text: The cybersecurity program includes regular assessment on the effectiveness of the firm's risk mitigation strategies. Assessments include third-party validation to help ensure our internal controls and safeguards adhere to security and compliance standards. We annually undergo external examinations, such as Sarbanes-Oxley relating to financial reporting, System and Organization Controls (SOC) 1, and SOC 2 for key operational Business Units. In addition, we periodically engage with third-party partners to perform an independent evaluation of our cybersecurity program as well as external network penetration testing. This complements our internal assessments, such as application security testing, vulnerability management, and penetration testing. The firm participates in various industry threat intelligence information sharing forums to stay current on evolving cyber risks and threats. The results of these assessments are discussed with and reviewed by the Audit Committee, and shared with the Board, annually.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: The Board of Directors and management work together to manage cybersecurity risk as part of our broader enterprise risk management approach.

companyName: TYSON FOODS, INC.

ticker: TSN

secItem: Item 1C


text: Our information systems have been subject to cybersecurity incidents in the past, including the incident disclosed in February 2024 relating to certain exfiltrated data. The incident has not had a material impact on the Company's operations and, as previously disclosed, we do not believe that the incident is reasonably likely to materially impact our financial condition or results of operations. However, there is no guarantee that future cybersecurity incidents will not have a material impact. Despite our comprehensive approach to cybersecurity, we may not be able to prevent or mitigate a cybersecurity incident that could materially impact our business, results of operations, or financial condition. While we hold cybersecurity insurance, the expenses associated with cybersecurity threats or disruptions may not be completely covered by our policy. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.

companyName: Cencora, Inc.

ticker: COR


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results or operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we are not aware of any cybersecurity incidents through the date of this report that have materially affected us, there can be no guarantee that we will not be the subject of future material cybersecurity incidents. Additional information on cybersecurity risks we face can be found in Item 1A of this 10-K, which should be read in conjunction with the foregoing information.

companyName: FLUOR CORP

ticker: FLR


text: The audit committee receives reports from management on our cybersecurity risks at least annually. In addition, management updates the audit committee regarding all material cybersecurity incidents, as well as any incidents with lesser impact potential that management, in its discretion, determines may be relevant for audit committee review. The audit committee reports to the board of directors regarding its activities, including those related to cybersecurity.

companyName: Nuvalent, Inc.

ticker: NUVL


text: We maintain cybersecurity policies that apply to all employees, businesses and functions, as well as third-party vendors and contractors as required by our legal agreements with them. These policies specify roles and responsibilities, fundamental principles and proper controls required for Xylem's protection, and also require the use of certain cyber risk management processes to onboard new suppliers and other third parties. We periodically review our policies to identify potential gaps or areas for improvement, considering changes in the Company, and its connected products and services, as appropriate.

companyName: Xylem Inc.

ticker: XYL


text: The Head of Product and Operations is promptly informed of potential cybersecurity risks, threats, and vulnerabilities by any employees or consultants. Once an incident has been identified, the Head of Product and Operations and the security consulting team assess the criticality and impact of the incident on the Company's business operations.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Our Board, in coordination with the Audit Committee, oversees our risk management approach, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent expert reviews, the threat environment, technological trends, and any material risks identified with our third parties. The Audit Committee also receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents until they have been remediated. Our CIO, Audit Committee and Board review and discuss our approach to cybersecurity risk on an annual basis.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Highline partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise, including secure cloud storage solutions, firewalls and monitoring software. Highline engages with these partners and their technology to monitor and maintain the performance and effectiveness of its corporate information environment.

companyName: GPB Automotive Portfolio, LP


text: CNH's Board of Directors (the "CNH Board") addresses our cybersecurity risk management as part of its general oversight function. The CNH Audit Committee is responsible for overseeing our key risks and controls relating to information systems, including our assessment and mitigation of material risks from cybersecurity threats. The CNH Audit Committee receives periodic reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the CNH CIO and the CNH CISO. In addition, on at least an annual basis, the CNH Board receives reports, summaries or presentations from the CNH CIO and the CNH CISO related to cybersecurity threats, risk, mitigation and related processes.

companyName: CNH Industrial Capital LLC


text: While we have experienced threats to our data and systems, to date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. That said, a significant cybersecurity incident may materially impact the Company's business strategy, results of operations and financial condition in the future. For further information regarding cybersecurity risks to the Company, see Part 1, Item 1A, Risk Factors, "A disruption in, or the inability to successfully implement upgrades to, our information technology systems, including disruptions relating to cybersecurity as well as data privacy concerns, could adversely affect our business and financial performance."

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: The Information Technology and Legal departments are responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. The Senior Director of Information Technology, Senior Manager of Information Technology, and Assistant General Counsel are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: CHIMERIX INC


text: Adviser has established an internal working group that includes relevant representation from senior management including the CCO, CFO, and CISO, and CTO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO, CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.

companyName: Kayne DL 2021, Inc.


text: The Company engages with a range of external professionals, including cybersecurity experts, consultants, auditors, and legal counsel to leverage specialized knowledge, experience and insights, to help ensure our cybersecurity strategies and processes remain current. This includes: engaging third-party experts to periodically advise and train our Board and management regarding the structure and oversight of our cybersecurity program, Incident Response Plan ("IRP") and various cybersecurity-related matters;

companyName: MONRO, INC.

ticker: MNRO


text: We have a set of company-wide policies and procedures concerning cybersecurity matters that include security risk assessment, identity and access control, vendor security and network security. There are other policies related to cybersecurity involving employees' use of company equipment and resources, generative AI, remote work and workplace security and safety. These policies are reviewed periodically and approved by appropriate members of management.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors—Risks Related to Our Business and Industry—We rely heavily on our information technology systems, as well as those of our third-party vendors, business partners, and service providers, for our business to effectively operate and to safeguard confidential information; any significant failure, inadequacy, interruption, or cybersecurity incident could adversely affect our business, financial condition, and operations."

