address cybersecurity threats and events. The results of such reviews, assessments and tests are evaluated by management and reported to our Audit Committee of the Board of Directors, or the Audit Committee, and our Board of Directors. • Technical Safeguards — We have integrated cybersecurity into our overall information technology operations and designed our processes and systems to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack as well as secure our networks and systems. • Incident Response and Recovery Planning — To better facilitate our cybersecurity program, our cybersecurity team works collaboratively across our Company to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents. We conduct regular tabletop exercises, including incident simulations to test these plans and ensure personnel are familiar with their roles and responsibilities in a response scenario. • Third-Party Risk Management — We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties and the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness — We provide training regarding cybersecurity threats as a means to equip our employees and consultants with tools to make employees and consultants aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: Our Vice President, Information Technology, along with the members of our Incident Response Team, which includes our Chief Financial and Business Officer and our General Counsel, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Incident Response Team is supported by an experienced managed service provider and an incident response provider with extensive global cybersecurity expertise, who both monitor, assess and report threats to us. Additionally, our Vice President, Information Technology has over twenty years of experience operating in the information technology, security and cybersecurity space. In particular, he has experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA

secItem: Item 1C


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. From time to time, we also experience or are subject to a variety of cybersecurity incidents in the ordinary course of business that do not have a material adverse effect on the Company, including a previously disclosed July 2023 cybersecurity incident experienced by one of our third-party vendors related to an unknown (i.e., zero-day) vulnerability in a popular file sharing software that the vendor used called MOVEit Transfer. As of the date of this report, we have not experienced any material cybersecurity incidents to our knowledge, and we know of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, please see Item 1A. Risk Factors.

companyName: PACIFIC PREMIER BANCORP INC


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Information Security Program is focused on the following key areas: • Security Operation and Governance: The Board has delegated to senior management responsibility for the Information Security Program which is managed through the IT Steering Committee, which maintains alignment and appropriate insight regarding information security activities. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security department oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Incident Response Plan: The Company has a contracted with a third-party to provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, and intrusion hunting. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by our Risk Management department. The process provides awareness and collaboration across internal teams including Information Security and Business Continuity. A Technical Requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. This process is aimed at advocating the necessary security, infrastructure, and application standards or controls so that information systems and the third party have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape. In coordination with the Information Security Group, the General Counsel provides reports of significant cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board or ad hoc as appropriate. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicits detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: A plan is in place to restore our networks if attacked by both our on-site backup and, if needed the off-site backup. We have very complex software for our engineering. We also have a robust accounting ERP software. These are regularly maintained and updated.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: Cybersecurity risk identification, assessment, and management are integrated into our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. These critical enterprise risks are assessed by senior management annually and discussed with the Board. Then each of the top risks are validated, prioritized, and assigned risk owners who are responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). In this way, critical business risks, including cybersecurity risk, benefit from both top-down and bottom-up risk management efforts that we believe are reasonably designed to escalate key risk and control issues to senior management and the Board.

companyName: FORD MOTOR CO

ticker: F


text: We contract with a third-party vendor (oversight for which is outlined in our Vendor Risk Management Policy) who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by employees, intrusion detection systems, third-party servicers, or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the Head of Information Technology, the ORC and the CSIRT, which provides status updates to the Information Security Committee ("ISC"), with the frequency of such updates depending upon the perceived threat level of the reported incident.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: The Company's Board of Directors and its Risk and Compliance Committee are responsible for overseeing the Company's cybersecurity program and polices. The Company's management, led by the Chief Risk Officer and Information Security Officer in conjunction with Chief Information Officer, is responsible for designing and implementing the program. The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company's cybersecurity systems and the planning and status project to strength the Company's information security. The Company's cybersecurity incident response plan requires that management promptly advise of the Risk and Compliance Committee of any material cybersecurity incident. The Chair of the Risk and Compliance Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Risk and Compliance Committee meetings where cybersecurity issues are discussed and have access to the materials for each Risk and Compliance Committee meeting.

companyName: PCB BANCORP

ticker: PCB


text: PPL and the other Registrants also maintain a process to review the cyber risks that arise from the use of third-party service providers as well as programs and procedures to mitigate such risks internally and to assess the extent to which such providers effectively manage their own cyber risks.

companyName: PPL ELECTRIC UTILITIES CORP


text: The board of directors (the "Board"), directly and through its Risk Committee and Cybersecurity and Technology Committee (the "Cybersecurity Committee"), oversees the Company's risk management strategy and cybersecurity, data privacy, and technology risks and provides oversight of ongoing investments in cybersecurity and technology. The Company's Chief Risk Officer ("CRO") provides regular reports to the Risk Committee regarding the Company's general risks, including risks relating to cybersecurity threats, and responses thereto. The Cybersecurity Committee oversees the Company's cybersecurity, customer privacy, and technology risks and monitors the Company's strategy and progress to achieve its planned cybersecurity objectives. The Chief Information Officer ("CIO") and Global Chief Information Security Officer ("CISO") provide quarterly updates to the Cybersecurity Committee regarding cybersecurity, and information technology strategy and programs. In addition, both the Risk Committee and Cybersecurity Committee meet as needed outside of the normal quarterly reporting cycle to discuss particular cybersecurity issues as required.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: In the event of a cybersecurity incident impacting us, our Adviser or Sculptor, Sculptor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Sculptor, including coordinating with the relevant members of our Adviser. The incident response plan includes notification to the applicable members of cybersecurity leadership, and, as appropriate, escalation to the full Sculptor risk management team and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee of our board of directors and to our full board of directors, if appropriate.

companyName: Sculptor Diversified Real Estate Income Trust, Inc.


