text: The Information Security & Compliance team is led by the Executive Director, Information Security and Compliance, who has 27 years of experience in IT and Security, including business risk management and cybersecurity, and reports to the Chief Information Security Officer (CISO), who has over 26 years in information technology and security roles. The Information Security & Compliance team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of the Company's information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of the information security program and improve the security measures and planning. The Incident Response team utilizes procedures that identify escalation paths when security events are identified. Incident priorities dictate the escalation of events and how an Incident manager reports them, to the executive leadership team within the Company, and the Board of Directors.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: Our Technology and Operations Committee provides independent and integrated oversight over our information security program, physical security program, business continuity program, security policies and procedures, and security exceptions and violations. This committee is comprised of leadership representatives from our operational risk, information security, IT, and legal departments, as well as other departments that provide both specific technical and multidisciplinary expertise to the committee. This committee is responsible for reviewing and approving our Information Security Policy. It also receives regular, prompt, and periodic information from the Information Security Department, which in turn provides periodic, regular, and prompt reporting to the Technology Committee of the Board of Directors on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted us, as well as risk assessment, management, and monitoring updates, as applicable or needed.

companyName: Federal Home Loan Bank of Des Moines

secItem: Item 1C


text: Depending on the environment, we implement and maintain technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training; access controls; data encryption; systems monitoring; regular patching of operating systems and software; and a password policy.

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: To assess, identify and manage material cybersecurity risks, we have endeavored to implement procedures, standards, and technical controls with the aim of protecting our networks and applications. We use internal and third-party tools and technologies to aid us in seeking to protect our network and internal systems from unauthorized access, intrusion, or disruption, including those described below.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: Our Director of IT has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our consultant's experience includes over 15 years of design, implementation and management of cyber-security programs at various levels and organizations.

companyName: CALLAN JMB INC.

ticker: CJMB


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. However, there is no guarantee that such coverage will be sufficient to address costs, liabilities and damages we may incur in connection with a cybersecurity incident or that such coverage will continue to be available on commercially reasonable terms or at all.

companyName: FLOWERS FOODS INC

ticker: FLO


text: We continue to make substantial investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed quarterly by our Board of Directors.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: Currently, the Company's board of directors does not oversee cybersecurity risks directly. However, plans are in place to introduce such oversight in the future. The Audit Committee of the Board will assume responsibility for cybersecurity risk oversight, with a plan to review cybersecurity matters on a quarterly basis. This initiative will ensure that the Company maintains robust oversight mechanisms to address evolving cybersecurity threats effectively.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: Although risks from cybersecurity incidents and threats have to date not materially impacted us, our business strategy, results of operations or financial condition, we have from time to time and will continue to experience threats to and security incidents related to our and our third party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: AEP also continually reviews its business continuity plan to develop an effective recovery strategy that seeks to decrease response times, limit financial impacts and maintain customer confidence during any business interruption. AEP administers a third-party risk governance program that identifies potential risks introduced through third-party relationships, such as vendors, software and hardware manufacturers or professional service providers. As warranted, AEP obtains certain contractual security guarantees and assurances with these third-party relationships to help ensure the security and safety of its information. The cyber security team works closely with a broad range of departments, including legal, regulatory, corporate communications, internal audit services, information technology and operational technology functions critical to the power grid.

companyName: AEP Transmission Company, LLC


text: Cybersecurity is an integral part of risk management at the Company. Our Board and management appreciate the evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, and mitigation of the effect any such incidents may have on the Company.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: Our management, led by our chief information officer, in conjunction with our internal management security committee and third-party service providers, helps to identify, assess and manage our cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile. These teams use a number of methods to do this, including manual and automated tools, internal and external threat assessments, and internal and external vulnerability assessments. The third parties we engage in this effort generally consist of threat intelligence service providers; cybersecurity consultants and software providers; penetration testing firms; monitoring services; forensic investigators; and other professional services firms, including legal counsel.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit and Risk Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit and Risk Committee each receive periodic reports from our Chief Information Security Officer, Chief Risk Officer and Chief Administrative Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit and Risk Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit and Risk Committee provide feedback and recommendations accordingly.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Third-Party Certifications and Audits In addition to our internal cybersecurity capabilities, we regularly engage with consultants, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. Specifically, the Company is engaged with third-party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification. We are also engaged with a third-party Data Protection Officer to oversee compliance with the GDPR.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Mr. Daly oversees a team of skilled cybersecurity professionals who have Certified Information Systems Security Professional ("CISSP") credentials, Global Information Assurance Certification from the SANS Institute, and other security and network certifications. The cybersecurity team monitors and evaluates our cybersecurity posture and performance on an ongoing basis, including through regular vulnerability scans, penetration tests, and threat intelligence feeds. The cybersecurity team uses various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence, and assesses and evaluates cybersecurity incidents, escalating certain cybersecurity incidents to Mr. Daly according to protocol. Mr. Daly is continually informed regarding the performance of the cybersecurity program, as well as the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: The CISO has served in various roles in IT and information security for over 26 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in computer science and a graduate degree in business and attained professional certification as a Certified Information System Security Professional ("CISSP"), Certified Information Security Manager ("CISM") and GIAC Certified Incident Handler ("GCIH"). The CIO holds an undergraduate degree in Economics and a master's degree in business administration, and has served in various roles in IT for over 25 years, including serving as the Chief Information Officer of three public companies. The Company's CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each has experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: LKQ CORP