companyName: Warby Parker Inc.

ticker: WRBY


text: Despite our efforts, cyber attacks, unauthorized access or security breaches, or other cyber incidents such as computer viruses, malicious or destructive code, ransomware, social engineering attacks, hacking, denial-of-service attacks, and other similar attacks could materially affect us and disrupt our business. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. Potential consequences of a successful cyber attack or cybersecurity breaches or incidents could, however, include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues resulting from the unauthorized use of proprietary information or the failure to retain or attract customers following an attack, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. For more information about the cybersecurity risks we face, see the risk factor titled "We are significantly dependent on information technology and our business may suffer from disruptions associated with information technology, cyber-attacks or other catastrophic losses affecting our IT infrastructure" in Item 1A. Risk Factors.

companyName: ALAMO GROUP INC

ticker: ALG


text: Unresolved Staff Comments, Cybersecurity Related Matters, Legal Proceedings and Mine Safety Disclosures In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Partnership programs are discussed with the Board of Directors by the Chief Technology & Data Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Our team of cybersecurity professionals is led by our Global Chief Information Security Officer, who has over 20 years of experience in the cybersecurity space and has obtained professional security certifications and advanced training in the field of cybersecurity and technology. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: General Motors Financial Company, Inc.


text: The audit committee of our board of directors has primary responsibility for oversight of our information security program. Our cyber security program is managed by our third party IT service provider together with internal personnel. Our service provider and internal personnel work together to assess the environment, potential threats and responses.

companyName: Rallybio Corp

ticker: RLYB


text: Our Chief Information Officer, who has led our ITG since 1999, holds degrees in Cybersecurity Management and Policy and Information Management and is certified in various information security applications. The Head of our Cybersecurity and Privacy division has been with FTI since 2007 and has extensive experience in the cybersecurity field. The members of Cybersecurity & Privacy division have experience and education in cybersecurity, risk management, data assurance, and compliance. Among them they hold various certifications in information systems security and privacy. The practices and activities of our cybersecurity and information technology teams align with internationally accepted management frameworks.

companyName: FTI CONSULTING, INC

ticker: FCN


text: We also consider cybersecurity, along with our other top risks, within our enterprise risk management framework. This framework involves internal reporting at the business and enterprise levels, considering key risk indicators, trends and countermeasures. Our Senior Vice President, Chief Information Security Officer (CISO) serves on the Enterprise Risk Committee that assesses our enterprise-wide risks and oversees risk mitigation activities.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our board of directors oversees our Cybersecurity Policy primarily through the Audit Committee. The Audit Committee is responsible for the implementation of our oversight, programs, procedures and policies related to cybersecurity, cybersecurity risks, information security and data privacy, including reviewing our cybersecurity-related disclosures in our annual securities filings, monitoring (on an ongoing basis) the implementation and effectiveness of our Cybersecurity Policy and assessing potential risks to our Cyberspace and our risk exposure, resiliency of our processes, industry trends and best practices and any relevant cybersecurity and digital technology metrics.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Item 1.A – Risk Factors – Technology and Cybersecurity Risks," which disclosure is incorporated by reference herein.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "We are dependent on the efficient and uninterrupted operation of our information technology systems, and those systems, or those of our third-party service providers, may be impacted by security incidents, cyberattacks, loss of data and other disruptions, which could adversely impact our business."

companyName: BioAge Labs, Inc.

ticker: BIOA


text: Risks are managed based on their severity in relation to the established risk appetite. EQT has in place several risk-mitigating controls, blending preventative, detective, and reactive measures with an emphasis on identity verification, least privilege, micro-segmentation, and a strong security culture. To this foundation, EQT adds critical components like data protection endpoint security, secure configurations, advanced monitoring and threat detection, robust incident and business continuity plans for effective response. EQT continuously modifies its controls in line with its and our current risk landscape.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected nor, are they reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business see, "Part I. Item IA. Risk Factors - the occurrence of cyber-incidents, or a deficiency in our Manager's Cybersecurity or those of any of our third party service providers, could negatively affect our business by causing a disruption to our operations, a compromise of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations" in this Annual Report on Form 10-K.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: Our cybersecurity risk management program is overseen by our Board of Directors. As was the case with our CIO, members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.

companyName: UNIFIRST CORP

ticker: UNF


text: We have developed and implemented a cybersecurity framework designed to identify, detect, protect, respond to and recover from risks stemming from threats to the security of our information, systems and network using a governance-led risk-based approach. The framework is informed, in part, by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not necessarily mean that we meet all technical standards, specifications or requirements outlined in the NIST framework. Additionally, we maintain a Systems and Organization Controls (SOC) 2 Type 2 attestation.


text: We assess PepsiCo's Information Security program using an industry-leading cybersecurity framework from the National Institute of Standards and Technology. To help assess and identify our cybersecurity risks, we maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of PepsiCo's environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate human risk, including mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.

companyName: PEPSICO INC

ticker: PEP


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP"), designed to inform the proper escalation (including, as appropriate, to BREIT's senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by members of BXTI and Legal and Compliance.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: We have not experienced any material cybersecurity breaches or incidents to date, but we cannot guarantee that we will not suffer any such breaches or incidents in the future. We may not be able to detect, prevent, or respond to all cybersecurity risks and threats in a timely or effective manner. We may also incur significant costs and liabilities as a result of any cybersecurity breaches or incidents, such as legal claims, regulatory fines, remediation expenses, reputational damage, loss of business opportunities, or competitive disadvantage.