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our Board provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.

companyName: GRI Bio, Inc.

ticker: GRI


text: To safeguard critical data and systems, ensure regulatory compliance, manage our material risks from cybersecurity threats, and address potential cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we: • Monitor emerging data protection laws and adjust our processes and procedures as required or appropriate; • Provide periodic, but no less than, annual training on cybersecurity, data privacy, and data handling to all employees and contractors with access to our systems; • Conduct periodic, but no less than, annual cybersecurity management and incident response training for relevant personnel, utilizing Knowbe4 resources; • Implement regular phishing simulations and processes for reporting phishing to enhance staff awareness and responsiveness; • Mandate that both employees and service providers treat sensitive data with utmost care, enforced through policies, practices, and contracts; • Contract with independent cybersecurity providers to assist with tabletop exercises periodically to refine our response strategies to cybersecurity incidents; • Employ the NIST incident handling framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents; and • Maintain cybersecurity risk insurance to mitigate potential financial losses from incidents.

companyName: ARTIVION, INC.

ticker: AORT


text: The Company's Chief Information Security Officers, experienced information systems security professionals with many years of experience across a variety of technology sub-specialties, provide oversight and direction for the Program and regularly communicates the information security risk posture and the prevention, detection, mitigation, and remediation of cybersecurity incidents to the Company's executive team and the Company's Audit and Risk Management Committee. Our Chief Information Security Officers and The Audit and Risk Management Committee oversees the Program and management of risks from cybersecurity threats and reviews and monitors the Company's business and technology strategy.

companyName: American National Group Inc.

ticker: ANG-PD


text: Contractually, we require the ISP to provide us with annually a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our officers under the oversight of our Board of Trustees. Our officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Lending Partners


text: Although we take measures to protect sensitive information from unauthorized access, use or disclosure, our information technology and infrastructure, and that of our technology and other third-party service providers and their subcontractors, are nevertheless inherently vulnerable to, and from time to time experience, various cybersecurity threats. We continue to invest in the security and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Natera, Inc.

ticker: NTRA


text: Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. As part of our services agreement with Agenus, Agenus' Chief Information Officer provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.

companyName: MiNK Therapeutics, Inc.

ticker: INKT


text: Additional information about cybersecurity risks we face is discussed in Item 1A, Risk Factors of this report under the heading "We are dependent upon information technology and operational technology systems, which are subject to disruption, damage, failure or cybersecurity attacks and risks associated with implementation, upgrade, operation and integration" which should be read in conjunction with the information above.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: Chief Executive Officer and Chief Financial Officer interact with our IT consultant and oversee our cybersecurity policies and processes, including those described above at "Risk Management and Strategy". The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: Management is responsible for assessing and managing cybersecurity risk. Specifically, the CISO is responsible for the prevention, mitigation, detection and remediation of cybersecurity incidents. The CISO regularly meets with the Chief Executive Officer ("CEO") and Executive Leadership Team to inform them on cybersecurity risks. These briefings encompass a broad range of topics, including: • Threat intelligence; • Risk updates with regional vice presidents; • Third-party assessments and results of tabletop exercises; • Training programs for employees; • Results of phishing simulations; • Cybersecurity technologies and best practices; and • Significant cybersecurity incidents and/or trends (if any).

companyName: Allegion plc

ticker: ALLE


text: The Information Security Management Team is responsible for all of Noble's cyber security-related activities such as advising on governance requirements, setting cyber security policies, standards, and procedures, reporting, determining current risk appetite, setting security posture, evaluating security maturity, and ensuring compliance to cyber security frameworks. The team monitors both internal and external threats, potential compromising internet-based attacks, phishing activities, and aims to adapt with protective measures.

companyName: Noble Corp plc

ticker: NE


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The audit committee of the Company's board of directors provides structured oversight of the Company's risk management program, which focuses on the most significant short-, intermediate-, and long-term risks the Company faces. The Company has an information security compliance committee (the "Committee") that consists of the members of the Company's compliance committee, which reports to the board of directors, and at least three members of Company management. The Committee is responsible for overseeing the development and upkeep of written policies and procedures aimed at safeguarding the Company's information systems and the nonpublic information stored within them. In addition, the Committee plays a crucial role in the governance of the cybersecurity risk management process. This involves collaborating with third-party industry experts and the Company's internal audit team to conduct risk assessments of the Company's information security program (the "Program"). The assessments encompass an evaluation of the Company's adherence to the Program, including the elements of the Program that are dictated by relevant laws, regulations, and the Company's information security manual. Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our Vice President, Engineering – Security, Compliance, and Trust, who maintains a CRISC certification, has more than twenty years of experience in information security, risk management, and regulatory compliance in the financial services industry, and serves as our designated Chief Information Security Officer ("CISO").

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: Management assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and regular evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to management and the audit committee, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.

companyName: Adeia Inc.

ticker: ADEA


text: For a discussion of the risks and uncertainties that cybersecurity incidents may have on us, see "Risk Factors: Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers" in this Form 10-K.

companyName: Ingersoll Rand Inc.

ticker: IR


text: Risk oversight is a responsibility of the Board. The Board has delegated responsibility for monitoring technology and cybersecurity risks to the Audit Committee. The Board reviews the Company's cybersecurity risk posture, strategy and execution on at least an annual basis while the Audit Committee receives cybersecurity updates quarterly.

companyName: Civeo Corp

ticker: CVEO


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the sections titled "Risk Factors— If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" and "Risk Factors— We are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations, and rules; contractual obligations; industry standards; and policies. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions (which could include civil or criminal penalties); private litigation, (including class-action claims) and mass arbitration demands; disruptions to our business operations; adverse publicity; and other adverse consequences that could negatively affect our operating results and business."

