text: • The CEO of Duke Energy has over 20 years of experience in the utilities industry, and has gained cybersecurity experience as CEO of one of America's largest utility companies, and through service on the board of the Edison Electric Institute, the Institute of Nuclear Power Operations, the World Association of Nuclear Operators, and past service on the Department of Homeland Security Advisory Council. • The EVP and Chief Financial Officer of Duke Energy (CFO) previously served as the Company's Chief Transformation and Administrative Officer and led the Company's business transformation through digital innovation, new ways of working and process redesign. In this role, the CFO gained an in-depth understanding of the Company's cybersecurity procedures and key threats, and was responsible for the enterprise business services and technology team, including the information and technology organization. • The EVP, Chief Generation Officer and Enterprise Operational Excellence of Duke Energy has gained cybersecurity experience through being responsible for the safe, efficient and reliable operation of Duke Energy's fleet of nuclear, natural gas, hydro, solar and coal units. • The President of Duke Energy has gained cybersecurity experience through focusing on transmission and the development of long-term grid strategies and solutions and through a prior role as Chief Distribution Officer, overseeing the safe, reliable, and efficient operation of Duke Energy's electric distribution systems, and through serving on the board of the Association of Edison Illuminating Companies. • The CSISO of Duke Energy has over 25 years of experience building and leading security teams within multiple industries. The CSISO holds a Secret Security clearance and is committed to strengthening U.S. critical infrastructure through active collaboration with federal partners at the Federal Bureau of Investigation, Department of Energy, Department of Homeland Security, and state partners including the national guard, law enforcement and universities. • The CAO of Duke Energy has over 25 years of experience in delivering secure information technology solutions across multiple industries, leading technology delivery for all core business functions. The CAO holds a Secret Security clearance and has active interactions and partnership with the Federal Bureau of Investigation, Edison Electric Institute and State Fusion Centers in the jurisdictions that Duke Energy serves.

companyName: PROGRESS ENERGY INC


text: We employ a suite of tools and services that support the continuous surveillance and reduction of cyber risks. Our internal teams undertake regular audits and penetration testing throughout the year. External third-party experts are enlisted annually to assess our cybersecurity maturity and conduct risk evaluations, besides offering specialized knowledge on various cybersecurity matters. Our security operations center operates 24/7 to identify, lessen, and react to cyber threats promptly. Defined protocols are in place to manage and mitigate any detected cybersecurity incidents swiftly, with regular reviews of our policies and procedures to ensure compliance with evolving regulatory standards and the dynamic threat landscape.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW

secItem: Item 1C


text: Our management team, including our Chief Technology Officer, Senior Director of Information Security and other members of the IT team are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer joined Consolidated in 2017 and has more than 30 years of communications industry experience. Prior to joining Consolidated, he served as the Chief Technology Officer at FairPoint Communications, Inc. and also held key leadership roles at Comcast and Level 3 Communications.

companyName: Consolidated Communications Holdings, Inc.


text: Our Cybersecurity Program is administered by our Executive Vice President of Accounting and our Chief Compliance Officer. These individuals, along with our external legal counsel and third-party IT providers serve as the incident response handlers in connection with any material cybersecurity incident under our Incident Response Plan. The Incident Response Plan provides guidelines for responding to a cybersecurity incident and facilitates coordination between the necessary parties. This includes notification to our senior management, and if material, reported to Board of Directors. We also utilize the services of IT and cybersecurity consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems to recommend improvements to our Cybersecurity Program. The Company maintains a cybersecurity insurance policy, which includes services of additional third party experts in the event of a cyber incident. The Company has not experienced any material cybersecurity incident, and the Company is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: Equinix has also implemented controls designed to identify and mitigate cybersecurity risk associated with our use of third-party service providers, such as security risk assessments. We use a variety of inputs in such assessments, including information supplied by the third parties and regular monitoring.

companyName: EQUINIX INC

ticker: EQIX


text: The Company has several security policies that are published and accessible to all employees. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. Marine Products has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. We plan to consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and make the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate. While the Company is currently self-insured for cybersecurity risks, we are evaluating a cyber liability insurance policy that may provide coverage for expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. The Company has a periodic touchpoint with all third-party information technology service providers to identify materials risks from cybersecurity threats.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third-party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: The Company has an enterprise risk management function that oversees the identification, prioritization, and mitigation of the Company's enterprise risks, and cybersecurity is a risk category addressed by that function. The Company uses governance, risk and compliance tools to assess, identify and manage its cybersecurity risks.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: CENTERSPACE

ticker: CSR


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third-party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations.

companyName: SUNHYDROGEN, INC.

ticker: HYSR


text: The Information Security team performs internal threat hunting, vulnerability scanning, log aggregation, and identity monitoring on an on-going basis. Web site, code, and configuration vulnerability scans are performed as necessary to ensure that changes do not introduce vulnerabilities into our systems. Information Security and IT Risk personnel receive regular training to ensure up-to-date expert knowledge.

companyName: Mistras Group, Inc.

ticker: MG


text: The firm's Chief Risk Officer (CRO) leads the Enterprise Risk program, providing the framework and tools used by all business teams across the firm, including technology, to identify, assess, and manage risks from cybersecurity threats in coordination with the firm's Chief Information Security Officer (CISO). The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risks from cybersecurity threats. The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Firm-wide Compliance to provide risk assurance activities.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: The ISAT ultimately provides information to our Risk and Audit Committee regarding its activities, including those related to cybersecurity risks. The Risk and Audit Committee also receives a briefing and continuing education from a member of the ISAT relating to our cybersecurity risk management program at least annually. The ISAT is responsible for notifying the Risk and Audit Committee of material cybersecurity incidents.

companyName: MARA Holdings, Inc.

ticker: MARA


text: We maintain a Cybersecurity Incident Response Plan, or CIRP, which is designed to guide our response to cyber incidents, including to mitigate and contain any potential cybersecurity incidents that could affect our systems, network, or data. The CIRP identifies the individuals responsible for developing, maintaining, and following procedures related to cybersecurity incident response, including escalation protocols. We also engage external third-party consultants to provide services, such as penetration testing, which is conducted on an annual basis, and periodic vulnerability assessments. These consultants also perform annual assessments of our cybersecurity program, which involve, among other things, review of our IT security measures and processes for alignment with the NIST Cybersecurity Framework and provision of threat intelligence regarding emerging risks to our information systems.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: The Verizon Executive Security Council (VESC) oversees and evaluates the work of the CISO and their team. The VESC is jointly chaired by the head of Verizon Global Services and the President of Global Networks and Technology and includes Verizon's Chief Compliance Officer, Chief Legal Officer, Senior Vice President of Internal Audit and senior executives in business and technology functions. The VESC provides oversight of all aspects of Verizon's cybersecurity program and, at regular intervals throughout the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Risk Assessment. The Company engages in periodic cybersecurity and technology resilience risk assessments based on methodology and guidance from a recognized national standards organization; and utilizes periodic risk-based analysis for adopting, maintaining and adjusting appropriate security controls to address such risks.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: As an element of its information security risk management oversight activities, the F&A Committee reviews the results of our incident response control tests, external and internal audits and penetration testing and oversees our vendor risk management program. The F&A Committee also receives quarterly updates regarding cybersecurity matters from senior management. In turn, the F&A Committee reports to the full Board on a quarterly basis regarding the F&A Committee's cybersecurity risk oversight activities. We also have Board members with expansive knowledge and expertise in the area of cybersecurity. In addition to these regularly scheduled updates, our Chief Privacy Officer and Senior Vice President, Cloud Security and Head of Global Information Security may also report to the F&A Committee on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats that have been detected by the information security team.

companyName: ORACLE CORP

ticker: ORCL


text: Despite our efforts, there is the ever-present risk that our systems and/or data will suffer a successful cyber incident such as unauthorized access, use, disclosure, modification, or destruction by hackers, cybercriminals, state-sponsored actors, insiders, or other malicious actors. We have experienced attempts to compromise our systems and/or data. These attempts included phishing attacks, malware infections, and unauthorized access attempts. We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations. We continue to be diligent in preventing, detecting, and responding to a cyber incident. However, we cannot guarantee that we will not suffer cybersecurity incidents in the future, which could result in:

companyName: Superior Drilling Products, Inc.


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of business information, result in litigation costs and negatively impact our reputation among customers and partners.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Difficulties with our global information technology systems, including any unauthorized access or cyber-attacks, could harm our business" which disclosures are incorporated by reference herein.

companyName: NETLIST INC

ticker: NLST


text: Board of Directors Our Board of Directors oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Our management team, including the Vice President, Global IT and Senior Vice President, Risk and Internal Controls, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our Vice President, Global IT has more than 15 years' experience leading teams in cybersecurity, designing and securing critical IT infrastructure in the sports entertainment, healthcare and biotech sectors. Our Senior Vice President, Risk and Internal Controls has more than 30 years' experience designing, implementing and leading risk management, internal control and compliance programs including cybersecurity, data privacy and business resilience.

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: Engagement with External Cybersecurity Professionals The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes. These third parties include cybersecurity assessors, consultants, and professionals who help identify, verify, and validate cybersecurity risks and support mitigation or incident response plans as needed.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Due to the type and volume of information that we collect and store to support our business, including to provide insurance coverage to prospective, current and former policyholders, we are an attractive target for cyber threat actors seeking financial gain. Our failure to maintain the safety of our policyholder's information could have a material adverse effect on our reputation, financial condition and results of operations. To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, we anticipate that our systems and data will continue to face attacks or other cybersecurity risks and there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under Item 1A. Risk Factors, General Risk Factors, "The failure to maintain effective and efficient information systems at the Company could adversely affect our financial condition and results of operations."

companyName: GLOBE LIFE INC.

ticker: GL


text: The Company utilizes a risk assessment approach to oversee and identify material risks from cyber threats, which includes information gathering, analysis, and prioritization of mitigation strategies. This approach was designed following security industry standard processes, models and guidelines. Risk assessments are a key component of the overall risk management process. The objectives of the risk assessment process are as follows: a. Provide assurance that management has implemented appropriate controls to mitigate risk. b. Identify applications, vendors, service providers, and/or business units that process, transmit, or store sensitive information. c. Comply with the various regulations addressing data security. d. Comply with the Company's information security policies and standards.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: If data and network defenses are bypassed, processes detailed in our Cyber Incident Response Plan would help identify, contain and eradicate threats and bring our systems back online if needed. Additionally, the plan requires that the appropriate level of our management be made aware of incidents and be updated as the situation warrants.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: To help identify and assess risks, we and our Manager engage third-party advisors to conduct assessments, which leverage standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: We are subject to cybersecurity risk, which includes intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risk can take the form of a variety of circumstances that cause harm to us, our members, our service providers, and the economy in general. These circumstances include malicious software or exploited vulnerabilities, social engineering, such as phishing, denial-of-service attacks, viruses, malware, and natural or other disasters. See Item 1A. Risk Factors for additional description of cybersecurity and other operational risks.