companyName: Mitesco, Inc.

ticker: MITI


text: The Company is not aware of any cybersecurity threat or any material cybersecurity incident to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: LA-Z-BOY INC

ticker: LZB


text: Framework for Identifying and Mitigating Threats: We follow a structured framework for identifying and mitigating cybersecurity threats, which outlines procedures for threat detection, incident response, and risk mitigation.

companyName: Jet.AI Inc.

ticker: JTAI


text: We have a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, which includes a cybersecurity Incident Response Plan ("IRP"). Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Extra Space Storage Inc.

ticker: EXR


text: The Board receives briefings from management and security and technological infrastructure team on enterprise-wide technology, cybersecurity risk management and the overall technology and cybersecurity environment by management. Specifically, the Board receives an Annual Security Information Report which details the plan for cybersecurity management, reviews the result of the implementation of threat control activities and conclusions for the period evaluated.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, refer to our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "An actual or perceived breach of the security of our systems, or those of third parties upon which we rely, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences."

companyName: Cardlytics, Inc.

ticker: CDLX


text: We do not currently have a Cybersecurity Incident Response Plan ("CSIRP") to provide the organizational and operational structure, processes, and procedures for investigating, containing, documenting and mitigating cybersecurity incidents. We expect to implement a risk-based approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: Cybersecurity protection and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud and violation of privacy or security laws.

companyName: FULLER H B CO

ticker: FUL


text: The Board provides oversight of Chevron's cybersecurity program, receives reports from management on cybersecurity risks in connection with Chevron's operations and projects, and also reviews cybersecurity risks as part of the company's broader annual ERM process. In support of the Board's oversight of the company's policies and processes with respect to risk management and the company's major financial risk exposures, including cybersecurity, the Audit Committee meets with Chevron's CISO and CIO at least twice a year to review cybersecurity risks and implications, including the results of independent third-party assessments. The CISO and CIO present cybersecurity matters to the Board of Directors at least annually. The CISO and CIO also provide new Board members with a cybersecurity briefing as part of the onboarding process.

companyName: CHEVRON CORP

ticker: CVX


text: The threat posed by cyberattacks and other cybersecurity incidents is significant, notwithstanding our prevention and mitigation systems and processes. To date, we have not experienced cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition. For additional discussion of risks from cybersecurity threats, see "Cyberattacks or other security breaches could have a material adverse effect on our business." in Item 1A., "Risk Factors."

companyName: Ameris Bancorp

ticker: ABCB


text: • Detection. Avanos has a formal framework consisting of people, processes and technologies dedicated to monitoring, detecting and responding all security events. We utilize multiple intrusion detection systems and processes. These include user access reviews to determine appropriate access to systems and data and a Security Identity and Event Management (SIEM) software solution, which consists of system logs with correlation logic to identify malicious activity. Logs and alerts cover the network, devices, applications and email. • Response. We have an incident response plan for cybersecurity incidents and conduct response planning with tabletop exercises. We have engaged a third party to assist with forensic investigations and expert support when needed. When a cybersecurity incident is identified by our IT Security Director and Security Team, our CIO and other members of our IT team are alerted. Incidents are classified by severity with predefined definitions, actions and notifications for each severity level. Incidents that are defined as medium, high or critical are reported the Chief Financial Officer, Principal Accounting Officer, General Counsel and CIO to determine materiality and associated public disclosure steps. For these incidents, we engage our third-party forensic partner to assist with containment, remediation and issuing a report on the incident. • Recovery. Our dedicated security operations team, defined incident response plan and third party forensic partner are employed to contain and recover from an incident. In addition, the IT organization conducts an annual disaster recovery exercise. Following an incident, the IT Security Team conducts a post-mortem to identify opportunities to improve our cybersecurity program. Any follow-up communications are provided as part of the recovery process.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Accordingly, we recognize the critical importance of maintaining the safety and security of these information systems and have implemented multiple layers of cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risk. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Efforts to assess, identify, and manage cybersecurity risk are led by our dedicated Chief Technology Officer ("CTO"), and supported by an experienced team, other members of management, and the Board. From time to time, we engage consultants, auditors, and other third parties to assist us in these efforts.

companyName: Torrid Holdings Inc.

ticker: CURV


text: To aide in identifying and assessing material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. As part of this process, the Company gathers input from subject matter specialists, as necessary, to gather insights to help in identifying and assessing material cybersecurity threat risks, as well as potential severity and mitigation measures. We also have a cybersecurity specific risk assessment process, which helps identify potential cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.

companyName: JUNIPER NETWORKS INC


text: Management of Cybersecurity Risk Our Cybersecurity Risk Management Processes Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents by escalating risks, issues, and key decisions to management, the Audit Committee, and our Board. Our program is designated to protect our products and services, confidential business information (including intellectual property), and employee and consumer data and includes steps for detecting and monitoring cybersecurity threats and incidents, assessing the severity of such threats or incidents, identifying the source of such threats or incidents, including whether such threats or incidents are associated with a third-party vendor or service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management, the Audit Committee, and our Board of potentially material cybersecurity threats and incidents. In addition, our cybersecurity team provides cybersecurity training to employees during the onboarding process and periodic basis thereafter, with specialized training and tabletop exercises for our core incident response teams and executive management on at least an annual basis.

companyName: Lucid Group, Inc.

ticker: LCID


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Security and Chief Information Officer. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: GM has a Cybersecurity Management Board that brings together representatives from senior management across the Company's Software & Services, Product Development, Information Technology, Manufacturing, Finance, Communications, Human Resources, Legal and Public Policy organizations to provide guidance and monitor overall company cybersecurity risk. The Company's cybersecurity maturity scorecard, cybersecurity threats and incident information are reviewed by the Company's Chief Information Security Officer (CISO), the Risk and Cybersecurity Committee of the Company's Board of Directors and the Cybersecurity Management Board during standing meetings as well as in impromptu sessions, when appropriate. During the reviews, various topics are discussed, which may include: • implementation and maturity of the Company's cybersecurity program, risk management framework, including cybersecurity risk policies, procedures and governance; • cybersecurity and privacy risk, including potential impact to the Company's employees, customers, supply chain, joint ventures and other stakeholders; • intelligence briefings on notable cyber events impacting the industry; and • cybersecurity budget and resource allocation, including industry benchmarking and economic modeling of various potential cybersecurity events.

companyName: General Motors Co

ticker: GM


text: During the year ended December 31, 2023, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: The Company's management team and board of directors jointly oversee the Company's cybersecurity. The third-party consultants provide monthly online security reports as well as any web-based security updates and possible threats to be aware of.

companyName: My City Builders, Inc.

ticker: MYCB


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards.

companyName: SeaStar Medical Holding Corp

ticker: ICU


text: We have processes in place to identify, assess and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of FS/EIG Advisor, as an affiliate of FS Investments. We also rely on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including us and our operations.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: Our cybersecurity risk management program includes processes that incorporate and utilize certain principles from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the COBIT 2019 Framework and the IT Infrastructure Library ("ITIL") Framework. The program aims to protect and preserve the security, availability, integrity, confidentiality, and privacy of our information systems and information residing on those systems and includes controls and procedures for the prevention, identification, containment, and remediation of cybersecurity threats through the use of various technologies, tools, policies, standards, and practices. Features of our cybersecurity risk management program include: • An expectation, set forth in our Code of Ethics, that all employees are responsible for protecting our data, operations and environment from unauthorized access and use; • Regular cybersecurity risk assessments and benchmarking; • Policies and processes related to the detection and reporting of and response to cybersecurity events; • Cybersecurity training for all newly hired employees upon onboarding; • Individualized, biannual employee information security assessments, coupled with tailored follow-on employee trainings; • Phishing tests conducted at least quarterly on a global basis, with additional periodic phishing tests conducted with high-risk employee groups; • Channels for employees to report suspicious emails or other activity and the actual or suspected loss, theft, improper use of or access to IDEXX systems or information; • Deployment and ongoing assessment of the effectiveness of technological tools aimed at preventing, detecting, and mitigating cybersecurity threats; • Policies and procedures to assess third-party service provider cybersecurity risks and security controls and measures (as part of our procurement process and periodically/regularly thereafter); • Performance of cybersecurity tabletop exercises; • Regular review of and, as applicable, updates to our cyber incident response plan and protocols, system backup measures, redundancy planning and disaster recovery plans; and • Maintenance of a cyber risk insurance policy to help address risk of loss due to certain types of cybersecurity events.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: We engage with experts to assist with regular third-party penetration testing to evaluate our program against industry standards. We also have standing engagements with incident response experts and external counsel to enhance our cybersecurity resilience. We frequently collaborate with cybersecurity experts to share insights on threats, best practices and emerging trends.

companyName: NORDSON CORP

ticker: NDSN


text: Our Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur. They will provide periodic briefings, as required, to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.

companyName: Sharplink, Inc.

ticker: SBET


text: SLB maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services.

companyName: SLB LIMITED/NV

ticker: SLB


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to the Company.

companyName: PACCAR INC

ticker: PCAR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Safehold Inc.

ticker: SAFE


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. Ensuring that changes to security configurations are documented, approved, and tested. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. Conducting subsequent penetration testing and vulnerability assessments, as warranted.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: Our team engages with external cybersecurity advisors and experts, including outside counsel and outside cybersecurity firms, assessors, auditors and consultants as necessary or appropriate. We also maintain numerous industry-related compliance certifications for various aspects of our business, such as International Organization for Standardization ("ISO") 27001, Service Organization Controls ("SOC 1, 2, 3") and Payment Card Industry ("PCI"), Federal Information Security Management Act ("FISMA"), Federal Risk and Authorization Management Program ("FedRAMP") and Health Information Trust Alliance ("HITRUST") in the U.S., Information Security Registered Assessors Program ("IRAP") in Australia and Public Services Network ("PSN") in the U.K.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks by way of updates shared during Cybersecurity Council meetings, as well as through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible under its committee charter for overseeing our company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Vital Farms, Inc.

ticker: VITL


text: Given the importance of information security to our customers, employees, suppliers and other partners, our Board and/or the Audit Committee receives reports as needed from our CIO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of higher severity cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our CIO and Cybersecurity Manager evaluate our cybersecurity readiness through a combination of internal assessment tools and third-party control tests, vulnerability assessments, audits, and alignment with industry standards. We maintain governance and compliance structures tailored to promptly escalate cybersecurity-related matters to our cybersecurity team, addressing potential threats or vulnerabilities. Incidents undergo evaluation based on their impact and potential materiality, followed by reporting to designated internal and external personnel in accordance with defined procedures. Moreover, we implement diverse defensive measures and continuous monitoring techniques, leveraging established industry frameworks and cybersecurity standards, including collaboration with third-party security operations centers.

companyName: Rocket Lab Corp

ticker: RKLB


text: While to date, we have not experienced cybersecurity events that were individually, or in the aggregate, material, we have developed a cyber-incident response playbook that sets forth our process for responding in the event of certain defined cyber incidents. Under our response protocols, following identification of such an incident, our CIO or other members of the information technology team would notify our executive team, which then would notify the Chairman of our Board of Trustees and assemble an Incident Management Team, comprised of certain defined management team members and external consultants, who collectively would assess and monitor the situation and manage internal and external communications.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board annually.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: As part of our assessment of the risks to our Company, the Information Security team conducts annual cybersecurity risk assessments to evaluate the inherent risk of our applications and the strength of our controls, and identify the residual risk for each application. In addition, we conduct regular reviews and testing of critical network and application systems to monitor their security. We have adopted internal Company-wide Information Technology and Information Security policies which are reviewed and updated annually and approved by our Board of Directors. Our employees and the Board of Directors attend annual trainings that are designed to raise awareness about cybersecurity threats, reduce our vulnerability, and encourage consideration of cybersecurity threats across the Company. Additional trainings are required for employees in certain roles; these additional trainings are tailored to the employees' specific duties.

companyName: UNION BANKSHARES INC

ticker: UNB


text: HMC Capital's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness training, including for all of the employees of our Sponsor and its affiliates. Our Sponsor undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Sponsor's and our critical third-party vendors and other partners. Our Sponsor also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: Our management team, including our Chief Executive Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants which may be engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.

companyName: Alset Inc.

ticker: AEI


text: Our Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives updates, as needed, on cybersecurity and information technology matters and related risk exposures.

companyName: PALISADE BIO, INC.

ticker: PALI


text: Risk management and strategy rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: Ondas Inc.

ticker: ONDS


text: The SVP, Chief Information Officer researches the latest technologies and trends used by cybercriminals through publications, conferences and discussions with peers. Cyber threats identified are communicated to all members of the Company via email to promote awareness and assist with protecting us from potential risks or breaches. All employees are required to undergo quarterly security awareness trainings and we routinely conduct internal phishing and other exercises to gauge the effectiveness of the trainings and assess the need for continued education and/or areas where improvement may be needed.

companyName: Urban Edge Properties

ticker: UE


text: Certain of our business partners also maintain data related to our trials and ongoing product development on servers they maintain. We require these partners to comply with all HIPAA standards for maintaining security of their systems where this data resides.

companyName: enVVeno Medical Corp

ticker: NVNO


text: the use of reputable cybersecurity consultants and other third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so the Company can maintain a posture of continual enhancement of our cybersecurity management and strategy;

companyName: CORNING INC /NY

ticker: GLW


text: The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. However, the Company could face risks from cybersecurity threats in the future that could have a material adverse effect on its business strategy, results of operations, or financial condition. For more information on the Company's cybersecurity-related risks, see Item 1A, Risk Factors of this Form 10-K.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of APA's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder.

companyName: APACHE CORP


text: Contractually, we require the ISP to annually provide us with a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between the Director of IT, our Adviser and Administrator, and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Our information security program is managed by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), who are responsible for assessing, monitoring and managing our cybersecurity risks. Our CIO has over 30 years of experience in the technology field, and our CISO has over 20 years of experience in the technology and cybersecurity fields, including over 10 years of experience as a CISO or Head of Information Security for various organizations.

companyName: RXO, Inc.

ticker: RXO


text: The VP of Security reports regularly to the CIO and the Security and Privacy Steering Committee. Further, the CIO provides regular reports to the Audit Committee and to the full Board. Reports include updates on our cyber risks and threats, projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our COO.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives presentations on cybersecurity issues and developments as needed. The Board also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting materiality thresholds, as well as ongoing updates regarding such incident until it has been addressed. The Company evaluates the materiality of a cybersecurity incident based on the overall impact of the event, which depends on a number of factors including, but not limited to, the financial impact of the incident and the type of information involved. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's President and Chief Executive Officer and General Counsel.

companyName: Farmland Partners Inc.

ticker: FPI


text: The Vice President of Information Technology, in coordination with executive leadership including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Human Resources Officer ("CHRO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Vice President of Information Technology monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: Key aspects of our cybersecurity risk management program include: • Risk assessments designed to identify risks to our systems and information; • An internal security team principally responsible for managing our cybersecurity risk assessment processes, response to cybersecurity incidents, and information technology security controls; • Engaging third-party service providers to assist with network, endpoint and cloud system monitoring; • Monitoring emerging data protection laws and implementing responsive changes to our processes; • Annual cybersecurity awareness training for employees and enhanced cybersecurity management and incident response training for employees involved in systems or processes that handle sensitive data; • Regular audits and tests of our information systems (including review and assessment by independent third-party advisors, who help identify areas for continued focus and improvement); • Regular phishing email simulations for employees and contractors with access to our email systems; • A third-party risk management process for service providers, suppliers and vendors, including those with access to our customer data, employee data, or our systems; and • A cybersecurity incident response plan that includes detailed procedures for responding to cybersecurity incidents, including processes to triage, assess severity, escalate, contain, investigate and remediate cybersecurity incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. In addition, we maintain insurance to protect against potential losses arising from cybersecurity incidents.

companyName: Stagwell Inc

ticker: STGW


text: Sixth Street employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: As a result of ongoing monitoring, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition, or results of operations. Notwithstanding the cybersecurity processes and procedures described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, or results of operations. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents, including information and security breaches, or other disruptions may not be fully insured. For further information regarding the risks to us associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect the Company, see the Risk Factor entitled, "Cybersecurity incidents or information or security breaches, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition, and results of operations."

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: Lumen's cybersecurity organization includes a response team and management level committees who support our processes to assess and manage cybersecurity risk as follows: • At the day-to-day operational level, Lumen maintains an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. Lumen generally seeks to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives, including regularly conducting phishing tests and holding employee trainings on our privacy, cybersecurity and information management policies, at least annually and more frequently when legal or other developments warrant. • The Technology, Security, and Privacy Council, co-chaired by the CSO, the Chief Information Officer (CIO), and the Chief Privacy Officer (CPO), leverages the combined expertise of various security, IT, legal, internal audit, and operational leaders across the company. This council provides a forum for these cross-functional members of management of our leadership team to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. Members of this council are responsible for reporting on cybersecurity and privacy risks to the Risk Oversight Committee ("ROC"). • The ROC, whose core members include our Chief Financial Officer, Chief Technology and Product Officer, Executive Vice President of Enterprise Operations, and Chief Legal Officer, oversees our company-wide risk mitigation strategies. With respect to cyber risks, the ROC's oversight function helps to ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by our Board of Directors and our senior leadership team. Some of the more significant risks discussed by the ROC are also reported to our Risk and Security Committee at least quarterly.

companyName: QWEST CORP

ticker: CTBB


text: We identify, assess, manage and mitigate cybersecurity risk through a risk management program based on the NIST Cybersecurity Framework that is regularly assessed by a third party cybersecurity consultant. As part of our processes, we perform routine scanning and have an established vulnerability management program and patching policy. We have in our learning management system a comprehensive cybersecurity awareness course that is mandatory for all employees with computers and covers key topics such as identifying workplace cybersecurity hazards and attacks, and our separate CyberSAFE and Data Privacy intranets provide content to help employees identify and avoid cybersecurity and data privacy risks. We also have data privacy educational tools, policies and procedures to help employees prevent, recognize and report data privacy incidents. We perform penetration tests and vulnerability and breach assessments with third-party advisors to support our compliance with laws and regulations including those applicable to chemical manufacturing sites. We also have a third-party risk management program with a formal approach to evaluating and managing risks associated with third-party information technology solutions and software. We maintain cyber/information security insurance to protect against certain expenses and liabilities that may be incurred in the event of an incident.

companyName: Celanese Corp

ticker: CE


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including, but not limited to, Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: BOX INC

ticker: BOX


text: To date, we have no t experienced any cybersecurity incidents that materially affected our business strategy, results of operations or financial condition.

companyName: Blue Star Foods Corp.

ticker: BSFC


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Multifactor authentication is required for all authorized users to access network resources which adds a second layer of protection from unauthorized entry to our systems.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: We rely on the representations and certifications of key partnerships with suppliers recognizing these third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for supplier selection and conduct security risk assessments to mitigate potential impacts on our business.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Our Board of Directors oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. Annually, the Board of Directors receives an update from our CFO and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, and notable incidents or events should they occur. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Amplitude, Inc.

ticker: AMPL


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, financial information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information and employee information. In an effort to protect this information from cybersecurity risks, we have developed a cybersecurity program which incorporates policies and practices designed to protect the confidentiality, integrity and security of our sensitive information.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Our formalized cybersecurity incident response plan is a framework to facilitate the detection, identification, containment, eradication and recovery from cybersecurity incidents. This framework addresses how and which risks impact our operational, financial or reputational standing and/or the ability to comply with regulatory or legal requirements. The incident response plan is evaluated and tested on an annual basis by management and independent third parties.

companyName: Globalstar, Inc.

ticker: GSAT


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of IT and Cybersecurity, to manage the risk assessment and mitigation process.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Global Gas Corp

ticker: HGAS


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's timely and effective response to a cybersecurity incident, and such plans are tested and evaluated on an annual basis. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Executive Response Team of the Company and as guided by the Company's Chief Risk Officer, to the Risk Committee when appropriate.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: The vCIO reports to our CFO. This vCIO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from other professionals in the industry, many of whom hold cybersecurity certifications, and through the use of technological tools and software and results from third-party audits.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors, consultants and service providers upon which we rely, or our data are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences."

companyName: ACELYRIN, Inc.


text: As part of our cybersecurity risk management program, we undertake ongoing cyber risk assessments as part of our efforts to detect, evaluate and respond to potential cybersecurity threats, including regular testing by our internal cyber operations team. We also engage third-party cybersecurity consultants to provide cybersecurity audits, targeted attack testing, cybersecurity threat intelligence and cybersecurity incident response services. We have also implemented a threat hunting program designed to seek out and identify potential cybersecurity threats in our systems. We require all employees and contractors to participate in cybersecurity training designed to enhance their understanding of cyber threats and their ability to identify and escalate potential incidents. Our vulnerability management program is designed to identify, assess, and remediate cybersecurity threats in our systems, such as through penetration testing.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Board Oversight of Cybersecurity Risks Diameter's Chief Compliance Officer, or a designee, reports to the Board periodically, and at least annually, an overview of the Adviser's cybersecurity structure and any material cyber incidents that occurred with respect to the Company or the Adviser since the last report. Diameter's Chief Compliance Officer may, in his or her discretion, update the Board regarding Diameter's cybersecurity program in addition to those periodic reports, including providing notice of material cybersecurity incidents that have occurred.

companyName: Diameter Credit Co


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the Head of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Equillium, Inc.

ticker: EQ


text: In addition, our cybersecurity risk management framework incorporates three lines of defense, each with defined roles and responsibilities. OFG conducts an annual cybersecurity maturity assessment to (a) evaluate its cybersecurity risk management practices and (b) develop action plans for improving its cybersecurity risk management program.

companyName: OFG BANCORP

ticker: OFG


text: We have established information designed to identify, assess, and manage cybersecurity risks that could impact our critical information systems and confidential data. Our information security team employs a variety of methods to identify and evaluate material risks from cybersecurity threats, including risk and control self-assessments, vulnerability assessments and penetration testing, breach and attack simulations, ransomware table-top assessments, cyber threat intelligence reviews, as well as internal and external cybersecurity assessments.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Cybersecurity threats pose a risk to the Company as crimes committed through or involving the internet. Examples of those threats are malware, phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into internal systems or the systems of third-party vendors that could adversely impact operations or damage reputations.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company's business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, or theft or tampering of intellectual property, any of which could materially adversely impact our business."

companyName: Rocket Lab Corp

ticker: RKLB


text: With the guidance of a qualified third -party that reports to and regularly meets with the Chief Executive Officer, we continue to make improvements in our cybersecurity program throughout our operating companies. We have established processes, consistent with nationally recognized frameworks, for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. Our prevention efforts are multi-faceted, and are intended to address threats to our employees, networks, applications and data.

companyName: CRAWFORD UNITED Corp


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the IT Governance Committee.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Bank maintains a chartered Technology Committee, which is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Committee is chaired by our Chief Technology Officer and members include two members from our Board of Directors, one independent Director and the President, the Information Security Officer, Chief Financial Officer, Chief Banking Officer, and officers of key business systems. The Information Security Officer reports the cyber security status of the Bank to our Board of Directors on a monthly basis. These reports include performance metrics, security events, penetration testing, training, audit results, new system and vulnerability assessments and the identification and remediation of cybersecurity risks. The Information Security Officer also provides information regarding the threat environment and our efforts to detect, prevent and respond to internal and external critical threats The Board of Directors, leveraging the efforts of the Technology Committee, oversees our continuing efforts to strengthen our information security infrastructure and staffing, adhere to regulatory guidelines and enhance our processes, technology controls and cybersecurity defenses. Our Information Security Officer regularly reports to the Board of Directors on security matters, our Risk Management Committee establishes and reviews key cyber risk indicators and performance metrics, and our Technology Committee assesses and disseminates periodic updates on information security risk, the maturity of our information security program, and related investments and results.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: The Company's Board of Directors and senior management are committed to continuously evaluating and upgrading our cybersecurity prevention, detection, and mitigation strategies in line with the evolution of our business needs and cybersecurity risks.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Although risks from cybersecurity threats to date have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: Despite our efforts, we recognize that no system is completely secure, and our main material cybersecurity risks are related to ransomware attacks, phishing attacks, insider threats, and third-party attacks. We monitor our systems against these risks and adjust our cybersecurity strategy accordingly. Our IT systems have been, and will likely continue to be, subject to computer viruses or other malicious codes, unauthorized access attempts, phishing, and other cyber-incidents, none of which, to Domtar's knowledge, have had a material impact on its business information systems or operations. While we cannot guarantee that our security efforts will prevent breaches or breakdowns to our IT systems or those of our third-party providers, we have a robust disaster recovery process that is exercised annually. For more information about cybersecurity risks, see the Risk factors discussion in Item 1A of this Form 10-K.

companyName: Domtar CORP


text: Our board of directors administers its cybersecurity risk oversight function through its audit committee. The audit committee is responsible for overseeing our policies, practices and assessments with respect to cybersecurity, and provides periodic updates to our board of directors. The audit committee receives periodic updates from management and our external third party information technology consultant regarding the effectiveness of the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems, and regarding other cybersecurity matters, including the results from cybersecurity systems testing and any recent cybersecurity incidents and related responses. Our audit committee is also notified between such updates as soon as practicable regarding significant new cybersecurity threats or incidents. The audit committee also receives a report on cybersecurity matters and related risk exposures at least semi-annually from our Chief Accounting Officer. The chair of our audit committee has a National Association of Corporate Directors Carnegie Mellon University CERT Certification in Cybersecurity Oversight.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO and cybersecurity teams hold relevant certifications, including, but not limited to, Security+ Certification, Factor Analysis for Information Risk Analyst, Certified Information Systems Auditor, Security Systems Certified Practitioner or Certified Federal Information Security Management Act Compliance Practitioner. We also supplement our cybersecurity program with third-party experts, who provide assessments of our program, testing of our environment, monitoring support, as well as insights into evolving trends in this space.

companyName: AVIENT CORP

ticker: AVNT


text: We actively engage consultants, outside counsel and other technology experts to enhance our cybersecurity risk management processes. We perform regular assessments and evaluations of the effectiveness of our cybersecurity measures. In addition to third party engagements, we maintain rigorous oversight of cybersecurity risks associated with our use of third party service providers. Vendor management processes are employed to evaluate vendors' cybersecurity practices, assess risk position and implement measures to mitigate potential threats arising from these external relationships.

companyName: Strawberry Fields REIT, Inc.

ticker: STRW


text: The Company's process for assessing, identifying, and managing material risks from cybersecurity threats is as follows: the Company has cloud-based security, our computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers. The Company has engaged any third-party consultants with regard to our cloud-based cybersecurity. We have had no current or previous cybersecurity incidents that have materially affected or were likely to materially affect the Company's business strategy, results of operations or financial condition.

companyName: My City Builders, Inc.

ticker: MYCB


text: Our CIO has over 20 years of professional experience specializing in business transformation, change management, executive leadership, and IT strategy, and has worked with technology security, banking and media companies. Our head of Information Security also brings over 20 years of security, privacy, and compliance experience from public and private sector roles, including leading the security programs at SaaS companies for over a decade.

companyName: ON24 INC.

ticker: ONTF


text: In the ordinary course of our business, we and our third-party service providers, such as contract research organizations, collect, maintain and transmit sensitive data on our networks and systems, including our intellectual property and proprietary or confidential business information (such as research data and personal information). The secure maintenance of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: The Board of Directors is in the process of creating a Technology Committee to have an oversight role regarding technology-based issues, including in relation to cybersecurity and generative artificial intelligence. With respect to cybersecurity, the committee's role may include assisting the Board of Directors in evaluating management's role in preparing, presenting and assessing our IT systems, reviewing our cyber risks and strategies as well as any significant incidents, and providing guidance regarding the Company's cybersecurity compliance obligations.

companyName: TD SYNNEX CORP

ticker: SNX


text: Third Party Security Experts We engage third party security experts to supplement our internal CFC team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: Baker Hughes Co

ticker: BKR


text: Our cybersecurity team is composed of the global head of Information Technology & Management Information Systems, the Chief Information Security Officer ("CISO") and deputy CISO. The cybersecurity team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our cybersecurity team members each possess 15-25 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training. We believe this collective experience allows us to effectively manage risks emerging from cybersecurity threats.

companyName: CEVA INC

ticker: CEVA


text: Notwithstanding our efforts at cybersecurity, the Company cannot guarantee that it will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A., Risk Factors – Risks Related to Our Business.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Cybersecurity Risks No previous cybersecurity incident has had, or is reasonably likely to have, a material adverse effect on Markel Group, its business strategy, results of operations, or financial condition. For risks related to cybersecurity threats, see Item 1A Risk Factors, including under "Information technology systems that we use could fail or suffer a security breach or cyberattack, which could have a material adverse effect on us or result in the loss of regulated or sensitive information."

companyName: MARKEL GROUP INC.

ticker: MKL


text: Routine oversight of cybersecurity risk management is delegated by the Audit Committee to our Chief Legal, Compliance and Administrative Officer. The IT department, reporting directly to this Officer, is responsible for managing the cybersecurity risk management program and is responsible for identifying, considering and assessing potentially material cybersecurity risks on an ongoing basis, establishing processes to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and reporting to executive leadership about evolving issues. The Chief Legal, Compliance and Administrative in turn, updates the Audit Committee and board of directors of any related incidents or threats that are being addressed.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: We are also in the process of simplifying our technology landscape and implementing several new cybersecurity technologies that will help improve the management of cybersecurity risks and threats. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial (including no related penalties and settlements).

companyName: CRAWFORD & CO

ticker: CRD-A


text: We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have based our cybersecurity program on industry frameworks with the goal of building enterprise resilience against an evolving landscape of cybersecurity threats and to respond to cybersecurity threats as they materialize. Our program includes monitoring, identification, assessment, and management components, as well as information and escalation components designed to inform management and the board of directors of prospective risks and developments.

companyName: ELI LILLY & Co

ticker: LLY


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: data encryption for certain data, network security controls, data segregation for certain data, access controls, physical security controls, monitoring for certain systems, asset management and tracking, and employee training. We also maintain cybersecurity insurance.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: Our Board oversees the Company's general risk management processes, and with respect to cybersecurity risks the oversight is performed primarily through the Audit Committee of the Board, which is briefed at least quarterly on cybersecurity threats, the results of periodic assessment and reviews of the Company's cybersecurity programs, and cybersecurity developments affecting companies generally. Our incident response plan provides for prompt notice to the Board of any material cybersecurity incident.

companyName: IES Holdings, Inc.

ticker: IESC


text: The Global IT Senior Director oversees the Company's incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The Company's Global IT Senior Director also coordinates with internal audit and other third parties to assess and manage material risks from cybersecurity threats and is responsible for informing the Audit Committee of cybersecurity incidents that may be material.

companyName: Whole Earth Brands, Inc.


text: Key elements of our Cybersecurity Program include: • monthly cybersecurity awareness training for all employees, focusing on threat recognition and appropriate responses to phishing and social engineering attacks; • deployment of a phishing detection system to identify and flag suspicious emails for further review; • installation and regular updates of advanced endpoint detection and response (EDR) software on all company-managed systems and workstations to prevent malicious activity; • implementation of secure DNS and web filtering with category and malicious site blocking; • deployment of next-generation firewall technology at all locations to secure perimeter access and ensure secure inter-site connectivity; and • a documented incident response plan to guide response and mitigation efforts in the event of a cybersecurity incident.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: Key Program Components To help manage cybersecurity risk, the Company uses cybersecurity frameworks and standards as a guide, such as the National Institute of Standards and Technology's Cybersecurity Framework, International Organization of Standardization ISO/IEC 27002, and Payment Card Industry (PCI) Security Standards. We use, and continue to improve, our cyber defense-in-depth strategy, which uses multiple layers of security for holistic protection.

companyName: FOOT LOCKER, INC.


text: Risks and Impact MWYN Inc. has not experienced any cybersecurity incidents to date that have materially affected its business strategy, results of operations, or financial condition. The Company recognizes that cybersecurity threats, including attempts to gain unauthorized access to systems, data breaches, and other malicious activities, continue to evolve in complexity and frequency across industry. While no material impacts have occurred thus far, the Company acknowledges that future incidents may reasonably be expected to materially affect its operations if not effectively prevented or mitigated. MWYN stores its sensitive and operational data on secured internal servers protected by firewall and access control protocols designed to prevent unauthorized access and ensure data integrity.

companyName: Marwynn Holdings, Inc.

ticker: MWYN


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives periodic updates. In addition, management updates the Audit Committee, as necessary, regarding any material or significant cybersecurity incidents.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: We conduct a regular risk assessment process with monthly management reviews of the cybersecurity risk landscape to identify threats and may conduct further assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Lyft, Inc.

ticker: LYFT


text: The members of Senior Management each hold degrees in their respective fields and combined have approximately 30 years or more of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: Over 98% of our restaurants are operated by franchisees who themselves are at risk of potential cybersecurity threats. There is no connectivity between the Company's network and the networks on which our franchisees and licensees operate. Furthermore, there is no interface between the Company-owned restaurants point-of-sale system and the Company's network and no interface between the Company's primary manufacturer, Smithfield Foods, Inc. and the Company's network.

companyName: NATHANS FAMOUS, INC.

ticker: NATH