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: We currently use the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool ("FFIEC CAT") to help us identify our cybersecurity risks and determine our cybersecurity preparedness. This assessment tool incorporates regulatory guidance as well as concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. The results of the assessment are used to determine risk management practices and controls in order to align our cybersecurity preparedness to address the identified risks within our risk appetite. We engage a third-party to provide an annual risk assessment of our compliance with interagency guidelines for safeguarding confidential customer information. This risk assessment focuses on our information security program and the controls in place to protect client information. The results of the risk assessment are analyzed and used to improve our information security program where needed. Internal audits, regulatory examinations and third-party assessments of our processes in information technology and information security also help us assess our cybersecurity preparedness and whether risk management practices and controls need adjustment. Risk issues are identified through assessments, audits, examinations and security testing. Findings are tracked and reported to the Bank's Technology Committee, and the Audit Committee of the Board of Directors. The FFIEC CAT will sunset in Fall 2025. We are currently evaluating other assessment tools which will be implemented in 2026.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: In addition, we have implemented a third-party risk management program to assess our vendors' ability to adequately protect information, which includes requiring agreements with our vendors that address cybersecurity. We periodically review and assess certain third parties' adherence to these agreements and review for information security (including cybersecurity) incidents experienced by our third-party vendors.

companyName: GLOBE LIFE INC.

ticker: GL


text: Our CISO, executive management team, Service Center Board, and SCC evaluate the type and severity of the incident, review applicable legal and regulatory requirements for disclosing cybersecurity incidents, and determine whether, when, and to whom the incident must be reported.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Leidos CSIRT owns the incident response process and provides direction and guidance to users of Leidos computing resources when responding to cybersecurity incidents. Leidos CSIRT also provides intrusion monitoring of networks and information systems and continuously monitors the Leidos computing environments and performs triage and analysis of events to identify potential incidents.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: We have policies and procedures for identifying, assessing, and managing material risks associated with cybersecurity threats. We seek to address cybersecurity risks through a comprehensive approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third party information technology vendor), the use of a third party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan. We also maintain cybersecurity insurance that provides for certain protection against potential losses arising from a cybersecurity incident.

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: At the management level, our VP leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: The Enterprise Information Security Risk Assessment quantifies risk criteria utilizing the same impact measures, including financial, strategic, operational, and reputational, set forth by the Enterprise Risk Committee. The risk assessment is reviewed and approved by the B oard of Directors annually. The Enterprise Risk Committee includes members of management from various departments and members of the Board of Directors and oversees the overall risk management of the Company. The Enterprise Risk Committee meets as often as appropriate to perform its responsibilities, but no less than once per calendar quarter and reports findings and provides recommendations to the Board of Directors on a routine basis.

companyName: Investar Holding Corp

ticker: ISTR


text: Our Board considers cybersecurity risk as critical and delegates cybersecurity risk oversight to the Audit Committee. Our CTO and Senior leadership, as part of our enterprise risk assessments, thoroughly evaluates our cybersecurity program, risks and corresponding mitigations, and reports to the Audit Committee, at least annually.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: We place the utmost importance on the security of our systems and the data we handle. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: The Company's Networking department, which reports up to the CIO, is responsible for the day-to-day monitoring of cybersecurity risks. Mitigation efforts are executed, if necessary, to cope with the impact of a cybersecurity incident. The Company is finalizing its Cybersecurity Incident Response Plan and anticipates it being available in early April 2024. We anticipate it will provide a framework for the identification, evaluation, and escalation of potential cybersecurity events.

companyName: ICC Holdings, Inc.


text: Enterprise Risk Management Our cybersecurity risk processes are a key element of our Enterprise Risk Management (ERM) process, which is designed to identify and evaluate the full range of significant risks to RTX. As part of our ERM program, RTX's functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning, and includes risks identified by our Enterprise Cybersecurity and Product Cybersecurity functions as part of the overall review of significant risks to RTX. The top ERM risks are compiled annually and shared with the Audit Committee of the Board of Directors as well as the full Board of Directors. In addition, Internal Audit incorporates these risks into its continuous risk assessment process and periodically audits specific ERM risks.

companyName: RTX Corp

ticker: RTX


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenge and recommendations for improvement.

companyName: US BANCORP \DE\

ticker: USB


text: Management's Role in Assessing and Managing Cybersecurity Risk BBSI's Chief Information Security Officer ("CISO") leads our enterprise information security program and is primarily responsible for the assessment and management of the Company's cybersecurity risk. The CISO has extensive experience in information technology and cybersecurity, including at another publicly traded company. The CISO oversees our cybersecurity risk management framework and manages a team of IT security professionals to identify and prioritize cybersecurity risks. The CISO also utilizes the expertise of third-party security partners to provide threat detection support, vulnerability management, incident response, penetration testing, and consulting services.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including " We rely on information technology in our operations, and any material failure, inadequacy, interruption, or security failure of that technology could harm our business," for additional discussion about cybersecurity-related risks.

companyName: Clean Energy Fuels Corp.

ticker: CLNE


text: We have implemented a variety of measures to assess, identify and manage material risks from cybersecurity threats. These measures include automated source code testing to help align our security infrastructure with application security best practices, and automated scanning and alerts to assess compliance against established security baselines. Our cybersecurity risk management process also includes defined timeframes for addressing vulnerabilities or other gaps identified by our automated detection and scanning tools. We also perform an annual evaluation of our alignment with the U.S. Commerce Department's National Institute of Standards and Technology framework. In addition, our Information Security team, which reports directly to our Chief Information Officer ("CIO"), performs regular internal vulnerability scans across our information technology systems, and we use an independent third-party service provider for the completion of bi-annual penetration testing to maintain our SOC II compliance.

companyName: Open Lending Corp

ticker: LPRO


text: Longer term cybersecurity risk management strategic planning is addressed by the Company's management Cybersecurity Committee, which is comprised of the Director of Cybersecurity and members from various departments within the Company, including Legal, Operations and Internal Audit. The Cybersecurity Committee meets quarterly to review cybersecurity threats and risks, strategic objectives, and progress on the Company's cybersecurity initiatives.

companyName: SSR MINING INC.

ticker: SSRM


text: The Audit Committee oversees our information security program, which includes oversight of our cybersecurity program and cybersecurity risks. As part of its oversight responsibility, and pursuant to its charter, the Audit Committee reviews with management and reports to the full Board with respect to significant information security matters and risks and management's actions to monitor and address identified issues. The Internal Audit team meets monthly with the VP, Information Security and Compliance officer along with key IT leadership to discuss open cyber or data security risks. This effort is to ensure items of risk are addressed and resolved in a timely manner. The Audit Committee receives updates from the Company's Chief Insights and Technology Officer ("CITO"), VP, Information Security and Compliance, and/or members of our executive leadership team. Management also reports to the full Board at least annually regarding a comprehensive overview and status of the Company's information security program. The Audit Committee is also apprised of cybersecurity incidents consistent with the provisions of our cybersecurity incident response plan ("IRP") pertaining to escalation of more significant incidents.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: We continue to strengthen our cybersecurity measures to safeguard our information systems based on industry standards. Our measures include policies to promote internal compliance by our employees, policies and procedures to regularly evaluate the security of our information systems and implementation of third-party products, including intrusion prevention and detection solutions, multifactor identification and anti-virus software, to help detect and protect against potential cybersecurity threats. We educate our staff on cybersecurity matters with periodic risk awareness information, phishing awareness campaigns, and training materials. Moreover, given the rapid growth of our global operations in 2023 due to the Ibeo acquisition, and our expectations for near- and long-term strategic growth, our Information Technology, or IT, team is prioritizing enhancements to our response system and continuity plans.

companyName: MICROVISION, INC.

ticker: MVIS


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization. In addition, there have been reports of other water utility companies being subjected to such attacks, resulting in widespread operational outages.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: The third-party services include testing both the design and operational effectiveness of security controls. This dependence exposes us, along with others who use such service providers, to the impact of a cyber-attack on their service providers. It is possible for a cyber-attack at a third-party service provider to have a significant financial, operational, or reputational impact to us. To reduce the effective impact to us of a cyber-attack on a third-party service provider, we intend to monitor the risks associated with our service providers through periodic review of these providers' cybersecurity programs.

companyName: Modular Medical, Inc.

ticker: MODD


text: The Board has oversight of cybersecurity risks and bears the primary responsibility for this domain. The members of our Board do not have experience in enterprise risk management, compliance, corporate governance, technology, or finance to equipping them to oversee cybersecurity risks effectively.

companyName: GOLDENWELL BIOTECH, INC.

ticker: GWLL


text: The Company has a dedicated Security Forum and a Data Protection Committee comprising members from our senior leadership that convene on a regular basis to receive updates from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel about the Cybersecurity & Privacy programs we have in place; discuss and assess material risks and planned risk mitigation, incidents and planned remediation efforts, trends observed, consider cybersecurity-related proposals, and review and adopt changes in cybersecurity policies.

companyName: Bally's Corp

ticker: BALY


text: We have policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Rise Gold Corp.

ticker: RYES


text: Technological Tools Chubb uses information security tools designed to protect information and systems. Our Information Security team regularly monitors these tools to discover and respond promptly to anomalous and suspicious patterns. We also participate in information sharing networks (government and private) and deploy system updates and other technologies.

companyName: Chubb Ltd

ticker: CB


text: There are a number of components of our risk management program. We leverage external third parties for security testing on an annual basis, including penetration testing. We consistently monitor critical risks from cybersecurity threats using automated tools and have a process to implement mitigation plans. Our Security Committee, headed by the Head of IT and Chief Legal Counsel, assess and monitor any identified security incidents that impact us or our external partners. Furthermore, we assess and review the cybersecurity practices of third parties who have access to our systems and/or process our sensitive information. This assessment may involve requesting Systems and Organization Controls Type 2 reports (SOC2 reports), conversations with our Head of IT, and the inclusion of contractual requirements to maintain data protection safeguards and timely notification if the third party experiences a security incident which may have a critical impact on our business or our data. Additionally, we conduct cybersecurity awareness training for employees during onboarding and throughout the year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other cybersecurity threats.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Cybersecurity Risks, Threats and Material Incidents While we are not aware of any cybersecurity incidents that have materially affected us through the date of this report, there can be no guarantee that we will not be the subject of future material cybersecurity incidents. Additional information on cybersecurity risks that we may face can be found in Item 1A – Risk Factors – of this Form 10-K.

companyName: AECOM

ticker: ACM


text: Oversight of Third-Party Service Providers The Company's processes also are designed to evaluate the cybersecurity threat risks associated with its use of third-party service providers that have applicable levels of access to the Company's data or information technology systems. The Company performs due diligence on third parties that have access to its systems, data, or facilities that house such systems or data, and it monitors cybersecurity threat risks identified through such due diligence.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Our Board of Directors and our Audit Committee each receive annual presentations and reports from our Director of Information Technology on developments in the cybersecurity space, including risk management practices, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. In addition, on an annual basis, our Board of Directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with our Director of Information Technology and other members of senior management to better assess our approach to cyber threats.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: Crexendo relies on several third-party vendors and contractors in order to provide products and services to its customers as well as to augment the resource pool. On an annual basis, all significant third-party vendors and subservice organizations are assessed for any applicable cybersecurity or service availability risks. Vendors and contractors with access to sensitive data and/or information are expected to meet certain information security requirements.

companyName: Crexendo, Inc.

ticker: CXDO


text: Our cybersecurity policies, standards, processes, and practices are designed to provide reasonable information security given the integrated nature of our organization, our third-party relationships, and the geographic regions we operate in. With this multi-layered approach, we aim to mitigate cybersecurity vulnerabilities across all aspects of our operations. Our approach to cybersecurity is grounded in the NIST Cybersecurity Framework v2.0, a nationally recognized and adaptable model that aligns with our goals, and addresses the following key areas:

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Our vendor risk management practices are robust and include comprehensive risk assessments of suppliers, with a strong emphasis on cybersecurity. We use commercially available services to monitor our vendors, providing security scores for supplier technology services, threat intelligence, financial intelligence, and other cybersecurity-related considerations. Regular reviews are conducted to track changes in our vendors' cybersecurity risk posture, and continuous threat intelligence monitoring helps identify potential cybersecurity incidents involving third parties. We also strive to negotiate appropriate cybersecurity provisions in our vendor contracts.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Refer to the discussion of risks and uncertainties associated with cyber-attacks or incidents in this report under "Item 1A. Risk Factors." We are not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition.

companyName: ITC Holdings Corp.


text: There can be no assurance that our and our third-party service providers', strategic partners', contractors', consultants', and collaborators' cybersecurity risk management program and processes, including policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our systems and information.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: We are an externally managed company and our day-to-day operations are managed by our New Manager and our officers under the oversight of our Board of Directors. We are reliant on our New Manger, in identifying, assessing and managing material risks to our business from cybersecurity threats.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Our IT Security Team is composed of several support teams (including our IT Site Managers, our Cybersecurity Incident Managers, our Global Information Security Team, and our IT Risk and Compliance Team) that address and respond to cybersecurity risks and incidents, including risks related to security architecture and engineering, identity and access management and security operations. As noted above, our IT Security Team is led by our VP Security, who has 15 years of experience in leading global security and compliance functions and strategies and holds several certifications including Certified Information Systems Security Professional (CISSP), Information Systems Security Management Professional (ISSMP), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), and Certified Information Security Manager (CISM). Our CIO has 20 years of experience in leading security, compliance and digital forensics functions. Collectively, the other members of our IT Security Team have decades of relevant education and experience and maintain a wide range of industry certifications. In addition, we invest in regular, ongoing cybersecurity training for our IT Security Team. Risks are updated by management each quarter, based on findings from external assessments and internal cybersecurity metrics.

companyName: CELESTICA INC

ticker: CLS


text: Our management is responsible for identifying, assessing, and managing our exposure to risk. The Board of Directors plays an active role in overseeing management's activities regarding risk management in part through its various committees based on each committee's responsibilities and expertise. The Board has delegated to the Technology and Operations Committee (the "Committee") oversight of the Company's Information Technology Department and risks arising from technology and operations, including information security, fraud, vendor, data protection and privacy, business continuity and resilience and cybersecurity risks.

companyName: StoneX Group Inc.

ticker: SNEX


text: The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our cybersecurity risk management is included within our overall enterprise risk management program.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Our management team relies on our third-party providers to administer cybersecurity assessments and to identify, manage, mitigate, and respond to cybersecurity threats. Management of the cybersecurity environment also includes patch management, and a managed network, security, and 24/7 support. Management updates the Board as necessary, regarding any significant cybersecurity occurrences. Pismo Coast Village is not aware of any material cybersecurity incidents in the 2025 fiscal year.

companyName: PISMO COAST VILLAGE INC


text: The Board of Directors, with the assistance of the Audit Committee, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our COO. The Board also receives updates from the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: NextCure, Inc.

ticker: NXTC


text: Engagement with Third-Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, helping our cybersecurity strategies and processes remain consistent with applicable generally adopted industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and penetration testing; consultation on security enhancements; bug bounty program for identifying security weaknesses in our products and services; designing partnership with third party vendors; using our inhouse security tools as customers; and global incident response experts for potential critical cybersecurity events.

companyName: JFrog Ltd

ticker: FROG


text: The Company engages in the periodic assessment and testing of its policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of the Company's cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on its cybersecurity measures, including information security maturity assessments and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and reviews.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: In October 2024, the Company hired a new CISO who is a Certified Information Systems Security Professional with over 12 years in banking experience with a background in cybersecurity, information security, and network administration. The former CISO, who has over 18 years of banking experience, is a Certified Information Systems Security Professional, and has been involved with the management of information and cybersecurity for over ten years, was promoted to the Chief Risk Officer role in October 2024. The CISO regularly reports to the Board Technology & Information Security Committee on information and cybersecurity strategy, testing, training, policies, procedures, cybersecurity insurance, and overall effectiveness of the Information Security Program and would report and discuss material incidents, and ongoing mitigation status, if any should occur. The CISO is the chair of Management's Information Security Committee that meets on a monthly basis to evaluate threats, incidents, defense system effectiveness, accepted risks, results of third-party cyber assessments and engagements, and the overall adequacy of the cybersecurity program. In addition, the Chief Information Officer has over 15 years of experience in managing bank technologies, information security, and risk management, and collaborates in supporting the Information Security Program. The CISO reports directly to the Chief Risk Officer and meets on a monthly basis with the Executive Management team to discuss cybersecurity risk management matters.

companyName: ENTERPRISE BANCORP INC /MA/


text: Accordingly, we work with third party providers to assess the environment to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on the risk assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: GTJ REIT, INC.


text: Our digital and cybersecurity controls are augmented with physical controls such as security systems, security site plans, security systems monitoring, and access control to mitigate physical security risks at our facilities. Our procurement policies and organizational controls require certain vendors to be assessed and vetted, with enhanced protocols on purchases and installations involving nuclear equipment. Additionally, cybersecurity reviews are performed on critical intellectual property vendors. Additionally, where warranted, we request a detailed cybersecurity questionnaire from our vendors to assess the vendor's practices and preparedness in addressing cyber threats.

companyName: Talen Energy Corp

ticker: TLN


text: Our risk management program for third-party service providers includes risk-based assessments of their interactions with our data and systems. We implement monitoring and response processes for key third-party service providers.

companyName: IPALCO ENTERPRISES, INC.


text: Our board of directors takes an active and informed role in our risk management policies and strategies. Our executive officers, which are responsible for our day-to-day risk management practices, present to the board of directors on the material risks to our Company, including risks related to information technology and cybersecurity.

companyName: AGREE REALTY CORP

ticker: ADC


text: The Director of Information Technology oversees risk management and strategy through (i) an IT operating committee ("the IT Operating Committee") made up of the Director of Information Technology, the CISO, and the Company's department heads, which is responsible for the establishment and review of the Company's IT governance, risk management and compliance, and (ii) an IT steering committee (the "IT Steering Committee") made up of the Company's executives, which provides guidance and oversight to support and achieve TPL's IT objectives, including cybersecurity. Both the IT Operating Committee and the IT Steering Committee meet on a quarterly basis. The IT Operating Committee reviews monthly reports on cybersecurity incident prevention, mitigation, detection, and remediation and reviews the Company's plans and policies related to IT processes on an annual basis. The Director of Information Technology also coordinates with the Company's internal audit department and the Audit Committee to ensure cybersecurity is represented and addressed within the Company's enterprise risk management strategy.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Our Senior Vice President of Corporate Services & Chief Risk Officer ( SVP & CRO), who reports directly to our Chairman, President & CEO leads a team that is responsible for managing our enterprise-wide information security strategy, policy, standards, architecture, and processes, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The team is also responsible for overseeing any third-party firms used as part of our information security strategy. Our SVP & CRO holds a Master's Degree in Business Administration and a Bachelor's Degree in Management Information Systems, has over 25 years of information and operational technology experience, is a certified Project Management Professional, and is a Certified Information Security Manager from the Information Systems Audit and Control Association. He served for one year as the President of the Bay Area InfraGard chapter and four years on its Board. InfraGard is a collaboration between the Federal Bureau of Investigation (FBI) and members of the private sector that promotes the protection of U.S. critical infrastructure and enables the exchange of important information. Our Director of IT Security and Chief Information Security Officer (CISO), who reports to the SVP & CRO, has over 25 years of information technology and 15 years of cybersecurity experience and holds a Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Our cybersecurity governance framework is designed to manage cybersecurity risks at all levels of the organization. As part of this governance framework, our Board of Directors regularly devotes time during its meetings to review and discuss the most significant risks facing the Company, including cybersecurity threats, and management's process for identifying, prioritizing, and responding to them. The Audit Committee of the Board of Directors assists the Board in overseeing the significant risk exposures facing the Company and regularly reviews cybersecurity risks at its committee meetings. Cybersecurity risks are integrated into the broader company risk management system through our Information Security and Privacy Committee ("ISPC"), which is a subcommittee of our Enterprise Risk Committee (the "ERC"), is co-chaired by the Chief Information Security Officer and Chief Privacy Officer, and consists of senior leaders across the company. The ISPC is charged with oversight, advisory, and decision-making responsibilities with respect to information security and privacy risks. Management, including the ERC, is responsible for communicating cybersecurity risks to the Audit Committee and Board of Directors. Our cybersecurity program, led by our Chief Information Security Officer, who reports to our Chief Risk and Compliance Officer, has a team of dedicated, experienced cybersecurity professionals responsible for day-to-day security operations and strategic cybersecurity programs. The Chief Information Security Officer has over 20 years of experience in security risk management, with over 10 years of experience leading cybersecurity teams. All employees are responsible for protecting Western Union's data and systems and are required to follow Western Union's cybersecurity policies.

companyName: Western Union CO

ticker: WU


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives, as necessary, briefings from management on our cybersecurity risk management program and receive presentations on cybersecurity topics from IT leadership, which includes our Chief Sustainability and Administrative Officer ("CSAO"), or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: The governance structure for the Global Cybersecurity and Technology Controls organization is designed to appropriately identify, escalate and mitigate information security risks, including through the use of key governance forums that inform management concerning the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management ("ERM") approach, which is subject to oversight by our Board.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Oversight of Third-Party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Nucor in certain circumstances. In response, we have implemented processes for overseeing and managing these risks. Those processes include limiting the exposure of our information systems to external systems to the least practicable amount, assessing the third parties' information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements. We also utilize third-party risk and compliance monitoring services to monitor our service providers, suppliers, and vendors and to augment the effectiveness of our risk mitigation efforts in this area.

companyName: NUCOR CORP

ticker: NUE


text: Our CISO, who reports to our Executive Vice President and Chief Technology Officer, has 25 years of cybersecurity and information security experience across a number of regulated industries, including financial services, healthcare and defense and national security. Our CISO has been a Certified Information System Security Professional (CISSP) for over 20 years and serves on the governing body of various organizations focused on technology and cybersecurity, including as an Advisory Council Member to the Harvard Business Review and a Governing Board Member of Evanta, an organization of peer-CISOs. Each of our CRO (who reports to our Chief Executive Officer) and CORO (who reports to our CRO) has over 20 years of financial services experience in operations and risk management.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee which reports on its risk management activities, including risks arising from cybersecurity threats, to the full Board. The Company's Vice President of Information Security and Privacy reports to the Audit Committee on an annual basis. In addition, the Audit Committee receives quarterly updates as part of the disclosure control process and updates, as needed, for significant issues.

companyName: Graham Holdings Co

ticker: GHC


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A. Risk Factors.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: We use a risk-based approach with respect to our use and oversight of third-party IT service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party IT service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party IT service providers, including conducting due diligence in connection with onboarding new IT service providers and, where appropriate, annual due diligence of such third-party IT service providers. We also collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our IT contracts where applicable as part of our oversight of third-party IT service providers. Because most of our critical IT systems are cloud-based and hosted by third-party IT service provides, we are dependent on the security controls of such vendors.

companyName: OptiNose, Inc.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time employees, with a data protection, cybersecurity, and incident response and prevention training program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.

companyName: CarGurus, Inc.

ticker: CARG


text: To help bring risks from cybersecurity threats within an acceptable risk appetite and tolerance level, we created a cybersecurity strategy and associated program of necessary activities. The program mitigates the risks through the effective design and implementation of compensating controls or remediation actions, commensurate with the assessed risk level from such threats.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Ginkgo's CISO has primary responsibility for assessing and managing Ginkgo's risks from cybersecurity threats. The CISO has over 20 years of public and private-sector experience in information technology and has served as Ginkgo's CISO since 2018. Executive leadership provides oversight and governance through monthly business reviews of the cybersecurity program.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any material cybersecurity incidents since our IPO.

companyName: Israel Acquisitions Corp

ticker: ISRLF


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Palladyne AI Corp.

ticker: PDYN


text: We leverage people, processes, and technology to manage and maintain cybersecurity controls. We employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.

companyName: ENB Financial Corp

ticker: ENBP


text: Network and endpoint protection: Utilizing firewalls, intrusion detection systems, antivirus software, and advanced encryption protocols to safeguard sensitive data and systems.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: The program is managed by our executive management team, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.

companyName: XCel Brands, Inc.

ticker: XELB


text: We rely on the Investment Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We rely on the Investment Advisor's risk management program and processes, which include cyber risk assessments.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: bConducting regular cybersecurity awareness training for all employees, contractors, interns, and any user with access to Company systems to increase the preparedness and awareness of risks and procedures.

companyName: IREN Ltd

ticker: IREN


text: Operational Risk Management and Strategy Identifying, assessing and managing material risks from cybersecurity threats is a core component of our overall operational risk management. LNC's Information Security team is the primary group responsible for cybersecurity and consists of four divisions with specific mandates: • The security engineering division, which leads our "security by design" efforts to help ensure cybersecurity considerations are taken into account in our applications, cloud architecture and infrastructure; • The governance, risk and compliance division, which includes responsibility for developing cybersecurity-related policies and procedures, training and supplier security review; • The cybersecurity response and investigations ("CSRI") division; and • The identity access management division, which is responsible for managing access to our data and technology infrastructure.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: Also, as part of the program, we periodically conduct cybersecurity awareness training including phishing simulations as well as e-learning for employees. We maintain cybersecurity policies, standards, and procedures, which include a cyber incident response plan. These policies and procedures are regularly evaluated and refined with strategies and protocols designed to adapt to changing regulations and emerging security risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities and improve decision-making, prioritization, monitoring, and overall response effectiveness. As part of our incident response plan, the Cybersecurity Team uses an established protocol to assess the severity of cybersecurity incidents. In addition, a cross-functional Cybersecurity Incident Response Team is responsible for cybersecurity incident oversight and response, as needed, depending on incident severity. Our cyber incident response plan also includes an escalation process to relevant senior management and/or members of the Board if a cybersecurity incident meets specific rating criteria to prompt response to attempt to minimize potential disruptions and protect the integrity of our operations.

companyName: DEERE JOHN CAPITAL CORP


text: We use third-party service providers to perform a variety of functions throughout our business, such as internet hosting companies, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with any particular provider.

companyName: EMERSON RADIO CORP

ticker: MSN


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level " S1-Critical," "S2-Moderate," or "S3-Low" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the CRO and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the CRO or ISO will engage the Company's designated Breach Coach to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, legal, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.

companyName: COMMUNITY WEST BANCSHARES /


text: We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our day-to-day cybersecurity work is led by our CIO and Head of Infrastructure. Both are highly experienced professionals. This group works closely with our executive management to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our cyber risk management and information security strategy includes elements to identify threats, assess risks, implement protective controls, detect attempts from threat actors to compromise the confidentiality, integrity, and availability of information and information systems, respond to those events and ultimately recover from incidents. We use a threat-based approach to identify and assess cyber risks. This approach includes membership in threat intelligence organizations such as the FS-ISAC (Financial Services Information Sharing and Analysis Center) to identify standard and emerging cyber-threats to financial services organizations and specifically to insurance companies. We also monitor for threats through vendor alerts, manufacturer bulletins, and government advisories.

companyName: GLOBE LIFE INC.

ticker: GL


text: To date, the Company has been subject to cyber related incidents, as previously disclosed in the Company's Quarterly Report for the quarters ended June 30, 2023 and September 30, 2023 and within this Annual Report. Since the identification of these incidents, we have implemented additional safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: Fidelity and its Enterprise Cybersecurity organization, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its shareholders. The Fund does not currently have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Private Credit Co LLC


text: Cognizant's cybersecurity risk management program is guided by industry-recognized security frameworks, including ISO/IEC 27001, TISAX and NIST. The program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: For additional information about the risks from cybersecurity threats that may materially affect us and how they may do so, see the section entitled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: The Company's operations rely on the secure processing, storage, and transmission of confidential and personal identifiable information within various technology platforms. Cybersecurity is a high priority and the Company has made significant investments in its processes and programs designed to prevent, detect, and respond to and recover from cybersecurity threats. We also have processes in place to help ensure compliance with our information security program with respect to our use of third-party service providers. Such processes and programs are a part of the Company's overall risk management and compliance programs. The Company continues to enhance its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring. The Company has also installed advanced endpoint threat protection technology and implemented a mandatory security awareness training program for all employees. This training is reinforced through periodic simulated phishing tests to assess our employees' responses to suspicious emails.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: We engage in annual corporate-wide internal and external facing penetration tests, employing a battery of hacking tools to map out our assets and to assess vulnerabilities that could be exploited. In addition, we also extend such testing to newly acquired companies and assets as part of the integration process. This penetration testing is performed by a third party and is used to evaluate our current posture towards cybersecurity threats and to make adjustments, as needed, to protect our systems. The results are reviewed with the executive leadership team and the Company's ESG Committee of the Board of Directors.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: The Company's Vice President of Information Technology and Director of Information Security, in coordination with the Security Advisory Board and Cybersecurity Incident Response Team, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Vice President of Information Technology and Director of Information Security, in coordination with the Security Advisory Board and Cybersecurity Incident Response Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Kroger Cyber Incident Response Plan The IR Plan documents the processes by which information security events are detected, identified, prioritized, and analyzed. The Kroger iSOC, CISO, legal counsel, and corporate affairs stakeholders are then engaged depending on the incident's scope, business effect, and potential material risk. This cross-functional team is responsible for assessing an appropriate response and mitigation pathway. Once security events are identified through the enterprise detection and monitoring ecosystem, the IR Plan sets forth an incident prioritization/decision workflow to determine scope, business effect, and potential material risk. This workflow is implemented through collaboration with the iSOC, CISO, legal counsel, and corporate affairs stakeholders and correlates to industry standard severity levels. In addition to the processes outlined above, we have also implemented an information security training program for employees that includes security awareness training related to cyber security risks, simulated phishing emails and regular communication to the enterprise regarding cyber security risks.

companyName: KROGER CO

ticker: KR


text: Our Chief Technology Officer, together with our SVP of Information Technology and Security, leads, manages and monitors the Company's cybersecurity risk and has over 40 years of experience in the technology field. The SVP of Information Technology and Security has over 30 years of experience in the IT and information security field and directs our Cumulus Security Team, which is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: On a bi-annual schedule, we use an external firm to assess our cybersecurity risk management program using the Capability Maturity Model Integration (CMMI) process and behavioral model. In addition, elements of the program are subject to Service Organization Control Type 2 (SOC 2) and ISO 27001 audits by a third party.

companyName: CENTENE CORP

ticker: CNC


text: Our CSO seeks to regularly obtain information about relevant developments in cybersecurity, including potential threats and risk management techniques to help shape our approach to preventing, detecting, mitigating, and remediating cybersecurity threats. Our CSO is also responsible for implementing and overseeing processes for regularly monitoring our information systems and data, including the conducting of periodic audits of certain systems to identify potential vulnerabilities. The CSO reports directly to the Chief Executive Officer and provides regular updates to our Chief Financial Officer, and CLO, on certain cybersecurity risks and incidents.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Concerning governance, oversight, and compliance, the Board of Directors plays an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank provides periodic reports to our Technology Committee and our Board of Directors, as well as to our senior management team as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: We continue to assess and improve the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are included as a party of our overall risk management governance which is reviewed yearly by our Board of Directors.

companyName: Kuvatris Therapeutics, Inc.


text: For additional information on our cybersecurity risks, see "Our business is subject to cyber security risks, including cyber security threats and cybersecurity incidents, such as security breaches and identity theft" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: QVC INC

ticker: QVCD


text: The Board and its committees oversee risk through regular reports from management. The Board's committees report on the matters discussed at the committee level to the full Board. The Risk Committee has primary responsibility for cybersecurity oversight. In that capacity, the Risk Committee receives quarterly presentations and reports, as well as additional reports as needed, on cybersecurity risks. Such reports address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established internal escalation thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: As a regulated financial institution, the Company must adhere to the security requirements and expectations of the applicable regulatory agencies, which include requirements related to cybersecurity, data privacy, vendor security risk management, systems availability, and business continuity planning, among others. The regulatory agencies have established responsibility guidelines for the Board of Directors and senior management, which include establishing policy, appointing and training personnel, implementing review and testing functions, and ensuring an appropriate frequency of reporting. The Company is examined annually, and its Information Security Program, policies and standards are designed to meet regulatory requirements and industry standards to implement physical, administrative, and technical controls to comply with the Gramm-Leach-Bliley Act ("GLBA"), Sarbanes-Oxley Act ("SOX") of 2002, and industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC").

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: The Company's cybersecurity efforts are led by the Chief Information Security Officer ("CISO"), who reports to the Chief Information Officer ("CIO") and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has proven cyber operations and cyber risk management experience, having previously worked for UK law enforcement and leading organizations in the financial services, health and advertising sectors. Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional. The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cyber security disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents. Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board ("IEB") and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee ("ISC").

companyName: Information Services Group Inc.

ticker: III


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect employee and third party, including patients, information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and enhance our practices. We have developed an incident response policy which is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. Internally and through a third-party service provider, we regularly conduct tests on our systems and incident simulations to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance coverage may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Verve Therapeutics, Inc.


text: The Audit and Finance Committee receives periodic updates from the Harley-Davidson CISO or his designee on our cybersecurity program, including industry trends, the current state of our business systems, and any current known risks or concerns related thereto. The Audit and Finance Committee is involved in reviewing our information security and technology risks, including with respect to cybersecurity and reports on such matters to the Board as necessary, and at least annually.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future. For additional information regarding the risk the Company faces from cybersecurity threats, please see the risk factors titled "We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers" and "We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action." included in Part I. Item 1A. – Risk Factors of this report.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: Terex maintains a variety of policies, plans and procedures that carefully detail the roles and responsibilities of those involved in monitoring, addressing and reporting any cybersecurity incidents, enabling Terex to respond efficiently and effectively, and to minimize any risks or impact to the business or customers. The VP Cybersecurity keeps members of senior management continually informed of any cybersecurity incidents, ensuring they are promptly and appropriately handled. The VP Cybersecurity also keeps the SVP Chief Digital Officer, Chief Executive Officer and other members of our senior management informed of the Company's overall cybersecurity posture and potential risks.

companyName: TEREX CORP

ticker: TEX