companyName: Federal Home Loan Bank of Cincinnati


text: Cybersecurity Risk Management and Processes The Company is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: Role of Management Our CIO defines and administers our cybersecurity risk management strategy. The CIO possesses both academic and industry experience, including leading multiple global retail and technology companies through technology implementation and modernization utilizing industry best practices. Our CISO reports to the CIO and directs, coordinates, plans and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy. The CISO possesses academic and industry certifications and approximately two decades of experience in technology risk management, including over a decade with the Company leading multiple information security functions. The CISO briefs the CIO regularly on current cybersecurity matters and relevant issues across the cybersecurity threat landscape. The CIO and CISO regularly report to our senior leadership team, as well as our Board of Directors and designated Board committees, regarding our cybersecurity risk management strategy. The CIO and CISO are supported by several dedicated teams of cybersecurity specialists, including teams responsible for vulnerability and penetration assessments, secure design of systems and applications, intrusion detection and monitoring and incident response. In addition, the CIO and CISO coordinate with other internal teams, including Digital, Data Governance, Operations, Finance, Legal and Internal Audit, to ensure our cybersecurity risk management strategy supports the Company's technology strategy and overall business goals.

companyName: Wendy's Co

ticker: WEN


text: Through ongoing communications with these teams, the Vice President of Information Technology and the Cybersecurity Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the board of directors and the audit committee when appropriate.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: To assure long-term success, Luxfer is committed to discovering and preparing for all potential cybersecurity threats. We set out below certain mitigating actions that we believe help us manage our principal cybersecurity risks.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Company has a dedicated internal IT department with cybersecurity engineers who oversee various aspects of cybersecurity. These engineers specialize in different areas, including ensuring security during product development, particularly in the domains of cloud management platforms and network interactions, as well as managing cybersecurity for daily office communications.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our CISO, supported by a cross-functional team, has primary responsibility for assessing and managing our cybersecurity program and the related risks. Details of the risk management and escalation processes are discussed in "Cybersecurity Risk Management and Strategy" above. The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing and managing the Cybersecurity risks with comprehensive oversight of information security functions with an emphasis on strategic leadership, governance, risk management and technical proficiency. Moreover, the Company's CISO provides cybersecurity updates to the entire board of directors and the board's Quality Compliance Management Risk Committee (the "Committee"). The purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities relating to the Company's compliance with laws, regulations, and industry standards that, if breached, may cause significant business, regulatory, or reputational damage to the Company, including oversight of the Company's: • Compliance with good ("x" = manufacturing, clinical, laboratory, pharmacovigilance, storage, distribution etc.) (GxP) and medical device Quality Systems Regulations (QSR); • Healthcare compliance, anti-corruption, privacy and data security landscape, medical product safety, supply chain, employee health and safety, political expenditures and lobbying activities, and government contracting; • Enterprise Risk Management program; and • Cyber and information security risks.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: The Company has adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP. Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board when appropriate, as discussed above. In general, the IRP leverages the National Institute of Standards and Technology guidance. The IRP applies to all Company personnel who provide or deliver technology systems (including employees, contractors and service providers).

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: The CISO is directly responsible for directing, "all cyber related activities (including monitoring, preventing, detecting, mitigating, and remediating" and informing the Audit Committee of any cybersecurity incident or threat with material impact, including such threats associated with our use of external suppliers and other third-party service providers.

companyName: Satellogic Inc.

ticker: SATL


text: The Company has also established a process to identify and assess potential risks arising from cybersecurity threats associated with our use of critical third-party service providers. This process includes, as appropriate, conducting assessments of third-party providers' cybersecurity capabilities and reviewing third party providers' processes for alignment with our internal cybersecurity requirements.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: We continue to increase our cybersecurity investments and safeguards designed to detect and prevent cybersecurity incidents. Notwithstanding our increased cybersecurity investments and preparedness activities, threat actors and cybersecurity incidents continue to pose a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property, confidential information and personal data. Cybersecurity incidents are investigated and remediated in accordance with our incident response procedures and other policies and procedures. For more information on how a cybersecurity incident may impact the Company, refer to the risk factor titled "Cybersecurity threats, data privacy compliance, and use of artificial intelligence could have a negative impact on our business," in Item 1A of this Form 10-K.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: Our cybersecurity risk management and strategy processes are led by a team of senior level management, including our Chief Financial Officer, Vice President of Finance, Senior Vice President of Legal and General Counsel and Vice President of Quality. These individuals collectively have significant prior work experience in various roles involving managing information security and implementing effective information and cybersecurity programs. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: Board will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cybersecurity incidents and ongoing cybersecurity risk management efforts.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: The Company maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: Cyberattacks continue to evolve in sophistication and frequency. Among other things, an attack could impair our ability to interact with customers and suppliers, fulfill orders, generate invoices, collect and make payments, ship products, provide support to customers, fulfill contractual obligations and otherwise perform business functions.

companyName: TELEFLEX INC

ticker: TFX


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations or financial conditions. See "Risk Factors – General Risk Factors - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results" in Part I, Item 1A of this Annual Report on Form 10-K for a discussion of these risks. To date, we have not experienced a material cybersecurity incident.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the CIO, the Chief Executive Officer and others. These individuals work with the Company's incident response team, pursuant to a documented incident response plan, to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: In addition, all employees of the Company and CIM Group receive mandatory training on cybersecurity matters upon hiring and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: Mid Penn places an emphasis on managing risks effectively to achieve its business goals and maintain the confidence of its shareholders. Cybersecurity is one of the company's most critical risks and is an integral part of our Risk Management program. We are open about our willingness to take risks and regularly review and update our risk management policies to keep up with the ever-changing financial landscape. Our risk committees, made up of experienced professionals, carefully evaluate the risks associated with our business activities, ensuring that our risk-taking aligns with our overall corporate goals.

companyName: MID PENN BANCORP INC

ticker: MPB


text: We identify material cyber risks by continually assessing external threats to understand evolving threats, developing issues and industry trends. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks. We view our main cyber risk areas to be attempts to gain unauthorized access to our data and computer systems and the data of third parties to which we may owe a duty of care through malware, ransomware, computer fraud, insider threat from persons inside our Company or persons with access to systems inside our Company, and other significant disruptions of our information technology networks and related systems. Our processes and controls to mitigate these cyber risks, categorized by five functional areas, Identify, Protect, Detect, Respond and Recover, are addressed below.

companyName: FIRST INDUSTRIAL LP


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability" and Item 1, "Business – Environmental and Other Regulations – Safety Management System Requirements" in this report.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Management's Role in Cybersecurity Risk Management The Chief Information Security Officer ("CISO") of the Bank and a standing management Information Security Committee monitor, measure, and report key indicators, risk assessments, and security measures to the management Corporate Risk Committee. The CISO, in conjunction with the Corporate Risk Committee, makes quarterly reports to, the Risk Committee of the Board of Directors. Such quarterly reporting may include, but is not limited to, key metrics and risk indicators, penetration test results, risk assessment results, status of ongoing initiatives, incident and notable event reports, compliance with regulatory standards, and operational issues. In addition to quarterly reporting to the Board's Risk Committee, the Company's incident response processes include escalation to management when an incident is suspected.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: We assess our service providers prior to allowing our information to be processed, stored or transmitted by third parties, and we include standardized contractual requirements in each contract where appropriate. We validate our service providers' security via questionnaires, open-source intelligence and, where appropriate, SOC 1 Type II reports on financially significant third-party service providers. Our process also includes regular monitoring of risk related to third parties on a periodic basis or when services or product purchases expand beyond their original scope or intended use.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: We maintain a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, and we partner with leading cybersecurity experts to continually enhance the security of our operating environments. Some of the key risks identified include unauthorized access to our systems, spoofing valid credentials, and monetary motivated attacks, amongst others. As an organization, we have devoted significant resources to cybersecurity processes aimed at addressing the known risks, as well as adapting to the changing cybersecurity landscape and responding to emerging threats, if any, in a timely and effective manner. Our comprehensive cybersecurity program is implemented and maintained using information security tools, policies, training, and a team of information technology professionals. We have a Cybersecurity Incident Response Plan and a Business Continuity and Disaster Recovery Program, in addition to other company policies and procedures that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process, are approved by the appropriate members of management, and are a required part of our employee training on an annual basis.

companyName: GENESIS ENERGY LP

ticker: GEL


text: In designing our Information Security Program, we refer to established industry frameworks, particularly those of the Federal Financial Institutions Examination Council ("FFIEC") and the National Institute of Standards and Technology ("NIST"). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. NIST is part of the U.S. Department of Commerce and among other initiatives, develops cybersecurity standards, guidelines, and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Activities range from producing specific information that organizations can put into practice immediately to longer-term research that anticipates advances in technologies and future challenges.

companyName: First Financial Northwest, Inc.


text: • Risk identification begins with understanding the devices and equipment in use across the company, including laptops and other data devices, industrial equipment and machinery, and associated risks related to the use of those devices and equipment. • Risk mitigation entails protecting our data and operational systems via a system of controls. We monitor and collect data about the devices and users that touch our network resources, reviewing this data for anomalies. When we identify anomalies, we investigate to determine if the anomaly represents a threat. We have a process to contain and remediate identified threats. As discussed further below, we have incident response processes in place to utilize in case of threats or incidents. We conduct regular crisis simulations.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Operating Officer and, as appropriate, the Chief Compliance Officer, the Director of Information Technology and third-party cybersecurity experts, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: Our Board of Directors includes cybersecurity risk management as part of its general oversight function and oversees the cybersecurity risk management program and any identified cybersecurity risks and incidents. To facilitate its oversight, the Board of Directors receive regular updates from management on cybersecurity.

companyName: Axos Financial, Inc.

ticker: AX


text: Our Chief Information Security Officer ("CISO") and Information System Security Officer ("ISSO") are responsible for providing overall direction, guidance, leadership, and support for the entire information systems environment, while also assisting other applicable personnel in their day-to-day operations.

companyName: Cycurion, Inc.

ticker: CYCU


text: Pursuant to the terms of the Fund's LLC Agreement, the Manager renders management, advisory and administrative services to the Fund, which includes the assessing, identifying, and managing of material risks from cybersecurity threats through its Corporate IT Security Governance program. Ridgewood Energy's Corporate IT Security Governance program consists of an information security framework and organizational structure with senior management oversight that are designed to safeguard critical information assets.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: As an externally managed company, the Company relies on our Manager's corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (the "Information Systems") in connection with the Company's day-to-day operations. Our Manager has adopted a written information security program (the "Written Information Security Policy"), which is designed to address applicable requirements under Regulation S-P and the FTC Safeguards Rule. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats under the Manager's Written Information Security Policy. The processes include, among other things, maintaining secure digital or physical access to information assets, using manual and automated detection methods for malicious code, due diligence of third-party vendors, and engaging a leading provider of cybersecurity services to assess and manage cybersecurity risk. For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: While the Company, with the help of third-party service providers, has implemented security technology and established operational procedures designed to prevent or limit the impact of cybersecurity threats and incidents, such events may still occur and safeguards may not fully protect our systems from comprises or breaches which could have a material adverse effect on Carver's financial condition and results of operations.

companyName: CARVER BANCORP INC

ticker: CARV


text: As of the date of this Annual Report, we have not identified any cybersecurity threats that have had, or are likely to have, a material impact on our operations, including our business strategy, financial results, or financial condition. For more information on the risks associated with cybersecurity, refer to the "Risk Factors" section contained in Item 1A of this Form 10-K.

companyName: WD 40 CO

ticker: WDFC


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. This program seeks to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. Lumen maintains an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.

companyName: QWEST CORP

ticker: CTBB


text: We have processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), we undertake the below listed activities: • closely monitor emerging data protection laws and, if necessary, implement changes to our policies and employee training processes designed to comply; • undertake regular reviews of our policies and statements related to cybersecurity; • conduct annual cybersecurity awareness training for all relevant employees to increase their awareness and responsibilities when faced with cybersecurity threats; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees to enhance awareness and responsiveness to such possible threats and provide supplemental training when appropriate; • through policy, practice, and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and Additionally, we carry information security risk insurance coverage that we believe to be appropriate for the potential losses arising from a cybersecurity incident. However, this insurance may be subject to certain exceptions and may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: We more fully describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A. of this Form 10-K. See the risk factors captioned "We may experience difficulties in managing our growth and expanding our operations," "We are subject to cybersecurity risks to our and our suppliers' operational systems, security systems, infrastructure, integrated software in our LiDAR solutions and customer data processed by us or third-party vendors or suppliers, and any material failure, weakness, interruption, cyber event, incident, or breach of security could prevent us from effectively operating our business" and "Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the variety of jurisdictions in which we operate may adversely impact our business, and such legal requirements are evolving, uncertain, and may require improvements in, or changes to, our policies and operations."

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Manager, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Manager and Apollo), including risk mitigation, compliance and controls.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Cybersecurity risks continue to evolve with certain risks leading the way. Risks experienced in the last year involved third party service providers, with no material impact to Wesbanco related to these incidents. Wesbanco continues to foster a risk averse focus and leverages various threat intelligence sources to continually evaluate current and future risks to the organization. The bank's cybersecurity strategy and roadmap is frequently evaluated and updated according to multiple inputs including any tangible cybersecurity incidents.

companyName: WESBANCO INC

ticker: WSBC


text: Board of Directors The Corporate Governance and Risk Assessment Committee (the " Governance Committee ") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the Governance Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISO. The Chairman of the Governance Committee provides quarterly reports of such updates to the full Board of Directors. The CISO's quarterly report to the Governance Committee contains updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.

companyName: International Seaways, Inc.

ticker: INSW


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Cybersecurity is a key component of our technology strategy, which is architected and managed by our CITO and reviewed and monitored by our senior executive team, with oversight from our Board and the Audit Committee, as described above. Our CITO's experience and expertise in cybersecurity includes 20 years of practitioner experience as an information security advisor across multiple industry verticals where he has served in security analyst, architect, and security program leadership roles, and has led information security teams to deliver large scale information security programs for multiple Fortune 500 companies. Our cybersecurity risk management program is managed by our SDIS, who reports directly to the CITO. Our SDIS's experience and expertise in cybersecurity includes 32 years of working in the information technology field as an analyst, architect, and leader and 14 years leading information security teams at multiple enterprises. The processes by which the CITO and SDIS are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents are described above under "Risk Management and Strategy."

companyName: Schneider National, Inc.

ticker: SNDR


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party CROs, CMOs, licensees, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption in our business and operations or could subject us to sanctions and penalties that could have a material adverse effect on our reputation or financial condition. " included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.

companyName: AGENUS INC

ticker: AGEN


text: The Board is actively engaged in oversight of our cybersecurity practices, with the Risk and Audit Committees having primary oversight responsibility. The Risk Committee reviews and approves the information security program on an annual basis, as well as receives management updates about information security matters on at least a quarterly basis. In addition, the Audit Committee receives prompt reporting and updates on IT audits and material cybersecurity-related incidents. The full Board receives regular presentations regarding pertinent cyber and information security topics. These updates cover external cybersecurity hot topics and notable events, current and emerging threats, cybersecurity program achievements and progress on key initiatives, key performance indicators, key risk indicators, and notable internal events.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: To maintain a strategic overview of our cybersecurity landscape, we conduct quarterly strategic reporting sessions. These sessions are crucial for reviewing security activity and identifying areas for improvement. Based on these reviews, we develop a Plan of Action and Milestones ("POAM") for remediation or re-architecture as necessary. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats. Our commitment to cybersecurity is integral to our risk management strategy, ensuring the ongoing protection of our systems and the sensitive data they contain.

companyName: TRANSCAT INC

ticker: TRNS


text: The CIO, through the Chief Administrative Officer and General Counsel, ensures that the highest levels of the Company remain informed about the cybersecurity posture, potential risks, events, and response if they occur. Material cybersecurity matters, and significant strategic risk management processes and decisions are elevated to the Board by the Chief Administrative Officer and General Counsel, ensuring that the Board has effective and substantive oversight and may provide input and guidance on critical cybersecurity measures and issues.

companyName: YORK WATER CO

ticker: YORW


text: Supporting the CIO and CSRO is a dedicated cybersecurity team that designs and monitors our cybersecurity control framework as well as implements cybersecurity control systems and solutions. Our cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Security+, Network+, AQS Certified Cloud Practitioner and Certified Information Systems Auditor.

companyName: HORTON D R INC /DE/

ticker: DHI


text: Starwood Capital considers cybersecurity risks, along with other top risks, within its Enterprise Risk Management ("ERM") framework. The ERM framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. Starwood Capital has implemented a cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. Starwood Capital prioritizes data protection through access management designed to permit access only by authorized personnel. Starwood Capital's cybersecurity incident response plan, integrated into the ERM framework, outlines a structured process for handling information security incidents involving assets or data. It guides Starwood Capital's cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Additionally, Starwood Capital maintains a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents. The cybersecurity insurance policy covers both our company and other Starwood Capital affiliates.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Risks from Cybersecurity Threats While the Company has technology and processes in place designed to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. Management does not believe our business strategy, results of operations, or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information about risks from cybersecurity threats, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: GARMIN LTD

ticker: GRMN


text: We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with key third-party service providers, hotel owners, and other companies with whom we do business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee of the Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and procedures to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee of the Board also reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is managed under the direction of our Senior Vice President for Business Transformation, who receives reports from our cybersecurity team, including our Chief Information Security Officer, or CISO, and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications, the CISO and these teams inform senior management about, and monitor the prevention, detection, mitigation and remediation of, cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Pactiv Evergreen Inc.


text: As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: "Our business and operations would suffer, and could be negatively affected, in the event of system failures or cyberattacks."

companyName: PDS Biotechnology Corp

ticker: PDSB


text: An actual or suspected cybersecurity incident that jeopardizes the confidentiality, integrity, or availability of Codexis' information systems or any information residing therein (or threat that presents significant risk to our information systems as identified by IT) is reported to the Cybersecurity Council by our IT Department. The focus of the Cybersecurity Council is on the investigation and facilitation of senior management's assessment and determination of materiality of an incident or threat, and such investigation is separate but contemporaneous with the investigation(s) done under other applicable programs, policies, and plans regarding cybersecurity. The Cybersecurity Council will liaise directly with other investigation(s) and share information and assessments. Along with assistance from the Cybersecurity Council as necessary, senior management reports its materiality determination and analysis, including necessary facts to support its determination, to the Audit Committee of the Board of Directors. Pursuant to its charter, the Audit Committee may, along with senior management, report such determination to the Board of Directors.

companyName: CODEXIS, INC.

ticker: CDXS


text: We use the NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: Aimco OP L.P.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Management, including the Chief Technology Officer and Chief Financial Officer and Treasurer, serves on the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents. The Audit Committee holds quarterly meetings and receives periodic reports from management, including our Chief Technology Officer and Chief Financial Officer and Treasurer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: In an effort to deter and detect cyber threats, we require all employees who use an official company email account to conduct business to complete regular trainings on data protection, cybersecurity, incident response and prevention, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks.

companyName: KADANT INC

ticker: KAI


text: The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2023). The CISO's update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key's compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key's Deputy CISO, also report annually to the Technology Committee to obtain approval on Key's Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.

companyName: KEYCORP /NEW/

ticker: KEY


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Apyx Medical has established a separate committee comprised of the CISO, Chief Financial Officer, Outside Counsel, Chief Executive Officer, and Department Heads, if necessary. This committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.

companyName: Apyx Medical Corp

ticker: APYX


text: In the event that we experience a cybersecurity incident, we have a cybersecurity incident response playbook that sets forth the applicable processes, roles, engagements, escalations and notifications to be executed in order to promptly respond to such threats. Depending on its nature and scale, a cybersecurity threat may be managed within our information security office, escalated to our CISO and CIO, or escalated to our management, and Board of Directors and Audit Committee, as appropriate. In certain instances, our GSR may be initiated and will collectively manage Teva's response to a crisis on a corporate level. The GSR is comprised of members from our various business units and regions, including senior leadership from a variety of functions, such as information security, legal, finance, human resources, communications and compliance.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, though the Company and our service provider have experienced certain minor cybersecurity incidents, we are not aware of any previous cybersecurity threats or incidents that may have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: Other Technical Safeguards: Additional technical safeguards that are designed to protect our information systems from cybersecurity threats include endpoint tools that detect and prevent threats on a computer and monitor for vulnerabilities, next generation firewalls, intrusion prevention and detection systems, and cybersecurity testing of our systems.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: We maintain a dedicated, fully staffed and qualified Information Security team that reports to the office of the Chief Technology Officer (CTO) and is currently led by the Director of Information Security (InfoSec). Combined, these individuals have more than 50 years of experience related to corporate information security governance, data and network security, data governance, risk management, and overall secure practices involved with InfoSec.

companyName: Rumble Inc.

ticker: RUM


text: We assess and identify security risk to the organization by: • conducting assessments of risk, including likelihood and magnitude, from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored or transmitted; • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology senior leadership, including the Chief Technology Officer; • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; and • continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: We do not presently maintain insurance coverage to protect against cybersecurity risks. If we procure such coverage in the future, we cannot ensure that it will be sufficient to cover any particular losses we may experience as a result of such cyber-attacks. Any cyber incident could have a material adverse effect on our business, financial condition and results of operations. A cybersecurity incident could negatively impact our business and our relationships with customers and expose us to litigation risk.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: Our Security Operations team, led by the VP of Information Security, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the executive management team. In addition, cybersecurity risks, emerging and existing threats and Asure's current security posture are presented to the board of directors quarterly, as the board of directors is generally responsible for our risk management. Our VP of Information Security holds a high-level certification relating to information security, Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium, and has 18 years of information security, risk management, application security, security operations, and incident management experience. Our Executive Management receives regular monthly reports from the VP of Information Security.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: The Company employs a multi-faceted approach to assess, identify, and manage material risks from cybersecurity threats. Components of our approach include the following:

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct operations and store and transmit sensitive data. We employ a layered cybersecurity approach, leveraging people, processes, and technology to monitor, detect, and mitigate threats. Our defenses include a variety of preventative and detective tools designed to block unauthorized activity and identify advanced persistent threats. Despite these measures, cyber-attacks are increasingly sophisticated and frequent, particularly in the financial services sector. While we have not experienced a material cybersecurity incident to date, a significant breach could result in financial losses, operational disruptions, reputational harm, regulatory scrutiny, or legal liability. In addition to securing our own systems, we rely on third-party service providers for various critical functions, including payment processing, cloud storage, and cybersecurity tools. Our systems, as well as those of our clients and third-party vendors, remain under constant threat, and vulnerabilities within these external providers could also pose risks to our operations.

companyName: BayCom Corp

ticker: BCML


text: We have established an incident response plan that outlines the procedures for detecting, responding to, and recovering from cybersecurity events. This plan is tested periodically through tabletop exercises and simulations to ensure readiness. In the event of a material cybersecurity incident, we are prepared to notify stakeholders and comply with all applicable regulatory requirements.

companyName: Frequency Holdings, Inc

ticker: FRQN


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: Based upon the information that we have as of the end of the year covered by this report, we do not believe that we have experienced any material cybersecurity incidents to date. However, the risks from cybersecurity threats and incidents continue to increase, and any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.

companyName: Boxlight Corp

ticker: BOXL


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers" within Risk Factors Item 1a.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Risks and exposures associated with our cybersecurity program are integrated into our overall enterprise risk management program and share common methodologies, reporting channels and governance processes. These processes and the governance for identifying and managing risks apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: GREIF, INC

ticker: GEF


text: The Audit Committee oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. On an annual basis, the Audit Committee discusses with Senior Management cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. As applicable, the Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: The Company's Board of Directors is responsible for overseeing management's identification, assessment and management of key risks, including cybersecurity risks.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: As an externally managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. We rely on IT systems, data hosting and other hardware and software platforms which are hosted by EQT, the parent company of our Advisor. As such, we are reliant on EQT for assessing, identifying and managing cybersecurity risk as part of its overall Risk Management Framework.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures;

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Our Board of Directors maintains oversight of risks from cybersecurity threats. Our Chief Executive Officer is assigned oversight of cybersecurity risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: BioNexus Gene Lab Corp

ticker: BGLC


text: To mitigate the risk and negative exposure of personal data being breached or inadvertently shared outside of ISG, we maintain a data protection framework that includes policies, procedures, guidance and records. This includes policies and procedures regarding the rights and usage of personal and client data. ISG employs a Data Privacy Manager who briefs the ISC on privacy matters as part of the quarterly ISC meetings. The Data Privacy Manager completes an internal audit annually and works with a specialist third party to complete an external Data Protection Compliance review.

companyName: Information Services Group Inc.

ticker: III


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technological initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Cybersecurity Overview We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.

companyName: NN INC

ticker: NNBR


text: FirstEnergy's Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident. FirstEnergy also conducts various internal and external risk assessments each year, which are based on nationally accepted standards. These can include annual compliance required assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in FirstEnergy's risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization's policies and procedures. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on FirstEnergy and others, such as vendors and customers, if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. FirstEnergy also regularly evaluates the adequacy and sufficiency of specific controls.

companyName: FIRSTENERGY CORP

ticker: FE


text: The Director of Information Security, reporting to and collaborating with the Vice President of Information Technology & the Chief Information Officer, manages our Enterprise Cybersecurity team. Day-to-day responsibilities include the implementation of cybersecurity strategies, cybersecurity risk management, and enhancing defenses against evolving threats. Our Director of Information Security has over 30 years of IT experience, 10 of which have been spent leading the Company's cybersecurity efforts. The Information Security Director plays a key role in shaping our cybersecurity strategy, ensuring alignment with industry standards and integration into our broader IT strategy.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Our Adviser's Chief Information Security Officer ("CISO") utilizes a variety of processes and systems to manage cybersecurity risks including third-party risk. This includes operational compliance monitoring processes within our information technology service management program, a security operations center managed by a security services provider; and periodic assessments and tests conducted by external parties or internal audit and compliance functions. We also regularly monitor cybersecurity and data privacy risks of investments in our portfolio. Additionally, our vendor governance framework includes monitoring of vendors' compliance with contractual terms and their cybersecurity risk profile. A risk assessment is conducted for each violation identified, which includes an assessment of the impact from a financial, operational, reputational, regulatory compliance, and client service perspective, to determine its materiality. Regular reporting includes information on material security incidents and policy breaches.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: The governance and oversight for cybersecurity risk management includes governance forums that inform management of key areas of concern regarding the prevention, detection, mitigation and remediation of cybersecurity risks.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: While to date, we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "Our business and operations could suffer in the event of cybersecurity breaches and we may incur significant legal and financial exposure." for further discussion of potential risks related to cybersecurity incidents.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: In the event of a cyber incident, the Company created and maintains a Business Contingency Program. This program provides guidance to prepare, detect, analyze, remediate and recover business operations with the least impact to the Company and its customers.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Further, our information security program is designed to provide oversight of third parties who store, process or have access to sensitive Company or customer data, and we require similar levels of protection from third -party service providers as are required for the Company. We maintain supplier risk assessment processes to identify risks associated with third -party service providers.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Trustmark's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Enterprise Risk Committee and the Audit Committee. Processes for identifying, assessing and managing cybersecurity-related risks are integrated into Trustmark's overall enterprise risk management process, which is overseen by the Enterprise Risk Committee. The Enterprise Risk Committee is responsible for monitoring risks that are being taken by Trustmark, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Enterprise Risk Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves Trustmark's cybersecurity strategy for protecting Trustmark's information assets and technology platforms. The Audit Committee oversees Trustmark's Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Enterprise Risk Committee and the Audit Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.

companyName: TRUSTMARK CORP

ticker: TRMK


text: The Technology, Environmental, Safety and Security Committee of NCLH's Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.

companyName: NCL CORP Ltd.


text: Our management team supervises efforts to help prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the technical environment.

companyName: Beachbody Company, Inc.

ticker: BODI


text: Our Chief Information Security Officer ("CISO") coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The CISO also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The CISO and the Chief Information Officer ("CIO") have shared responsibility for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to President and Chief Executive Officer, while the CISO reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Our Information Security Team meets at least annually with each of the Compliance Committee and the Audit Committee to discuss cybersecurity threats and the risk management programs. The Information Security Team provides information, as appropriate, about the sources and nature of risks the Company faces and how management assesses such risks. Our CCO also provides a quarterly report to the Audit Committee on trends and observations concerning cyber threats and actions being taken to mitigate those risks. The Chair of the Audit Committee reports quarterly to the full Board of Directors and that report includes a summary of the CCO's report.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Our current CCO will depart the Company at the end of February 2025, and will be succeeded by our new Chief Information Officer ("CIO"), who will join the Company in March 2025. The CIO's responsibilities will include the Company's cybersecurity efforts and policies, and he will report directly to our CFO. Our new CIO previously served in relevant leadership positions at other large public companies and brings to the role a wealth of information security and information technology knowledge and experience.

companyName: HARMONIC INC.

ticker: HLIT


text: Our management team, including our Chief Executive Officer, the VP R&D and Data Protection Officer of Cortex, and our external advisors, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Viewbix Inc.

ticker: VBIX


text: We have incident response and breach management processes which occur in stages starting with preparation for cybersecurity incidents followed by detection and analysis of cybersecurity incidents, containment, eradication and recovery, and post-incident analysis. Such incident responses are overseen by leaders from our information security, compliance and legal teams. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity threat or incident that materially affected or is reasonably like to materially affect our business or operations, but there can be no guarantee that we will not experience such an incident in the future. We aim to incorporate industry best practices throughout our cybersecurity program and continue to invest in additional controls designed to ensure the resiliency of our networks and prevention of cybersecurity incidents. We describe how cybersecurity threats are likely to materially affect us, including our business strategy, results of operations, and financial condition, in the section titled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Spire Global, Inc.

ticker: SPIR


text: Our cybersecurity risk management program, which is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas, is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. Our cybersecurity risk management program includes: (a) assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; (b) a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; (c) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; (d) cybersecurity awareness training of our employees, including our senior management, and incident response personnel; (e) a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and (f) a risk evaluation of the service providers, suppliers, and vendors of critical systems during contracting.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business— We rely significantly on the use of information technology. Cybersecurity risks – any technology failures causing a material disruption to operational technology or cyber-attacks on our systems affecting our ability to protect the integrity and security of customer and employee information – could harm our reputation and/or could disrupt our operations and negatively impact our business."

companyName: LENSAR, Inc.

ticker: LNSR