ticker: LKQ


text: We use third-party service providers to perform a variety of functions throughout our business, such as electronic communications service providers, cloud-based file storage service providers, and contract manufacturing and research organizations. We evaluate the cybersecurity posture of such third-party service providers, including whether such providers maintain appropriate security measures and, where appropriate, require them to implement and maintain reasonable security measures in connection with their work with us. Our Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives updates, as needed, on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology departments. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: As of December 31, 2023, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: The Audit Committee of the Board has direct oversight, regularly reviews reports on cybersecurity risks and vulnerabilities. The Audit Committee is informed about risk assessments, progress of risk reduction initiatives, and feedback from external auditors. Our chief compliance & audit officer ("CCO/CAO") and his direct report, chief information security officer ("CISO"), have primary responsibility for assessing and managing material cybersecurity risks. The CCO/CAO reports to the Audit Committee, which is the primary governing body that drives alignment on security decisions across the Company. The Audit Committee meets at least four times a year on cybersecurity and such meetings are attended by the CCO/CAO, CISO, chief legal officer ("CLO"), chief financial officer ("CFO"), corporate controller, associate general counsel, and other senior company executives as needed to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Audit Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect our Company, see "Risk Factors" included elsewhere this Annual Report on Form 10-K, including "Our data and information systems and network infrastructure may be subject to hacking or other cyber security threats. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being insecure, which could harm our business and reputation and our proprietary business information could be misappropriated, which could have an adverse effect on our business and results of operations. "

companyName: Odysight.ai Inc.

ticker: ODYS


text: We also maintain data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. We have processes in place to assess, identify and manage vendor cybersecurity risks, which include initial and periodic security program reviews and, in cases where personal information is shared, ongoing cybersecurity and privacy obligations that are documented in data processing agreements. Our cybersecurity policies, standards, and processes are informed by a variety of industry standards and best practices, including the NIST Cybersecurity Framework and ISO 27001.

companyName: APPFOLIO INC

ticker: APPF


text: Cybersecurity Incidents In February 2023, we experienced a cyberattack that resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries, the consequences of which may be material. See "Item 1A. Risk Factors - We experienced a criminal cyberattack in February 2023, which resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries, all of which could damage our reputation or create additional financial and legal exposure." in Item 1A. Risk Factors which is incorporated by reference into this Item 1C.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Role of Management Through a services agreement between QVC Group and Liberty Media Corporation ("LMC"), QVC Group has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at QVC Group and at QVC.

companyName: QVC INC

ticker: QVCD


text: The Board and the Audit Committee oversee management's efforts to address cybersecurity and information security risks. Senior management provides the Board updates on the Company's cybersecurity program at least once a year, including as part of the Company's enterprise risk management assessment, and the Audit Committee reviews the cybersecurity program at least twice a year and on an as-needed basis. Such reviews, among other things, include the results of internal and/or external assessments, a review of cybersecurity governance at the management level, and a review of the Company's cybersecurity program and progress toward various initiatives.

companyName: IDEX CORP /DE/

ticker: IEX


text: Our management team, including the IT Manager, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of our cyber risk management program. Our management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making.

companyName: Sachem Capital Corp.

ticker: SACH


text: The Bank has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Bank's Third-Party Risk Management Program requires an initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of the Information Security team, LNC operates a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with the procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of the operational risk management team's broader periodic review of third parties.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: KILROY REALTY CORP

ticker: KRC


text: We are currently seeking and investigating potential assets, property or businesses to acquire, and currently have no material business operations. As such, we have very limited information technology systems and infrastructure in place to assist with our search with potential assets, property or businesses to acquire. Further, we have very limited cybersecurity measures in place, such as, firewalls and intrusion detection systems.

companyName: Xenous Holdings, Inc.

ticker: XITO


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. The Security Team's experience includes various industry certifications (e.g., CISSP, CISM, CCSP, CISA, etc.), and industry experience (e.g., healthcare, technology, critical infrastructure, etc.).

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: The Company monitors cybersecurity events using multiple methods. The Company's 24/7 Security Operations Center ("SOC") has the ability to detect and respond to threats in real time and is authorized to shut threats down before they can harm the organization. Additionally, the SOC periodically performs pro-active "threat hunts," searching for potential indicators of compromise and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The Chief Information Security Officer is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The Chief Information Security Officer may determine that an incident has the potential to be materially relevant and would escalate that determination to the Cybersecurity Incident Disclosure Team comprised of the senior leaders, including the Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, outside counsel and other leaders and advisors to the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: We do no t presently have any general processes for assessing, identifying, and managing material risks from cybersecurity threats. As we expand our business operations, we plan to develop processes that will allow for the identification and assessment of cybersecurity risk that will be integrated into an overall risk management system, which will be managed by senior management and overseen by the Board of Directors. As part of this development, we plan to identify and address cybersecurity risks related to our business, privacy and compliance issues through a multi-faceted approach that is expected to include third party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with these planned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things, will consider: conducting proactive privacy and cybersecurity reviews of systems and applications, audits of applicable data policies, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security, and implementing appropriate changes.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: The Audit Committee reports to our Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program, including presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: All employees and third parties that have access to our systems or networks are required to adhere to our cybersecurity policy and standards. Our centralized information security group provides education and training. This training includes a required annual online training class for all employees and third parties that have access to our systems or networks, multiple simulated phishing attacks and regular information security awareness materials. Every employee and contractor has a defined role in protecting systems and information of State Street, our clients and others. They are responsible for complying with the information security program, reporting suspected violations and threats; and protecting the confidentiality of information assets of us, our clients and others at all times.

companyName: STATE STREET CORP

ticker: STT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, hardware, software, and our high value data, including intellectual property, trade secrets, confidential and sensitive information (collectively, "Information Systems and Data").

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Our cybersecurity and information technology teams actively maintain a register of risks and mitigation measures under the umbrella of our enterprise risk management program. Our enterprise risk management program is designed to identify and monitor risks to the Company, assess the Company's risk mitigation plans, and consult on further measures that can be taken to address new and existing risks. Our Enterprise Risk Management Committee, which meets quarterly, is comprised of our executive officers, Senior Vice President of Information Technologies and Engineering, Chief Accounting Officer, Vice President of Internal Audit, Corporate Secretary, and Director – Risk Management & Insurance. Our Risk Management and Insurance Department is responsible for the implementation of our enterprise risk management program and maintains a register of risks and initiates reviews and assessments. The Director of Risk Management and Insurance reports to the Audit Committee and full Board on a quarterly basis.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: We carefully manage cybersecurity risks arising from our use of third-party software, cloud services, and suppliers. We perform due diligence and security risk assessments on critical third-party service providers, both at onboarding and periodically during the relationship. Our procurement and legal teams work together to incorporate robust cybersecurity requirements into contracts with vendors (for example, data protection standards and incident notification obligations). Where appropriate, we require suppliers to adhere to our security policies or industry standards, and we conduct ongoing monitoring or audits of their security controls. These steps help reduce the risk that a weakness in a partner's systems could compromise our data or operations.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: The CDIR team monitors and manages key cybersecurity risks, including threats related to third parties, cloud security, malicious code, e-commerce systems, and store technology. It also conducts security reviews, assesses vulnerabilities, and analyzes threat intelligence to strengthen our cyber defenses and incident response efforts.

companyName: lululemon athletica inc.

ticker: LULU


text: Invesco's information security program is led by its Chief Information Security Officer who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and the Trust's information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats.

companyName: Keen Vision Acquisition Corp.

ticker: KVAC


text: Our designated Chief Information Security Officer ("CISO") is responsible for overseeing the performance of our cybersecurity program in partnership with our Chief Executive Officer ("CEO"). Our Vice President of Cybersecurity reports to the CISO.

companyName: Rubicon Technologies, Inc.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and clinical data management and processing service providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a review of certain information security measures of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: Our board of directors is ultimately responsible for overseeing the our risk management activities in general and, as deemed necessary by our management team, will be informed of any cybersecurity threats or risks that may arise. In fiscal year 2024, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy and results of operations.

companyName: Slam Corp.

ticker: SLAMF


text: Our Board of Directors is responsible for the Company's cyber risk oversight. We have established a risk committee (the "Risk Committee") comprised of members of senior management whose responsibilities include identifying, assessing, and managing enterprise-level and material risks to the Company, including strategic, financial, credit, market, liquidity, security, property, information technology ("IT"), cyber, legal, regulatory, and reputational risks. As described in greater detail below, the Risk Committee also assesses and makes the final determination as to whether a cybersecurity incident is material.

companyName: Orion Properties Inc.

ticker: ONL


text: Third parties also play a role in our cybersecurity. We engage third-party services to assist in the scanning and testing of our web properties and cloud infrastructure. We have a retainer with a cybersecurity response organization to immediately respond and provide professional expertise and assistance if necessary. Our process is designed to provide any required notifications in case of a cyber event, including those to federal, state, and local authorities, as well as to our insurance providers and auditors.

companyName: DHI GROUP, INC.

ticker: DHX


text: Roles and Responsibilities Roles and responsibilities for cybersecurity have been established first by VanEck's cybersecurity policy and secondly by its connection to the governance structure of the firm and VanEck's risk management committee (the "Risk Management Committee"), which is comprised of senior-level employees. Cybersecurity is closely aligned with not only risk management, but also with business continuity planning and response.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: While the Board of Directors and Audit Committee oversee cybersecurity risk management, Entergy's management is responsible for managing cybersecurity risk. Entergy and the Registrant Subsidiaries' security-risk-management system, as discussed above, is comprised of a three lines of defense model to enhance risk management efforts and define roles in the security program. The first line of defense, comprised of business units performing operational functions, including the CISO and CIO, is responsible for identification and management of security and reliability risks directly through design, implementation, and execution of control activities. The second line of defense, comprised of the CSO and Chief Security Office, performs and supports security and reliability risk management and governs and oversees the execution of security and reliability controls by the first line of defense. Ownership of specific security operations may migrate from a business unit in the first line of defense to the second line of defense, as determined to be appropriate by the Chief Security Office. The third line of defense, which includes Internal Audit, independent third parties, and certain regulatory constructs, such as the NERC Reliability Standards and the NRC Cyber Rule, provides assurance of selective actions taken by the first and second lines of defense to senior management and the Board of Directors.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Global IT Manager regularly informs the CFO of cybersecurity risks and incidents. Furthermore, significant cybersecurity matters and strategic risk management decisions would be escalated by the CFO to the Audit Committee and the Board of Directors.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Assessment of Cybersecurity Risks As of March 31, 2024, cybersecurity risks have not materially affected the Trust or the Fund's ability to achieve its investment objective, results of operations or financial condition. However, future incidents could have a material impact on our ability to achieve the investment objective, results of operations, or financial condition.

companyName: Franklin Templeton Holdings Trust

ticker: FGDL


text: Board of Directors' Oversight and Management's Role Through the Company's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and information and operational technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and information and operational technology risks. The Board or Audit Committee regularly reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, the Company's Director of Information Systems is responsible for upward reporting of emerging cybersecurity incidents.

companyName: OneWater Marine Inc.

ticker: ONEW


text: The Board and its committees oversee risk through regular reports from management. The Board's committees report on the matters discussed at the committee level to the full Board. The Risk Committee has primary responsibility for cybersecurity oversight. In that capacity, the Risk Committee receives quarterly presentations and reports, as well as additional updates as needed, on cybersecurity matters. Such updates address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, external threat intelligence, technological trends and cybersecurity considerations arising with respect to the Company's peers and third parties. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established internal escalation thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Incident and response reports and lessons learned from any cybersecurity event; and Compliance report with regulatory requirements and industry standards. In addition to scheduled presentations described above, the IT Department contracted CIO, the Chief Administrative Officer and General Counsel, and the President and Chief Executive Officer maintain constant dialogue regarding emerging or potential cybersecurity risks and threats. The Chief Administrative Officer and General Counsel is in regular contact with the Audit Committee Chair related to these risks so that the oversight by the Board can be both proactive and responsive. The Audit Committee has the authority to actively participate in strategic decisions related to cybersecurity and offers guidance and approval for major initiatives. As a result, cybersecurity considerations can be integrated into the foundation of broader corporate objectives. The Audit Committee and the Board conduct an annual review of the Company's cybersecurity risk position and the effectiveness of its risk management strategies and measures. From this review at the Board level, the Company is able to identify areas where there exist improvement opportunities and can set goals for the following year.

companyName: YORK WATER CO

ticker: YORW


text: Arvana's current risk management strategy may not fully account for or mitigate the risks posed by emerging technologies or the potential impact of these limitations on our business. Financial liabilities, damage to our reputation, and erosion of customer trust could negatively affect our business operations and financial condition.

companyName: ARVANA INC

ticker: AVNI


text: Because it is essential to our operations and business strategy that our website, app, technology and network infrastructure remain secure, we have processes in place for assessing, identifying, and managing material risks from cybersecurity threats. We have integrated these processes into our cybersecurity risk management program.

companyName: CarParts.com, Inc.

ticker: PRTS


text: We engage internal auditors and other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Innoviva, Inc.

ticker: INVA


text: Governance of cybersecurity risk management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: The Company's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse the Company's systems or information. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, security assessments, tabletop exercises, and other exercises focused on evaluating effectiveness of the Company's processes and programs. The Company also deploys technical safeguards that are designed to protect its information systems from cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the Company's business. The Company has also developed and periodically updates incident response plans that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation to the appropriate management committees and to the Risk Oversight Committee and full board of directors as appropriate. These incident response plans are coordinated through the ISO and other key members of management, including the Chief Risk Officer.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: The underlying controls of the cybersecurity program are based on recognized practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. RGA periodically engages a third party to perform an assessment of the Company's cybersecurity risk management program against the NIST framework.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: We also have a robust and rigorous oversight process for managing cybersecurity risks related to our third-party service providers. The process includes, conducting due diligence and background checks on the potential service providers, verifying their cybersecurity credentials, capabilities, and track record, establishing clear and specific contractual terms and conditions regarding the Company's cybersecurity expectations, obligations, and the responsibilities of the service providers, and monitoring and auditing the service providers' performance, compliance, reporting and escalation procedures for any cybersecurity issues or incidents identified.

companyName: AGREE REALTY CORP

ticker: ADC


text: To support the head of IT and cybersecurity manager in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 30 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.

companyName: NEOGEN CORP

ticker: NEOG


text: the use of third-party cybersecurity experts, where appropriate, to assess, test or otherwise assist with aspects of our security processes.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having independent cybersecurity experts conduct tabletop exercises, conduct penetration tests, and review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: Fortive Corp

ticker: FTV


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they cannot resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events that our IT and cybersecurity providers do not routinely resolve are brought to the Board's attention.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our VP of Information Technology has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: extensive IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The VP of Information Technology provides regular reports on ongoing risk and mitigation practices to our COO and CFO, who then reports to the Board. Our incident response policy, which is updated from time to time, provides that management reports to the Board in the event of any detected material incident and regularly updates them on the mitigation and remediation steps being taken in connection with the Company's response.

companyName: ORTHOPEDIATRICS CORP

ticker: KIDS


text: Management Leadership Team, with oversight from the Board of Directors, plans to further implement a comprehensive cybersecurity program, including incident response process, aligned with the NIST Cybersecurity Framework and NIST Computer Security Incident Handling Guide (NIST SP 800-61) to assess, identify, address and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.

companyName: VirTra, Inc

ticker: VTSI


text: Assessment and management of cybersecurity risks is a key component of CRH's broader risk governance processes as cybersecurity is a core risk facing the Company. Identification of cybersecurity risks is integrated into CRH's overall ERM framework, with a focus on risks related to information systems, data security, operational technology and technology infrastructure.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: The Company is not aware of risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, which have materially affected the Company, including its business strategy, results of operations, or financial condition.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: Our board of directors has delegated to the audit committee, which is comprised of entirely independent directors, the responsibility to oversee our cybersecurity programs and cyber-related risks. Specifically, audit committee delegation under its formal written charter includes the responsibility to oversee the integrity of our IT systems, processes and data, and review and assessment with management (i) the adequacy of controls and security for our IT systems, processes and data, and (ii) our contingency plans in the event of a breakdown or security breach affecting our IT systems.

companyName: Silk Road Medical Inc


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a cybersecurity incident response plan, incident detection and response, a disaster recovery and business continuity plan, risk assessments, implementation of security standards, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and systems monitoring.

companyName: Regulus Therapeutics Inc.


text: The Company has established clear lines of communication with key stakeholders, including executives, IT teams, employees, and customers, to ensure transparency and an effective response to cybersecurity incidents.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: The Company provides regular cybersecurity training for employees to enhance awareness of common threats, such as phishing and ransomware. All Journal Technologies employees undergo annual CJIS training and certification.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: The CISO is supported by a team of highly technical and experienced security professionals who are responsible for implementing and maintaining the security program for 1st Franklin, including security engineers and a cybersecurity analyst.

companyName: 1st FRANKLIN FINANCIAL CORP


text: Third Party Monitoring and External Reviews Axon utilizes the assistance of third-party technology and providers to support our objective of protecting our information, information systems and network. Services provided by third parties to assess the performance of our cybersecurity risk management systems and procedures and to identify cybersecurity risks to the Company include assessing products and internal systems for vulnerabilities, incident response services such as computer forensics, internal and external audits for security certifications globally and overall security program maturity evaluations. Axon and our service providers have also developed systems and processes that are designed to protect our and our customers' data, to prevent data loss, and to prevent or detect cybersecurity threats and incidents.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Our processes for identifying, assessing and managing material risks from cybersecurity threats are integrated into our overall risk management systems and processes and include cybersecurity risk assessment surveys, interviews of our personnel responsible for cybersecurity and ongoing development of cybersecurity risk mitigation plans based on program assessment.

companyName: agilon health, inc.

ticker: AGL


text: In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including sensitive personal information as well as proprietary or confidential information relating to our business or a third-party with which we do business. The protection of information and business processes is an integrated component in our overall risk management program, and reflected in our Code of Ethics, security standards, and privacy policies. We employ processes to safeguard information and protect our customers' data, including by deploying both proactive and defensive practices against the evolving cyber threat landscape. Examples of these processes include: a. Employing a qualified Chief Information Security Officer. b. Maintaining tools to identify malicious cyber activity. c. Monitoring risks posed by threat actors, including through partnerships with industry groups and government agencies. d. Providing annual cybersecurity training to our associates. e. Testing our associates' knowledge through internal phishing simulations.

companyName: HUMANA INC

ticker: HUM


text: These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: From time to time, we and OpCo experience cybersecurity threats and attempted breaches and other incidents. Westlake classifies and tracks these events based on significance and implements remediation actions that it considers appropriate to address the risks to the Partnership and OpCo relating to such incidents. Although we and OpCo have not experienced material impacts to our business strategy, results of operations or financial condition from any such incidents in the past three years, we cannot guarantee that a material incident will not occur in the future. See "Item 1A. Risk Factors—Failure to adequately protect critical data and technology systems could materially affect our operations."

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall enterprise risk management processes. The processes for assessing, identifying and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include identifying the relevant assets that could be affected, determining possible threat sources and threat events, assessing threats based on their potential likelihood and impact, and identifying controls that are in place or necessary to manage and/or mitigate such risks.

companyName: DEXCOM INC

ticker: DXCM


text: Our cybersecurity risk management program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) and is aimed to assess, identify, and manage risks from cybersecurity threats. The processes comprising our cybersecurity risk management program include risk assessments, vulnerability scanning and penetration testing, threat intelligence monitoring, and employee training and awareness programs. To respond to and handle cybersecurity incidents, we have implemented and maintain a comprehensive incident response process that is regularly tested and updated.

companyName: Waystar Holding Corp.

ticker: WAY


text: Our cybersecurity program also includes third-party assessments to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk assessments during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity governance and risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors.

companyName: Intapp, Inc.

ticker: INTA


text: The Company has an Information Security Team composed of employees and a managed detection and response partner providing 24/7 coverage. Additionally, the Company utilizes third parties to assist with penetration testing, attack simulation, threat intelligence reporting, detection and incident response, as well as review and enhancement of associated response plans and processes.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Our Executive Director of Information and Technology Services ("IT Director"), who reports to our Chief Financial Officer, is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our IT Director has multiple university certifications in advanced cybersecurity with over 30 years' experience in cybersecurity and technology roles, most of which have been held with the Company. Meetings of our Risk Management Committee and Board of Directors include discussions and presentations from management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management on our enterprise risk profile on an annual basis. The Board of Directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: our incident response plan, incident detection and response procedures, disaster recovery and business continuity plans, encryption of certain data, network security controls, data segmentation, access and physical security controls, asset management and disposal, monitoring of our systems, employee training, and maintaining cybersecurity insurance.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: Risks from Cybersecurity Threats To date we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to affect our business, including our business strategy, results of operations or financial condition.

companyName: Redfin Corp


text: We periodically engage assessors, consultants, auditors, and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. These assessments provide insight into areas of future improvement in risk mitigation and further program development. In addition, we rely on third parties for various business functions and oversee such third-party service providers by conducting vendor diligence upon onboarding as well as ongoing monitoring.

companyName: CABOT CORP

ticker: CBT


text: Our audit committee receives updates from management of our cybersecurity threat risk management and strategy processes. The audit committee receives information regarding current and emerging material cybersecurity threat risks and our ability to mitigate those risks. Our board of directors receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: HVII is a SPAC with no business operations. Since its initial public offering, its sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, HVII does not consider that it faces significant cybersecurity risk and has not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Hennessy Capital Investment Corp. VII

ticker: HVII


text: Risk Management and Strategy RPC approaches cybersecurity as an enterprise-wide risk and has created an accountability framework that includes oversight of cybersecurity risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, RPC uses the Center for Internet Security (CIS) Controls framework to provide best practices for securing IT systems and data. We have implemented a majority of version 8.0 of the CIS Controls which supports a Zero Trust architecture. RPC has created a cross-departmental team to continuously monitor and screen Company vendors (also known as partners and managed service providers) for vulnerabilities on their own systems and compliance with RPC's policies and procedures, to mitigate risks potentially caused by third party breaches. We have completed an initial risk assessment for each vendor and identified an external cybersecurity firm to further assist with this initiative that is being guided by CIS Control Standards.

companyName: RPC INC

ticker: RES


text: Overseeing Third-Party Risk Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Signing Day Sports, Inc.

ticker: SGN


text: IT Director has overall responsibility for our information security program, with support from our management team and specialized partners in cybersecurity incident response and privacy. The process includes managing our incident response strategy. If a cybersecurity incident meets certain criteria, however, our CEO and CFO will become involved with the response strategy, including decisions about public disclosure and reporting. Our IT Director also coordinates with our CEO and CFO to determine strategic cybersecurity priorities and to establish believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our IT Director has served in various roles in information technology and information security for over a decade, which includes experience in the biotech, pharmaceutical and healthcare industries and experience in cybersecurity risk management and data privacy the ordinary course of our business, we, and the third parties upon which we rely, collect, process, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and store (collectively, "process") proprietary, confidential, and sensitive information, including protected health information, personal information, credit card and other financial information, or other sensitive information owned or controlled by ourselves or our customers, payors, and other parties.

companyName: Celcuity Inc.

ticker: CELC


text: The Board and the committees of the Board oversee our risk profile and exposures relating to matters within the scope of their authority. Among other matters, the Audit Committee is charged with oversight of Resideo's risks relating to enterprise-wide cybersecurity, including review of the state of the Company's cybersecurity policies and programs and steps management has taken to monitor and control such exposures. Cybersecurity review with the CISO is a regular standing calendar item of the Audit Committee in connection with its overall ERM program oversight. In addition, our Audit Committee provides oversight of our product technology and software cybersecurity program. The Audit Committee, together with the CISO, provide the full Board with visibility into the risks that impact us and the plans to mitigate them. The CISO's reports to the committees and the Board include insights on operations, business cyber risks, emerging threats and key strategic initiatives driving improved security capabilities, and special topics around what the Company is doing to strengthen Resideo's security posture. Resideo Technologies, Inc.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: We recognize the critical importance of maintaining the safety and security of our systems and data and we take a holistic approach to the oversight and management of cybersecurity and related risks. This approach is supported by our Board of Directors and management who are actively involved in the oversight of our risk management program.

companyName: Legacy Education Inc.

ticker: LGCY


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, including clinical trial data ("Information Systems and Data").

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: As of the September 30, 2024, we have not identified any material weaknesses in our cybersecurity controls. Our ability to protect our business from cybersecurity risks is subject to uncertainty, and there can be no assurance that our cybersecurity measures will prevent all potential attacks.

companyName: GEE Group Inc.

ticker: JOB


text: Our CISO, who reports both to our Chief Risk Officer and our Chief Information Officer, manages the Bank's information security and cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our CISO has more than 15 years of experience in cyber security matters, including over 14 years in information technology with the Bank in roles of increased responsibilities. Our information security department executes our cybersecurity risk management program, and is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our Board of Directors. Our threat and incident response team, a subset of our information security department, is responsible for responding to potential threats that may require a system change, modifications and other methods to maintain business continuity to minimize cybersecurity threats. Personnel in the security program hold a variety of technical certifications relevant to their job functions and engage in continuing education.

companyName: Federal Home Loan Bank of Chicago


text: The Company uses a reputable third-party managed service provider ("MSP") for cybersecurity support, which has operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. The Company's MSP is staffed with several security personnel, many of which have Certified Information Systems Security Professional ("CISSP") certifications.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: We maintain a cybersecurity policy, reviewed with our audit committee, which is designed to address cybersecurity risks to us (including by escalating certain cybersecurity incidents to members of management and the board of the audit committee, in each case depending on the circumstances). We also maintain incident response procedures designed to assist us in responding to cybersecurity incidents.

companyName: Annexon, Inc.

ticker: ANNX


text: Our CISO has over fifteen years of experience in information security, serving in roles of increasing responsibility within public and private companies. As part of our information security program, we have an incident response program that coordinates activities across multiple teams in responding to cybersecurity incidents in accordance with a defined Cyber Security Incident Response Policy. Each of these teams are managed by experienced and credentialed professionals with knowledge in their fields and the teams comprise a security operations center to detect, analyze, and escalate cybersecurity events, a cybersecurity incident response team to own containment and recovery activities, and a crisis response team to liaise with business stakeholders, secure priority resources, and validate completion of any post incident activities. These teams inform our CISO of all material events and key developments and coordinate with other teams, such as the Information Technology, Legal and Privacy teams, as appropriate for analysis and compliance with legal and contractual obligations. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct initial due diligence on the cybersecurity profile of our vendors as they are onboarded and utilize third-party software to provide continuous monitoring and scanning of critical third-party infrastructure and to monitor any known breaches of those third-party systems. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.

companyName: Alteryx, Inc.


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from our Chief Information Officer ("CIO"), internal security staff and/or external experts, as appropriate, as part of the Board of Directors' continuing education.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our cybersecurity risk management program is led by our Chief Legal and Administrative Officer (CL&AO), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. The CL&AO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks. We continue to secure our own manufacturing and information technology infrastructure; to train our employees throughout each year about malware, viruses, hacking, phishing, and other information security risks, including how to avoid and mitigate them; and to protect our sensitive data from failures, breaches, or cyber incidents. We periodically (more than annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Communication, Coordination and Disclosure: We take a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management, internal audit and other key business functions and engage with our Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the assessment and escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: BOYD GAMING CORP

ticker: BYD


text: As a government contractor, we must comply with extensive cybersecurity regulations, including the DFARS related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. The policies and controls we have implemented to date reflect our adherence to these requirements and have been assessed by external organizations, including industry partners.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance, model and data, and reputational risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for system failure, interruption, or a cybersecurity breach to occur, which could disrupt business operations or compromise confidential, personal, sensitive or proprietary information. Our CISO is primarily responsible for this cybersecurity component and is a key member of the organization, reporting directly to the CIO (who then reports directly to our Chief Executive Officer) and, as discussed below, periodically to the Innovation and Technology Committee, Enterprise Risk Committee and to our Board of Directors. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: The Audit Committee of the Board of Directors has the responsibility of overseeing the Company's cybersecurity risks. The Director of Information Technology provides periodic updates to the Board of Directors regarding actions taken to mitigate the Company's exposure and protection from cybersecurity risks. Management routinely evaluates the Company's security processes, procedures, and systems to determine if enhancements are needed to reduce the possibility of a future cybersecurity event. This includes safeguards implemented by the Company, such as a multi-factor authentication process; restricted firewall settings; network monitoring, email phishing tests, and enhancing the Company's backup recovery strategy, among others.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: We believe cybersecurity is critical to advancing our technological developments. We face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Aditxt, Inc.

ticker: ADTX


text: We engage third party cybersecurity firms to support our in-house cybersecurity initiatives and provide additional expertise with respect to our cybersecurity programs. Such firms are overseen by our General Counsel and Chief Information Security Officer and provide the following services: • On an annual basis, conduct penetration testing to evaluate the susceptibility of our information systems to cybersecurity threats and the effectiveness of our cybersecurity program; • On a biennial basis, conduct a comprehensive "tabletop" exercise to evaluate our incident response policies and procedures and provide relevant experience for our employees tasked with executing such response; and • On a biennial basis, conduct a cybersecurity assessment based on the National Institute of Standards and Technology's Cybersecurity Framework.

companyName: EMCOR Group, Inc.

ticker: EME


text: The Information Security team performs internal threat hunting, vulnerability scanning, log aggregation, and identity monitoring on an on-going basis. Web site, code, and configuration vulnerability scans are performed as necessary to ensure that changes do not introduce vulnerabilities into our systems. Information Security and IT Risk personnel receive regular training to ensure these individuals have up-to-date expert knowledge.

companyName: Mistras Group, Inc.

ticker: MG


text: The CICSO has over three decades of technology experience, working for leading technology and consulting companies and previously served as chief information and cybersecurity officer for both public and private medical device and healthcare organizations. Our cybersecurity team includes a former chief information security officer for large healthcare organizations, a former head of global security for a major enterprise cybersecurity platform, and other similarly credentialed professionals. Our CICSO reports to the Chief Financial Officer and provides regular reports to the Audit Committee on cybersecurity policies, procedures, and risk and remediation efforts. Our CICSO also serves on our Disclosure Committee and has regular dialogue with the senior management team on information security matters and risk management practices.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: The Board of Directors of the Company (the "Board") considers cybersecurity risk as part of its overall risk oversight function. The Board receives updates from the CFO regarding the Company's cybersecurity risk management program at least annually. These include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: Cybersecurity risk management is an important priority integrated into our overall governance structure. Our Board of Directors oversees risks from cybersecurity threats and includes the involvement of the Audit Committee in the governance strategy.

companyName: CarParts.com, Inc.

ticker: PRTS


text: To address risks associated with third parties, Prudential has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: The Board of Directors, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board of Directors and Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Sarbanes-Oxley & Cybersecurity Steering Committee, which includes the Company's President and Chief Financial Officer ("CFO") and Vice President of Information Technology.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Our process for identifying and assessing material risks from cybersecurity threats (our "Cybersecurity Process") operates alongside our broader overall risk assessment process, covering other risks facing the company. As part of our Cybersecurity Process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: DROPBOX, INC.

ticker: DBX


text: Our cybersecurity risk management program and strategy also includes: • a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information protection and broader enterprise IT environment; • the use of reputable cybersecurity consultants and other experienced third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so we can maintain a posture of continual enhancement of our cybersecurity risk management program and strategy; • continuous and updated cybersecurity awareness training for our employees, incident response personnel and senior management; and • a risk management process for critical third-party service providers and vendors that includes due diligence in the selection of third-parties and vendors and the periodic monitoring thereof to ensure that they adhere to applicable cybersecurity standards.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: Management and Strategy has adopted cybersecurity principles modeled after its parent company, Eureka, which outsources its IT support to a third-party provider.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: We also have a cybersecurity incident response plan to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident, including, where appropriate, escalation to the Risk Committee and the Board. We periodically perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities, and assess team preparedness.

companyName: F5, INC.

ticker: FFIV


text: We have established a rigorous third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information. This ensures that our partners adhere to our cybersecurity standards and do not introduce vulnerabilities into our environment.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Material Cybersecurity Risks, Threats & Incidents The Company relies on information technology and third-party vendors to support its operations, including its secure processing of personal, confidential, sensitive, proprietary and other types of information. The Company and its vendors may not be able to protect all of their respective information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. While the Company has not experienced any material cybersecurity incidents, there can be no guarantee that it will not be the subject of future successful attacks, threats or incidents.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Our operations rely on third-party service providers and software programs. For instance, our accounting and financial reporting-related systems use software obtained from third-party service providers, and these systems are necessary for the efficient and consistent operation of our business. We use these systems to communicate with tenants, banks, vendors, and others, and to manage our accounting, financial reporting, and for other recordkeeping purposes. We, thus, maintain a process to identify and evaluate cybersecurity risks and incidents associated with key third-party providers.

companyName: MAYS J W INC

ticker: MAYS


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, such as malware infections, phishing campaigns, ransomware and vulnerability exploit attempts, which to date have not had a material impact on our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation" in Item 1A - Risk Factors.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by the Enterprise Information Security Steering Committee, led by the CISO. The CISO leverages his 15-plus years of experience building and leading cybersecurity programs and teams. The CISO has experience as a Chief Information Security Officer in multiple industries and has received Certified Information Systems Security Professional ("CISSP") and Certification in Risk Management Assurance ("CRMA") certifications. The CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation and response to cybersecurity threats and incidents and is responsible for determining if the cybersecurity program is functioning effectively in the face of evolving cybersecurity threats.

companyName: ROBERT HALF INC.

ticker: RHI


text: Our IT Director and ISO are primarily responsible for the cybersecurity component and are key members of the ERM program, reporting directly to the Chief Operating Officer and Chief Executive Officer, respectively. Both our IT Director and ISO engage with our information security team to accomplish the goals of the cybersecurity component of our ERM program. The information security team consists of information security professionals with varying degrees of education and experience. In particular, our IT Director and ISO are both qualified professionals with appropriate education, experience, and professional certifications. Each has more than 20 years of experience in the fields of IT and data security and hold relevant professional certifications that ensure expertise in preventing, detecting, and managing cyber risk.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: In an effort to prepare for and respond to system failures, interruptions or cybersecurity breaches, the Company has implemented a multi-layered cybersecurity program that integrates people, technology, and processes and is intended to comply with the information security standards established pursuant to the Gramm-Leach-Bliley Act (GLBA) 12 CFR 364, Appendix B. This cybersecurity program includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts that penetrate, disrupt or misuse our systems or information. The cybersecurity program is built upon a foundation of advanced security technology, our internal employee team, and operations based on industry best practice and recommendations from the National Institute of Standards and Technology (NIST) Cybersecurity Maturity Framework, Federal Financial Institutions Examination Council (FFIEC) Guidelines, and Center for Internet Security (CIS) Benchmarks. This consists of controls designed to govern, identify, protect, detect, respond and recover from system failures, interruptions, and cybersecurity breaches. Our CISO and our CIO, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The cybersecurity program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Criteo assesses and manages its cybersecurity risks in part through executive committees. The Governance Risk and Compliance Committee (the "GRCC"), composed of the CISO and certain members of our executive and leadership teams, meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators ("KPIs"). The Information Security Committee (the "ISC"), a security-focused governance body including senior managers across the Company on information security activities, meets regularly to receive updates on KPIs and to review relevant standards and policies.

companyName: Criteo S.A.

ticker: CRTO


text: Management Oversight Senior management's Technology Committee, includes the CIO, the CISO and other senior executives who oversee the Company's enterprise IT infrastructure and ensures that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The Technology Committee, the CIO and the CISO periodically provide cybersecurity reports about our Cybersecurity Program to senior management's Executive Committee and the board of directors and its Risk Committee.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We maintain an Enterprise Cybersecurity Incident Response Policy to address cybersecurity incidents. The Policy is tested on a periodic basis, including an ongoing improvement program involving periodic tabletop exercises. Cybersecurity incident handling is managed by individual organizations with cybersecurity responsibility and monitored/guided by applicable corporate functions. All Cybersecurity Incident Response Plans under the Policy are based on industry standards, such as the NIST Computer Security Incident Handling Guide – Special Publication 800-61.

companyName: PTC INC.

ticker: PTC


text: The Board considers cybersecurity as part of its broader consideration of business strategy and enterprise risk management. It is the responsibility of the Risk Management Committee ("RMC"), a committee of the Board, to oversee efforts to develop and formally approve the written Information Security Program ("ISP"), implement, maintain and monitor the program, and review management reports and policies related to cyber incidents. The RMC is led by our Chief Risk Officer and comprised of Board members as well as the Chief Executive Officer. Cybersecurity risks are reported to the RMC at least quarterly and those reports include key performance indicators, test results, recent threats and how the Company is managing those threats, along with the effectiveness of the ISP. The RMC receives briefings from executive management on activities, including those related to cybersecurity risk oversight. The Board reviews the overall ISP at least annually.

companyName: NBT BANCORP INC

ticker: NBTB


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. See Item 1A. "Risk Factors— Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation " for more information regarding cybersecurity risks and the potential impact on the company.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: As of February 1, 2025, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, cash flow or financial condition.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Furthermore, our IT security infrastructure and cybersecurity policies are designed to monitor and manage security risks associated with any third-party service providers, suppliers, software and hardware vendors, contractors, and consultants we collaborate with (hereinafter, collectively, Vendors) who might store, process, collect, share, create, transmit, destroy, or access any of our sensitive data. Our Vendor Management Policy establishes clearly defined requirements of engagements with Vendors and requires them to uphold similar security standards to those we internally require. Depending on their risk level, we may subject certain Vendors to heightened security requirements, such as enhanced risk assessments, ongoing monitoring, or additional contractual controls to restrict their levels of information access.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: In the ordinary course of our business, we collect and store sensitive data, including IP, proprietary business information of ours and that of our suppliers and licensees, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our licensees and third-party providers also possess certain of our sensitive data. The secure maintenance of such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS