text: Additionally, effective December 9, 2022, amendments to the GLB Act's Safeguards Rule went into effect. That rule requires financial institutions to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors. Additionally, multiple states and Congress are considering laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: Axel Schwan. Mr. Schwan was appointed as President, Tim Hortons Canada & US in October 2019 after serving as Global Chief Marketing Officer for Tim Hortons since October 2017. Mr. Schwan first joined RBI as Marketing Director, Germany, Austria and Switzerland in 2011 and was then appointed as Vice President, Marketing and Communications, EMEA for Burger King before advancing to the role of Global Chief Marketing Officer for the brand in January 2014. Prior to joining RBI, Mr. Schwan led the Schwan family restaurant business, alongside his sister, and worked in various marketing roles at Unilever and Danone in Germany.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF

secItem: Item 1C


text: We engage third-party consultants in connection with our cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. These third-parties provide testing and advisory services to identify risks, improve the quality of controls, and ensure JLL is well-positioned to respond to cybersecurity incidents.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: We perform analysis of security requirements for all systems and applications throughout their lifecycle, including for new systems and applications and significant upgrades to existing systems and applications. All new or upgraded systems and applications are tested for stability, compatibility, and security integrity in a separate environment prior to introduction into our production environment.

companyName: Clene Inc.

ticker: CLNN


text: Our management team, including specifically our Chief Financial Officer, working closely with our Vice President of Information Technologies and our Director of Cybersecurity and Compliance (our Cybersecurity Oversight Team), is responsible for assessing and managing our material risks from cybersecurity threats. Our Cybersecurity Oversight Team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Oversight Team's experience includes a combined 50+ years in the pharmaceutical industry and information technology. This includes software and systems development, cybersecurity program oversight and overall IT management. The team has over two decades of experience dedicated to supporting enterprise architecture and a decade of experience specializing in cybersecurity, implementing cybersecurity frameworks, assessing and managing cybersecurity risks and executing incident response plans.

companyName: Nuvalent, Inc.

ticker: NUVL


text: We utilize cross-functional teams and risk assessment tools and technologies to identify potential cybersecurity and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization's cybersecurity and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: Material Affects of Cybersecurity Incidents Except as described in the section entitled "Risk Factors" included in Part I, Item 1A, including, without limitation, the risk factor above titled "We face four primary risks relative to protecting critical information: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of our being unable to identify and audit our controls over the first three risks. In addition, an application, data security or network incident may allow unauthorized access to our systems or data or our customers' data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results" risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. In this instance, materiality is defined as an adverse impact to our critical information, which could result in significant legal and financial exposure.

companyName: CareDx, Inc.

ticker: CDNA


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including conducting scans of the threat environment and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats, including risk assessments, incident detection and response, end-point detection and response, network security controls, access controls, physical security, systems monitoring, a vendor risk management program, and penetration testing. We work with third parties (including professional services firms, threat intelligence service providers, and penetration testing firms) from time to time that assist us to identify, assess, and manage cybersecurity risks.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: The Company established an Enterprise Risk Management (ERM) Committee that employs the International Organization for Standardization (ISO) risk management standards. Members of the ERM Committee include the Company's CSO, Chief Financial Officer, Chief Network Officer, Director of Safety and Risk Management and the Director of Internal Audit. The committee leverages a risk management tool to maintain a risk register, which systematically identifies, assesses, prioritizes, and manages risks within the enterprise. This structured approach enables us to conduct a formal, periodic risk assessment, ensuring the continuous enhancement of our security posture. In addition to threats, vulnerabilities, impacts and costs, the risk assessment process also identifies the costs and effectiveness of countermeasures and action plans to reduce risk.

companyName: CINCINNATI BELL INC


text: Management and Strategy one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.

companyName: MBC FUNDING II CORP.


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.

companyName: VIVIC CORP.

ticker: VIVC


text: Our Board has the primary responsibility to oversee cybersecurity matters. The Board periodically reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board receives reports from the members of our management team responsible for executing our cybersecurity program, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board discusses with such members of our management team our information technology systems and procedures on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board in a timely manner.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: At least annually, our third-party IT and cybersecurity firm conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Within the firm's global risk department, governance processes are established, including a formal Supplier Risk Management program overseeing third-party relationships based on documented risk thresholds. The Supplier Risk Management program performs regular assessments, including information security reviews. Ongoing monitoring is performed through our centralized risk function as well as by business line supplier managers to raise new threats or weaknesses associated with a third-party service. In accordance with our Enterprise Incident Management Policy, any third-party cybersecurity incident is reported and evaluated for further review and impact analysis.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: One of the functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole and through its committees.

companyName: Clarus Corp

ticker: CLAR


text: Our cybersecurity program is designed to detect and prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, efficiently remediate and recover from cybersecurity incidents and ensure compliance with regulations and disclosure requirements. Pursuant to our processes, when a cybersecurity incident occurs, we convene a cross-functional incident response team whose membership is dictated by the severity of the incident but in all instances includes representatives from our information technology, legal and accounting departments. This cross-functional representation allows us to leverage diverse perspectives and expertise when addressing cybersecurity events and to analyze the potential financial, legal, operational, and reputational implications of an incident, thereby enabling us to make informed decisions and take appropriate actions. This incident response framework further enables us to quickly assess the severity of cybersecurity incidents and the materiality of incidents based on pre-defined criteria that considers both quantitative and qualitative factors to determine the appropriate response. Identified incidents are then escalated to the relevant management teams based on their severity, allowing for a swift determination of materiality and an effective mitigation process. If we determine that an incident is not material, we continue to monitor it for subsequent developments.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: The Board engages in oversight of cybersecurity risks. With the input of the InfoSec Committee, our CISO may provide periodic updates to the Board on matters related to cybersecurity as needed.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. Our cybersecurity and risk management program is developed based on: • Continuous Development: Ongoing refinement of our risk management processes. • Partners and Tools: Leveraging global access control and activity monitoring solutions. • Education and Training: Implementing company-wide policies and proactive user training. • Continuous Monitoring: Regular surveillance of our environment. • Access Management: Ensuring only authorized users have access to our Zero Trust approach network implementation.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Notwithstanding any of these measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "We are subject to data security and privacy risks that could negatively affect our business operations, results of operations or reputation" in Item 1A. "Risk Factors."

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Our cybersecurity risk management strategy relies on input from management, including our Vice President, Head of Computational & Structural Science, who reports directly to our Chief Technology Officer, and has over 10 years of experience in developing and implementing cybersecurity strategies for companies in the biopharmaceutical industry, as well as our Chief Financial Officer and Chief Legal Officer and General Counsel. We have also formed an Information Risk Assessment Committee, or IRAC, consisting of senior members of the finance, legal, operations and information technology functions, to oversee the management of information security as a whole, including integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees. The IRAC meets on a regular basis, generally quarterly, to discuss cybersecurity risk and to review our cybersecurity program.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see "System failure, information leakage and the cost of maintaining sufficient cybersecurity could adversely affect our business" in Item 1A — "Risk Factors."

companyName: WYNN RESORTS LTD

ticker: WYNN


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer with guidance from external security consultant. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant degrees and certifications, including Certified Information Security Manager and Certified CISO. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Our cybersecurity program uses layered security defenses, cyber resiliency and automation capabilities for our security functions and operations. Our cybersecurity roadmap outlines and defines the security initiatives, projects and tasks. All security efforts and projects are discussed by the SSC. Security events are identified via multiple channels, including without limitation security detection mechanisms, near real-time system alerts, out-of-bound channels and dark web monitoring. Our employees and vendor partners are also trained to report any security events to the cybersecurity team, who will escalate and notify the legal team, senior executives, and Board of Directors as needed.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding cybersecurity incidents, that we experience. The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: BurgerFi International, Inc.


text: The Company maintains a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. These include risks relating to disruption of business operations or financial reporting systems, intellectual property theft, exposure to fraud or extortion, harm to employees or customers, violation of privacy laws or other regulatory and compliance lapses, reputational risk, and inability to consistently deliver digital technologies. For more information on the Company's risks related to cybersecurity, refer to "Risk Factors" in Item 1A of this Annual Report on Form 10-K.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: As part of its broader approach to risk management, Cheniere's cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Cheniere's strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, Cheniere routinely evaluates opportunities to refine its cybersecurity program in order to mitigate operational network risks. Cheniere includes business continuity planning as a component of its strategy to help ensure critical systems are available to support the Company in the instance of a disruptive event. Cheniere also participates in various industry organizations to stay abreast of recent trends and developments.

companyName: Sabine Pass Liquefaction, LLC


text: Our management team, led by the newly appointed Chief Information Security Officer (CISO) and supported by leaders from our Global Information Technology, Information Security, and Information Technology Compliance organizations, oversees the assessment and management of material risks associated with cybersecurity threats. This includes directing our comprehensive cybersecurity risk management program, supervising internal cybersecurity personnel, and collaborating with external cybersecurity consultants to maintain a robust and adaptive security posture, as well as strengthening our cybersecurity framework and ensuring alignment with evolving regulatory requirements and industry best practices. These efforts underscore our commitment to proactively managing risks and safeguarding critical assets in an increasingly complex threat landscape.

companyName: Callaway Golf Co

ticker: CALY


text: The Bank is subject to cybersecurity risks, which includes intentional and unintentional acts that may affect the availability, confidentiality, and integrity of our information systems, including any information residing therein, or services. The Bank has, in alignment with industry standards and Finance Agency regulatory guidance, implemented processes, as set forth in its cybersecurity risk management framework, for identifying, assessing, and managing material risks from cybersecurity incidents that may directly or indirectly impact the Bank's business strategy, results of operations, or financial condition. Please refer to "Item 1.A Risk Factors - Operational Risks" for a description of potential cybersecurity threat risks.

companyName: Federal Home Loan Bank of San Francisco


text: A threat actor representing to be the Sphere 3D CFO inserted themselves into an email exchange between the Sphere 3D CFO and the Company's CEO, which also included Sphere 3D's CEO, regarding the transfer of Sphere 3D's BTC from the Company's wallet to Sphere 3D's wallet. The threat actor requested that the BTC be transferred to an alternate wallet. As a result, 26 BTC, with a value of approximately $560,000 at the time, was transferred to a wallet controlled by the threat actor. Via counsel, Gryphon engaged with US Federal law enforcement to recover the BTC. Despite these attempts by law enforcement to recover the BTC, recovery was not possible.

companyName: American Bitcoin Corp.

ticker: ABTC


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our Director of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: The Company, like many retailers, relies upon third-party service providers, such as payment processors, network providers and application providers, that have faced risks from threat actors and cybercriminal groups that seek to steal payment card data, consumer data, and other sensitive information; disrupt critical information technology systems; and/or demand ransom payments. Although the Company has implemented security measures and controls designed to address these risks, if these risks were to materialize, such as in the event of a cybersecurity incident causing the networks of a third-party payment processor to not be operational, the impact to the Company could be material.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Our Board of Directors is responsible for oversight of risk management, including cybersecurity risks. The Audit Committee is updated on current cybersecurity events, metrics and other technology risks by our Vice President of Management Information Systems and Director of Infrastructure and Security on a quarterly basis, and all material risks and threats are reported immediately. The Audit Committee, in turn, provides the Board of Directors with updates regarding cybersecurity risks as it deems necessary or appropriate.

companyName: VOXX International Corp


text: We also conduct exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals collaborates with technical and business stakeholders across our business units to further analyze the risks to the company and form detection, mitigation and remediation strategies.

companyName: Bandwidth Inc.

ticker: BAND


text: The Bank's approach to cybersecurity risk management relies upon having the right people, processes, and technology in place to govern, identify, protect, detect, respond, and recover from cybersecurity risks/threats/incidents. The Bank's cybersecurity program aligns with industry standards, specifically the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the NIST 800-53 control framework. The effectiveness of the Bank's cybersecurity program is measured through internal and external audits, Finance Agency regulatory oversight and other third-party control and compromise assessments such as periodic penetration tests and various security assessments. In addition, the Bank's cybersecurity program includes processes and technologies that enhance its ability to detect and respond to cybersecurity threats, including the use of automation, threat intelligence feeds, robust incident response procedures and frequent vulnerability scans and remediation. The Bank's Vulnerability Management Group, which is comprised of members from Information Technology ("IT") Security, IT Infrastructure and Operational Risk Management, meets regularly to discuss details of the Bank's vulnerability management program including, but not limited to, current threats and vulnerabilities, patching status, upcoming technology changes, and current issues or concerns, if any.

companyName: Federal Home Loan Bank of Dallas


text: Our critical business systems are fully redundant and backed up at separate locations. Separate business and SCADA networks allow for isolation of potential threats and enhances the security of these systems. Our security systems correlate security events and aggregate security-related incident data, such as malware activity and other possible malicious activities. This system sends alerts if the data analysis shows that an activity could be a potential security issue. Security functionality is continuously monitored by our network operations center, and our network traffic is analyzed for signs of malicious activity through the CyberSentry program, which is managed by DHS's Cybersecurity and Infrastructure Security Agency and a third-party security operations center, which operates continuously. We maintain a dedicated SCADA group within our IT department to evaluate and respond to significant events and incidents that may impact our operations. Anti-virus solutions are deployed on the SCADA systems and workstations in our data centers and control centers.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Monitoring Cybersecurity Incidents The company utilizes various industry-leading systems to provide 24/7 threat detection and response capability, many of which provide proactive measures to shut threats down before they can harm the organization. Additionally, the company's incident response team periodically performs proactive measures, searching for potential indicators of threats, compromise, and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The ISO is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat is immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The ISO may determine that an incident has the potential to be materially relevant and would escalate that determination to the executive management, including Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, and other leaders and advisors of the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.

companyName: OP Bancorp

ticker: OPBK


text: The Chief Legal Officer acts as the Company's Data Breach Coordinator and leads our Cyber Crisis and Data Breach Response Committee (the "Committee") which consists of the Company's Chief Information Officer, Chief Financial Officer and Chief Accounting Officer. Cybersecurity incidents that may significantly impact the confidentiality, integrity, or availability of the Company's data or the reliability of the Company's systems or networks are reported to the Committee. The Committee assesses the materiality of each incident, which is made using both quantitative and qualitative analyses to determine an incident's immediate and reasonably likely future impacts. Such cybersecurity incidents are also reported to the Audit Committee. The Company's Data Governance Committee has oversight of that how the Company's data is handled and shared with third parties and is comprised of the Company's Chief Information Officer, Chief Legal Officer, Chief Human Resources, Chief Accounting Officer, Senior Vice President of Business Shared Services and Chief Audit Executive.

companyName: BrightView Holdings, Inc.

ticker: BV


text: Third parties also play a role in our cybersecurity. We engage third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.

companyName: Hempacco Co., Inc.

ticker: HPCO


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has more than 14 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: To combat ever-present cyber risks, the Company maintains a comprehensive cybersecurity program, which includes employee training, annual risk assessments and a comprehensive cybersecurity environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. However, we operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to patients, customers, and employees; violation of privacy laws and other litigation and legal risk; and reputational risk.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity incidents or threats. During the reporting period, we have not, to our knowledge, experienced any material cybersecurity threats or incidents.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Our Acting Chief Executive Officer, CFO and Senior Director, Information Security and Infrastructure, are responsible for assessing and managing our material risks from cybersecurity threats and have decades of experience in overseeing operations, including information technology functions, in the public company environment. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants as needed.

companyName: Lite Strategy, Inc.

ticker: LITS


text: The Board oversees risk management directly and through its committees. Generally, the Board oversees risks that may affect the business of Jabil as a whole, including operational matters. The Cybersecurity Committee ("the Committee") assists the Board in fulfilling its oversight responsibilities with regard to the Company's cybersecurity programs and risks, including the cybersecurity practices, procedures, and controls management uses to identify, assess, and manage the Company's key cybersecurity programs and risks, to protect the confidential intellectual property information and data of the Company and its customers and to comply with applicable data protection laws and regulations.

companyName: JABIL INC

ticker: JBL


text: In the fiscal year ended December 29, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Risks Related to Our Technology Infrastructure" in Item 1A-Risk Factors.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: The Company's governance structure is designed to identify, escalate, and mitigate information security risks. Management utilizes its Enterprise Risk Management Committee and IT Steering Committee, comprised of senior leaders including the Company's CRO, CTO, CFO, and other leaders with cybersecurity expertise, to disseminate information and monitor information security efforts throughout the Company. Each committee's charter, in addition to the Information Security Policy, establishes roles and responsibilities related the Company's cybersecurity governance and program. The risk team provides oversight of the Company's activities designed to identify, assess, measure, and mitigate cybersecurity risk. The Company's Information Security Program includes training that reinforces the Company's Information Security Program policies, standards, and practices, as well as the expectation employees comply with these policies. The technology team engages employees through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees, and is supplemented by various testing initiatives, including social engineering testing. Finally, the Company provides specialized security training for certain employee roles such as system administrators and all information security training is monitored and reported on by the risk team as well as the Company's learning and development function.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: The Nominating / Corporate Governance Committee receives regular reports from management concerning our cybersecurity risk management program, and also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: Park's information security and cybersecurity operations teams have defined escalation paths for issues and events, which include engaging Park's Incident Response Plan, and working issues and events through Park's Cybersecurity Response Playbook. Evaluation of escalated events is performed first by the Information Security Officer and Chief Legal Officer, who track and log cybersecurity incidents across Park and Park's vendors. Any incident assessed as potentially being or becoming material is further escalated to a leadership team that includes the Chief Financial Officer, Chief Operations Officer, Chief Risk Officer, Chief Information Officer, and Chief Accounting Officer. Events that leadership determines may be material are shared with the Board of Director's Executive Committee for final review and evaluation. Park engages teams, including but not limited to information security, information technology, corporate fraud and security, and fraud prevention, to address and remediate cybersecurity events and issues as they arise. Park engages outside legal counsel for assistance in evaluating and remediating cybersecurity issues and events. Information regarding issues and events is also shared by Park leadership with both internal and external auditors.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: We have implemented an Incident Response Policy and detailed procedures that govern how potential cybersecurity events are identified, escalated, investigated, contained, and remediated. The objectives of our incident response program include: • Timely investigation and validation of incidents • Minimization of data loss or service disruption • Evidence preservation in accordance with legal and regulatory requirements • Restoration of affected systems and services • Post-incident review and implementation of corrective actions • Notification to affected parties and regulators, where appropriate These procedures are tested and exercised periodically to ensure preparedness and adaptability.

companyName: PETMED EXPRESS INC

ticker: PETS


text: Our cyber risk management program is designed to comprehensively address the spectrum of cybersecurity threats that confront our organization. Within this program, we integrate an analysis of the risks facing the organization to guide our preparedness against cybersecurity threats to ensure a holistic approach that encompasses cross-functional and geographical visibility under the oversight of executive leadership through regular risk management meetings.

companyName: EnerSys

ticker: ENS


text: • Role-based access controls to identify, authenticate, and authorize individuals to access systems based on their job responsibilities; • Business resiliency planning with disaster recovery and business continuity testing; • Testing of new products and services and major changes to existing products and services to identify potential security vulnerabilities before release; • Protection, including encryption, for the secure communication of sensitive data; • Regular, proactive privacy and cybersecurity reviews of systems and applications, including third-party security practices; • Auditing of applicable data policies; • Regular internal and external security audits and penetration tests by third-party security vendors, as well as internal offensive team penetration testing; • At least annual security awareness training and testing of our employees; and • Monitoring emerging laws and regulations related to data protection and information security and implementing appropriate changes.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our Board of Directors (the "Board") oversees our risk management program as part of its general oversight function. The Board's Audit Committee is delegated the responsibility for reviewing and discussing with management our program to identify, assess, manage, and monitor significant business risks, including financial, operational, privacy, business continuity, legal and regulatory, reputation risks, and security, including cybersecurity. The Audit Committee receives quarterly updates from management regarding investigated incidents and periodic updates from management regarding cybersecurity matters (including the current threat landscape and cybersecurity risks). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.

companyName: Nkarta, Inc.

ticker: NKTX


text: The Security Committee is a management committee with representation from operations, technology, compliance, risk, and senior management. The Security Committee monitors, reviews, and makes necessary changes to the Information Security Program. This Committee provides accountability for policies and procedures and reviews incidents that may affect information security.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Within our organization, we have established a dedicated cybersecurity governance structure. This structure includes key individuals on the Company's disclosure committee responsible for detecting and reporting cybersecurity incidents and events, and our Board of Directors which is responsible for risk oversight, with review of IT governance and data security being the responsibility of the audit committee. Throughout the year, the Board of Directors receives briefings and assessments of the Company's risks related to IT, data governance, cybersecurity and overall data security. In furtherance of its risk oversight responsibility, the audit committee provides complaint reporting procedures for the confidential, anonymous submissions by employees and others of concerns regarding questionable accounting, auditing and any other matters. These submissions are collected by an independent organization specializing in those services, and are conveyed to the chair of the audit committee and our general counsel and chief compliance officer. Additionally, in 2022, we developed an enhanced Employee Self Service portal, designed to serve as a knowledge base where employees can log in to explore the latest IT solutions, tips and resources in addition to reviewing the status of their service request.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Our CEO is responsible for overseeing our business operations, which includes working with our IT personnel to oversee the day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity threats to our Company. Our executive management team is responsible for updating the Board, as necessary, regarding any significant cybersecurity incidents, should any occur. Our Board may also receive periodic reports from management on our cybersecurity risks and cybersecurity risk management program. In the event of a cybersecurity incident, our CEO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. date, we have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Loop Media, Inc.

ticker: LTPVQ


text: We have implemented and maintain various information security processes at each of our remote and office locations designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: We have established a vendor risk management program, which is a cross-functional program supported by our information security, compliance and procurement teams. As part of that program, we assess the security and privacy practices of our suppliers and third-party service providers who have access to, store or process our information through ongoing risk monitoring and security assessments, in line with the cybersecurity risks associated with the products or services they provide. We provide feedback and guidance to certain vendors as needed in an effort to enhance their security posture, including when new risks or threats are identified. Additionally, we perform periodic reassessments of applicable vendors to ensure our information security control requirements continue to be met.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: Our cybersecurity incident response policy and vulnerability management policy are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our chief technology officer. These management members work with related incident response functions, including the information technology department, the product development department and the legal department, to help the company mitigate and remediate cybersecurity incidents of which they are notified.

companyName: Moatable, Inc.

ticker: MTBLY


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our board of directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. We intend to provide our board of directors with periodic updates on cybersecurity and information technology matters and related risk exposures from management.

companyName: CLOUDASTRUCTURE, INC.

ticker: CSAI


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient, payor, business partner, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, our data, or our facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.

companyName: GIVBUX, INC.

ticker: GBUX


text: Role of the Management Our chief operating officer, together with our principal accounting officer, is responsible for the day-to-day management of our cybersecurity risks. We have an incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the chief operating officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. The chief operating officer activates the incident response plan to assess and mitigate a cybersecurity incident. In the event of an incident, the chief operating officer and principal accounting officer consult with cybersecurity consultants and other involved parties to identify the undesirable effects of the cybersecurity incident and develop a material incident disclosure plan for review and approval by the Audit and Finance Committee.

companyName: Comstock Inc.

ticker: LODE


text: The incident caused disruptions and limitation of access to portions of our business applications supporting aspects of our operations and corporate functions, which we voluntarily took offline as a precautionary measure. Based on the information reviewed to date, we believe the unauthorized activity has been contained and we were able to bring the impacted portions of our IT systems and individual computer devices back online and operate at full capacity within a week of detection of the unauthorized access.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: As of the date of this report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including our business strategy, results of operations or financial condition. For information regarding cybersecurity risks, see our discussion above in Item 1A. Risk Factors - Risks Related to Our Business - Our internal computer systems, or those of our third party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our commercial, research and development and other programs.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: Our board of directors maintains comprehensive oversight of company-wide risk assessment by conducting in-depth analysis of key risks related to information security, technology and cybersecurity threats. The audit committee of our board of directors oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee receives quarterly reports on cybersecurity matters, including material risks and threats, from our Chief Information Officer ("CIO") and our cybersecurity team. In the event of a cybersecurity incident, our Global Director of Cybersecurity or senior Information Technology management will notify our Disclosure Committee in accordance with the escalation criteria set forth by our incident response plan and related processes. Security incidents and events are classified based on severity (Critical, High, Medium), impact, and nature, as outlined in the Incident Response Plan. This classification system assists the cybersecurity team in prioritizing responses, allocating resources efficiently, and effectively managing risks.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: The Company has processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: In connection with our external SOC and managed service providers, we have implemented change control measures that allow for the continual oversight and assessment of the services provided and threats identified. Notifications and remediation of cyber threats are tracked, reviewed, and archived. Processes implemented and lessons learned involving these third parties are evaluated after each incident to ensure efficiency and replication.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Cybersecurity Threats, Risk Management and Strategy Our business operations, including our onshore operations and vessel operations, rely on information and operational technology systems, which could be targeted by various cyber threats including computer hackers and cyber terrorists. Reliance on information systems for vessel operations include the steering, navigation and propulsion systems of our vessels, communications and cargo management. Cybersecurity threats are of increased concern in today's world as they can potentially, amongst other things, disrupt operations, compromise sensitive information, and expose us to litigation. Cybersecurity threats are continuously evolving and can vary widely. Some common types of cyber threats are not limited to, but include malware, phishing, social engineering, spoofing, supply-chain attacks, domain name system (DNS) tunneling, insider threats, code injection, identity-based attacks, and other cyber threats.

companyName: DORIAN LPG LTD.

ticker: LPG


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled: Cyber-attacks, failures in or interruptions of, or other compromise of our information technology systems, or those of third parties with whom we work, or our data could result in adverse consequences that materially affect our business, including without limitation, regulatory investigations or actions, litigation, fines and penalties, information theft, data corruption, harm to our reputation and brand, significant disruption of our business operations and other adverse consequences.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: For a description of how cybersecurity risks may materially affect Comerica's business strategy or results, see "Item 1A. Risk Factors." No cybersecurity threat risks during the fiscal year ended December 31, 2023 materially affected or were reasonably likely to materially affect Comerica's financial condition or results of operations.

companyName: COMERICA INC

ticker: CMA


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing, stress testing based on top cyberattack scenarios and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning and by leveraging the Federal Reserve Bank of New York methodology for cyber risk ("FFIEC CyberSecurity Assessment Tool"). The Company regularly engages third parties to perform independent assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the EROC, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Our Chief Executive Officer is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff and third-party service providers. Our IT staff at both Ranor and Stadco oversee their respective cybersecurity processes on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above, and escalate matters to our Chief Executive Officer as appropriate.

companyName: TECHPRECISION CORP

ticker: TPCS


text: We annually assess our cybersecurity programs against third-party requirements, including HIPAA and the Sarbanes-Oxley Act (SOX). We test multiple aspects of cybersecurity regularly, including annual pen testing over our proprietary information systems and have historically tested annually and beginning 2024 will test semi-annually our technical recovery and incident response procedures.

companyName: JOINT Corp

ticker: JYNT


text: With the approval of the Audit Committee, we also engage third-party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third-party service providers in the ordinary course of business, including to assist us in performing information security assessments for third-party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third-party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Our board of directors has designated the audit committee to oversee our exposure to risk, including risks related to cybersecurity threats, and the steps management has taken to monitor and control such risks. The audit committee receives periodic updates from our Vice President – Information Systems on our cybersecurity program, potential material cybersecurity threats, and results of the most recent cybersecurity risk assessment. Additionally, t he audit committee is regularly informed about (1) the results of independent and objective assessments of key components of our cybersecurity program as reported by our internal audit department and (2) material risks that could impact our operations or financial condition and the measures implemented to adequately mitigate relevant risks. The audit committee regularly reports to our board of directors regarding its activities, including those related to cybersecurity risk oversight, and members of our board of directors periodically discuss cybersecurity matters with members of management.

companyName: Five Point Holdings, LLC

ticker: FPH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director, Information Technology, who reports to our Sr. Vice President, Operations. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our incident response process involves management, who participates in our disclosure controls and procedures.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: Risk Management and Strategy FirstEnergy has established a broad framework to assess, identify and manage material risks from cyber security threats. This program is established at the executive level, with regular reporting to, and oversight by, the FE Board as described below. At the highest level, FirstEnergy's program includes multi-layered governance by management, the Audit Committee, the Operations and Safety Committee, and the FE Board, as described in greater detail below.

companyName: FIRSTENERGY CORP

ticker: FE


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience and protecting stakeholders' interests. The Company currently manages cybersecurity risks by working with third-party IT consultants and utilizing basic security protocols. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of the CFO with assistance from the management team. Any significant cyber incidents that they become aware of are reported to the board of directors. The Board of Directors does not have a designated cybersecurity committee, but the Audit Committee receives periodic updates on cybersecurity matters. The Company has not experienced any material cybersecurity incidents to date and there are no material cybersecurity incidents discovered in 2025. Please refer to Item 1A: Risk factors for further insights into cyber attack-related risks.

companyName: Star Gold Corp.

ticker: SRGZ


text: Our Head of Information Technology and DCSDP report to our General Counsel, as well as to our Board through its Audit Committee. The IT Security team and DCSDP coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board and the Audit Committee on a quarterly basis, or more frequently as needed.

companyName: Certara, Inc.

ticker: CERT


text: Our ISO, under the supervision of our Chief Risk Officer, leads the development and implementation of the Information Security Program. In addition, our Information Technology Department ("IT") also has a dedicated cybersecurity team under the supervision of our Chief Information Officer. Members of our Information Security and IT cybersecurity teams have over 50 years of combined experience in information technology systems and cybersecurity risk management and include a team member that has a ISACA Certified Information Systems Auditor certification and two team members each with a master's degree in cybersecurity.

companyName: OFG BANCORP

ticker: OFG


text: Our risk mitigation process assesses, prioritizes, and monitors information security risks and vulnerabilities and focuses on embedment of risk mitigation efforts across our business. Among other things, our internal experts regularly conduct audits and tests of our information systems and our cybersecurity program is periodically assisted by established, independent third party consultants, who provide assistance through tabletop and other preparedness exercises. We also review information security threat information published by government entities and other organizations in which we participate and actively engage with suppliers, industry associations, key thought leaders and law enforcement communities as part of our continuous efforts to evaluate and enhance the effectiveness of our cybersecurity program. In 2022, we launched and required all salaried employees to complete a mandatory Global Cybersecurity and Privacy training, covering information security, end-user security policies, breach response, remote working, phishing and email security and digital threats. The training content is reassessed and refreshed each year to reflect evolving risks. Additionally, we maintain regular publications on cyber awareness on our Company portal and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies. In 2023, we implemented additional management governance through the creation of a Global Cybersecurity and Data Privacy Steering Committee, which meets periodically to review information security risks and vulnerabilities are being appropriately managed and mitigated. In addition, we maintain insurance to protect against potential losses arising from an information security incident.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents, and we have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident.

companyName: BANNER CORP

ticker: BANR


text: The Company engages reputable third-party assessors to conduct various independent risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: Plan and Testing – We have a cybersecurity incident response plan and dedicated teams to respond to incidents. Cross-functional teams assess priority and severity, and external experts, including legal counsel, may be consulted. Our cybersecurity teams respond to incidents based on severity levels and improve our plan through regular table top breach exercises, penetration tests and simulations.

companyName: PVH CORP. /DE/

ticker: PVH


text: As of the date of this report, the Company has not experienced any material cybersecurity events. However, the presence of new or more advanced forms of cybersecurity threats could have a material and adverse impact on the business, results of operations, and financial position. For further discussion relating to this topic, see Item 1A. Risk Factors "The Company's information technology systems may be negatively affected by cybersecurity threats."

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: Our information security team for IAS, MIS and Corporate is led by our Chief Digital & Information Officer ("CDIO"), who also serves as our Chief Information Security Officer ("CISO") for IAS, MIS and Corporate. Our CDIO/CISO reports to our President, BRP & CEO, Retail Brokerage Operations. Our CDIO/CISO has served in the role since 2021 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams at Comerica Bank, HSBC, Citibank and General Electric. Our CDIO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CDIO/CISO attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: Our cybersecurity risk management processes, policies and CIRP are focused on (1) developing organizational understanding to manage cybersecurity risks, (2) applying safeguards to protect our systems, (3) detecting the occurrence of a cybersecurity incident, (4) responding to a cybersecurity incident and (5) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. Our processes and policies include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. For additional information concerning cybersecurity risks we face, see Item lA Risk Factors - Information Technology and Cybersecurity Failures or Data Security Breaches Could Harm Our Business.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: Alcoa has implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to a security risk assessment prior to engagement to determine if they meet defined levels of security capabilities. Our master services agreements with third party service providers generally carry a number of security requirements, including audit rights for the Company. After engagement, third party service providers are subject to regular audits in which contract owners within Information Technology Automated Solutions (ITAS) validate that any certifications a vendor had upon engagement are maintained throughout the life of the agreement.

companyName: Alcoa Corp

ticker: AA


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Our Chief Executive Officer provides periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.

companyName: TECHPRECISION CORP

ticker: TPCS


text: Asbury's information and data security training programs are housed in a Learning Management System ("LMS"). We migrate our acquired companies into Asbury's current LMS.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Monitoring Cybersecurity Incidents and Reporting to Board of Directors The CISO regularly informs the CEO, Chief Legal Officer, Chief Information Officer and in-house data privacy counsel regarding cybersecurity risks and incidents to keep senior management abreast of our cybersecurity posture and potential risks facing Workiva. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board to enable it to provide oversight and guidance on any critical cybersecurity issues.

companyName: WORKIVA INC

ticker: WK


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management’s implementation of our cybersecurity risk management program. Pursuant to its charter, the audit committee’s oversight of the integrity of our information technology systems and cybersecurity risks includes the review and assessment with management of the adequacy of controls and security for our information technology systems, processes and data, as well as our contingency plans in the event of a breakdown or security breach affecting our information technology systems.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We provide regular training and awareness for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Crane NXT, Co.

ticker: CXT


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security organization, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional ("CISSP"), Certified Data Privacy Solutions Engineer ("CDPSE"), or Security+ and through the use of technological tools and software and results from third-party audits. Our cybersecurity incident response framework is governed by a cybersecurity incident response plan, which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. We have an incident response team comprised of our CISO, executive leaders, management and internal and external legal counsel, whose primary responsibilities include: • Evaluating and validating the impact of an incident; • Approving certain incident response countermeasures and remediation actions; • Escalating incidents and response countermeasures for approval; and • Acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Security Leader. Our Security Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.

companyName: Nextpower Inc.

ticker: NXT


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: SYNOPSYS INC

ticker: SNPS


text: Equinix has processes for assessing, identifying, and managing material risks from cybersecurity threats, both integrated into our Governance, Risk and Compliance Program (the "GRC Program") and existing within our Information Security function ("InfoSec") led by a Chief Information Security Officer ("CISO"). Our prior CISO departed Equinix in the fourth quarter of 2024, at which time we appointed a tenured Equinix Information Technology senior leader to the role in an interim capacity. To assist our interim CISO, we have engaged a technology risk consultant in an advisory role.

companyName: EQUINIX INC

ticker: EQIX


text: During the reporting period, the Company has not identified any impacts from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results and financial condition.

companyName: Main Street Capital CORP

ticker: MAIN


text: Our executive risk committee, which is comprised of our Chief Financial Officer, Chief Legal Officer and Senior Vice President, Engineering Operations, oversees the cybersecurity risk assessment and mitigation activities and receives regular reports from our cybersecurity team regarding the nature, timing and extent of incidents that occur across the Company's internal environments and those disclosed by third-party service providers, if applicable. Our cybersecurity team is comprised of technically skilled professionals with computer science, cybersecurity assurance or other cybersecurity degrees and professional experience in monitoring, detecting, mitigating and preventing cybersecurity incidents and testing cybersecurity processes. The executive risk committee has expertise in the pertinent financial, legal, regulatory, operational and technical areas to assess the impact of cybersecurity risks and incidents across the business and oversee our response to and disclosure of such incidents. In particular, our Senior Vice President, Engineering Operations brings decades of technical experience to our executive risk committee along with technical education in computer engineering.

companyName: Trade Desk, Inc.

ticker: TTD


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. As outlined in its committee charter, the Cybersecurity Risk Management Committee of the Board ("Cybersecurity Risk Committee") assists the Board in fulfilling its oversight responsibility. Our CISO, Michael Adams, leads the team responsible for implementing and maintaining our information security program and reports directly to the Chief Operating Officer ("COO"), who reports directly to our Chief Executive Officer ("CEO"). Mr. Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company. Mr. Adams previously also served as Zoom's Chief Counsel to the COO and CISO.

companyName: Zoom Communications, Inc.

ticker: ZM


text: Our cybersecurity program is overseen by our head of cybersecurity, with guidance from our Chief Technical Officer. Our head of cybersecurity has more than ten years of experience managing cybersecurity matters, holds an undergraduate degree in information systems with a focus on information security, and holds numerous certificates across the cybersecurity landscape. Our Chief Technical Officer is responsible for providing the Audit Committee with quarterly updates on cybersecurity risks and developments.

companyName: IES Holdings, Inc.

ticker: IESC


text: To identify, detect and respond to a cybersecurity incident, we conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing, perform incident response capability reviews and exercises, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including intellectual property) and implement appropriate changes. The Company has implemented a cybersecurity incident response plan that outlines the Company's process for preparing for a cybersecurity incident, detecting, analyzing, containing, eradicating and recovering from such incident, and provides guidance for post-incident analysis. Additionally, we have established a Cyber Incident Committee that is comprised of leadership across the Company's finance, legal, accounting, internal audit and IT organizations to provide guidance and monitor overall company cybersecurity.

companyName: Westrock Coffee Co

ticker: WEST


text: We maintain a comprehensive Information Security Management System ("ISMS") program, which is led by a dedicated Chief Information Security Officer ("CISO"), who joined the Company in October 2024 and has almost 20 years of experience in enterprise grade cybersecurity and global scale systems, having previously served as a CISO of another public company and as a cybersecurity consultant. Our CISO is undertaking a comprehensive review of our information security systems and processes, and as a result, we may make incremental improvements to our cybersecurity controls and procedures and our cybersecurity risk management over the next six to twelve months.

companyName: Vimeo, Inc.


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology and Chief Compliance Officer and other members of management of our Adviser that implement and oversee our Adviser's cybersecurity program.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: We have not experienced a cybersecurity incident or identified risks from known cybersecurity threats or prior cybersecurity incidents that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned "System failures or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities" in Item 1A. Risk Factors.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: We have policies, procedures and processes in place to identify, assess and monitor material risks from cybersecurity threats. These plans are part of our overall enterprise risk management strategy and are part of our operating procedures, internal controls, and information systems. Cybersecurity risks include, among other things, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Management Responsibilities Our cybersecurity program is managed by our Senior Director of Information Technology ("Technology Senior Director"). Our Technology Senior Director has 21 years of experience in information technology and cybersecurity, having been at the Company since 2003. The Technology Senior Director, along with the Company's IT security partners, is responsible for reducing cybersecurity risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events, responding quickly and building procedures to rapidly recover, if needed.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: As of August 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we face numerous and evolving cybersecurity threats in our business.

companyName: AI Era Corp.

ticker: AERA


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For further discussion of our risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality, Integrity or Availability of Our Systems or Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."

companyName: METROPOLITAN LIFE INSURANCE CO


text: As of December 31, 2024, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations or financial condition. While we have implemented measures designed to help mitigate the risk from cybersecurity threats and incidents, we cannot guarantee that we or our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business will be successful in preventing a cybersecurity incident, or mitigating or remediating a cybersecurity threat, which could result in a data center outage, disrupt our systems and operations or the systems and operations of our managers, tenants, borrowers, investments in unconsolidated entities, vendors, suppliers, service providers or other third parties with whom we do business, compromise the confidential or personal information of our employees, partners or the residents in our senior housing communities and damage our business relationships and reputation. Although we have implemented various measures designed to manage risks relating to these types of events, these measures and the systems supporting them could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure confidential or personal information. See "Risk Factors—Our Legal, Compliance and Regulatory Risks—Cybersecurity threats and incidents could disrupt our operations or the operations of the third parties with whom we do business, invest in or lend to, result in the loss of or unauthorized access to confidential or personal information or damage our or their business relationships and reputation" included in Part I, Item 1A of this Annual Report.

companyName: Ventas, Inc.

ticker: VTR


text: Our board of directors currently does not oversee our cybersecurity program and had delegated the oversight to our PRC subsidiary which established its Information Security Committee headed by our CEO, Mr. Guolin Tao to be the head of the committee. The Information Security Committee meets quarterly to discuss cybersecurity risks and effectiveness and will provide the board of directors occasional updates on the effectiveness of our cybersecurity program.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: We have established a Computer Security Incident Response Team ("CSIRT") that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate. The CSIRT is responsible for identifying, managing, and responding to security incidents against Qualys' infrastructure and corporate IT systems. The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology ("NIST"), Federal Risk and Authorization Management Program ("FedRAMP"), International Organization for Standardization ("ISO"), and Federal Information Security Management Act ("FISMA"). We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.

companyName: QUALYS, INC.

ticker: QLYS


text: Continuous Monitoring – We have security team members across all of our geographic business operations that support our key IT processing centers. We have teams dedicated to investigating all security alerts and incidents at a global level or within our business segments. Further, we have managed security service providers who provide 24x7 advanced threat detection and monitoring services to augment our security analyst teams.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: AMN Healthcare's board of directors (the "Board") is responsible for overseeing our enterprise-wide risk management program. The audit committee of the Board (the "Audit Committee") has primary oversight responsibility for information and cybersecurity, including internal controls designed to mitigate risks related to these topics. This includes regular, and at least quarterly, review by the Audit Committee of reports on topics including, among others, significant cybersecurity risks, results from third-party assessments, training and vulnerability testing, and our incident response plan. Material breaches, if any, and any disclosure obligations arising from any such breach are also discussed separately with the Audit Committee as part of the Board's risk oversight generally.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: The Board of Directors is responsible for overseeing the development, approval, implementation and maintenance of the ITSM, including overseeing the program's execution in accordance with the overall strategic goals of the Bank. The Board conducts oversight, in part, through the use of committees. The Risk Management Committee ("RMC") of the Board of Directors is charged with monitoring and reviewing risk assessments, assurance, testing, and training as well as overseeing the correction of identified deficiencies as they relate to the ITSM. The Company's Information Security Team is comprised of the information security officer ("ISO") and a cyber-risk analyst. With input from the Information Technology and Risk departments, the Information Security Team is responsible for incident management, disaster recovery, business continuity and cybersecurity programs and policies. The Bank's Incident Response Manual and Cyber Incident Policy outline how potential cybersecurity threats or incidents are communicated to the RMC. The RMC is responsible for determining if cybersecurity incidents or threats should be escalated to the Board of Directors. The Information Security Team and the RMC work together to mitigate cybersecurity threats or incidents.

companyName: Provident Bancorp, Inc. /MD/


text: Our CISO is responsible for assessing and managing cybersecurity risks and maintaining our cybersecurity program. Our CISO has over 25 years of experience, including five years as our CISO, managing technology risks across multiple industries, including financial services, technology and manufacturing. Through strategic hiring and internal development, our CISO enhances the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats. As of the date of this filing, 100% of our IT Risk Management team has technical industry certification, and members of the IT Risk Management team have an average of 15 years of cybersecurity experience. Our CISO currently serves as an advisor to multiple industry groups. Our cybersecurity program undergoes an annual third-party controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: We are subject to cybersecurity threat risks associated with our use of third-party service providers, including independent clinical investigators, contracted laboratories and contract research organizations. Cybersecurity considerations affect the selection and oversight of these third-party service providers.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Technology Officer (CTO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: The Committee has established a Cybersecurity Subcomittee (the "Subcommittee"). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware, and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled " Technology failures or cybersecurity breaches could have a material adverse effect on our operations. " in Item 1A- Risk Factors.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: The Company considers management of cybersecurity and digital risk as essential for enabling success. The Audit Committee (the "Audit Committee") of the Board provides oversight of the Company's risk assessment and risk management policies and strategies with respect to significant business risks, including cybersecurity and digital risk. On a regular basis, the Audit Committee reviews reports from the Company's Chief Information Security Officer ("CISO") or her representative(s) regarding the identification and management of cybersecurity risks, including when applicable, notable cybersecurity threats or incidents impacting the aviation sector and the Company; results of independent third-party assessments of the Company's cybersecurity program; key metrics, capabilities, resourcing and strategy regarding the Company's cybersecurity program; and updates related to cybersecurity regulatory developments.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: We have established and maintain comprehensive incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident.

companyName: Eiger BioPharmaceuticals, Inc.


text: Vendor Risk Management The Program seeks to ensure that each vendor (or third-party service provider) with whom the Company does business meets the Company's standards for protecting and preserving the confidentiality, integrity, and continued availability of electronic information systems and data. The Company requires vendors to meet threshold requirements for cybersecurity controls, such as access controls, logging and monitoring, and encryption. The Company's contracts with vendors require the implementation and maintenance of such controls, and obligate vendors to promptly report all cybersecurity incidents to the Company. Based on the overall risk level associated with a particular vendor, the Company's contract with a service provider may require enhanced or heightened controls. The CISO's Information Security Team performs risk-based initial and periodic due diligence of vendors, during which the Information Security Team evaluates, assesses, and otherwise reviews vendor cybersecurity controls. The results of such reviews are reported to the CISO. Any cybersecurity incidents involving vendors will be escalated and acted upon in accordance with the Program.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO