text: The Vice President of Operations and Executive Vice President of Products and Solutions are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above including the incident response.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: The board is responsible for informed oversight of our risk management process. The board administers this oversight function through various board standing committees that address risks inherent in their respective areas of oversight. The board has delegated oversight for cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company's policies and procedures with respect to cybersecurity risk management.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR

secItem: Item 1C


text: The Company's Chief Information Security Officer ("CISO") is responsible for cybersecurity at the executive level. The CISO oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with the Chief Information Officer and reports to the Chief Financial Officer and Chief Administrative Officer. The CISO also leads a cross-functional Cybersecurity Incident Response Team ("CSIRT") responsible for responding to and managing cybersecurity incidents. The CSIRT consists of professionals from various departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas. The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO's professional background, the CISO maintains several relevant industry credentials, including ISACA Certification in Risk and Information Systems Control ("CRISC") and ISC2 Certification in Information Systems Security Professional ("CISSP").

companyName: Strategic Education, Inc.

ticker: STRA


text: Our cybersecurity organization, led by our Assistant Vice President of IT and our Director of Information Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Within our team, our current Director of Information Security has professional cybersecurity certifications. The Company's Board of Directors administers risk management oversight through the Audit Committee of the Board. Our Audit Committee receives quarterly updates about the effectiveness of the Company's cybersecurity and information security programs, vulnerability and threat detection, progress relative to the Company's cybersecurity roadmap, and the status of projects to strengthen our information security systems. The Audit Committee discusses with Company management and the Board the Company's processes with respect to risk assessment and risk management.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Security Policy and Requirements The Company has information security policies to (i) protect information processed and stored by the Company in accordance with applicable laws; (ii) protect the Company's information from current and emerging threats to computing systems and the energy industry in particular; and (iii) establish appropriate levels of protection for the Company's information systems. The IT Department is responsible for designing and implementing information system controls, procedures and solutions to accomplish the Company's cybersecurity and data protection objectives. The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, is responsible for (i) approving and reviewing any changes to the policies; (ii) ensuring necessary resources; (iii) defining information that is considered strategically important; (iv) reviewing and approving information security objectives on annual basis; and (v) driving continued improvement and communicate importance of information security to the organization. All Company employees, contractors, managers and partners are responsible for (i) following applicable information security controls and (ii) reporting violations of controls or suspicious incidents to their business manager or directly to the IT Department. We are regularly audited by certain customers to assess the adequacy of our cybersecurity controls.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Cybersecurity is a top enterprise risk in PGE's enterprise risk management program. An enterprise-wide management group operates to evaluate the cybersecurity program's effectiveness. The Company has an employee who functions as a Chief Security Officer, whose responsibilities include cybersecurity and who has a reporting relationship to senior management. This employee has had a twenty-five year career with the Federal Bureau of Investigation (FBI) prior to joining the Company. She served as the Confidential Advisor to the Director of the FBI, providing strategic advice across all threats allowing her to develop unique and key insights into the global cyber threat landscape, FBI cyber strategy, and cyber operations. Prior to joining the Company, she served as the Special Agent in Charge of the FBI Jacksonville Division where she led all FBI cyber investigations and operations for nation state and criminal actors. PGE has a management-level committee, the Integrated Security Executive Committee (ISEC), specifically dedicated to cybersecurity and risk issues. The ISEC meets twice each quarter and reviews risks, processes, and strategies related to cybersecurity. Members of the ISEC include the Chief Information Officer, the Chief Operating Officer, the Chief Executive Officer, and the Chief Legal and Compliance Officer. In addition, as a top enterprise risk, cybersecurity is also reviewed by the Company's management-level Executive Risk Committee on an annual basis, or more frequently if circumstances warrant. This broader review allows the cybersecurity risk and mitigations to be aligned with other enterprise risks, including identifying areas of overlap. Members of the Executive Risk Committee include: the Chief Executive Officer, the Chief Legal and Compliance Officer, the Chief Financial Officer, the Chief Operating Officer, the Chief Information Officer, the Senior Vice President of Strategy and Advanced Energy Delivery, and the Vice President of Energy Supply and Regulatory Affairs.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: Our external audits and assessments identify and evaluate material risks from cybersecurity threats against our overall business objectives on a periodic basis and form the basis of internal reports, which can be shared with the management team, the Audit Committee of the Board of Directors, and the Board of Directors to evaluate our overall enterprise risk.

companyName: OptimizeRx Corp

ticker: OPRX


text: The Company's board of directors has oversight responsibility for the Company's enterprise risk management process and it delegates oversight responsibility for certain significant functional areas of risk management to the board's committees. The Audit Committee of the board of directors is responsible for oversight and review of the Company's cybersecurity and other information technology risks, controls, and procedures, including the potential impact of such risks on the Company's business, financial results, operations, and reputation, as well as the Company's plans to mitigate cybersecurity risks and to respond to cybersecurity incidents.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Our board of directors has oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. The board receives regular updates from management on our cybersecurity risks. In addition, management updates the board as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the board, as appropriate.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: The Company provides regular, mandatory training for all personnel on cybersecurity threats and has processes and procedures in place to communicate out-of-cycle notices and updates regarding the Company's information security policies, standards, processes, and practices by the Chief Technology Officer ("CTO") as needed.

companyName: IBEX Ltd

ticker: IBEX


text: Cybersecurity Risk Management Personnel Our VP of Technology, Shaam Farooq, has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. Mr. Farooq has over 25 years of experience in global technology leadership, having served as an enterprise CISO across multiple industries. He actively participates in the oil and gas cybersecurity community, ensuring our security strategy remains responsive to current industry threats and aligned with best practices. Shaam continues to refresh his Certified Information Systems Security Professional and Certified Information Security Manager trainings as necessary.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Members of the Committee will present the results of the periodic performance and effectiveness review to our Board of Directors, who oversee our risk management processes directly and through its committees. These results, along with other cybersecurity topics including updates on previously identified material cybersecurity threats or incidents, are presented at regularly scheduled meetings. Members of the Committee will also notify our Board of Directors between such meetings regarding significant new cybersecurity threats or incidents.

companyName: PC CONNECTION INC

ticker: CNXN


text: Our cybersecurity program is managed by our Vice President of Operations (" VP Operations ") and our Director of Information Technology (" IT Director "), whose team (" Cybersecurity Team ") is responsible for facilitating the enterprise-wide cybersecurity program. Our VP Operations and IT Director have experience with large information technology footprints, including cybersecurity. Their in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Audit Committee of our Board of Directors oversees management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: Our Chief Information and Product Officer, Chief Information Security Officer, Chief Legal & Compliance Officer, Chief Corporate Affairs Officer, and other senior members of our cybersecurity, risk, and compliance and ethics teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit & Risk Committee and/or the full Board of Directors Our program and practices regarding information security, cybersecurity, and data privacy include the following: • Audit & Risk Committee and Board of Directors updates. To inform and educate the Audit & Risk Committee in its primary oversight responsibility for information security, cybersecurity, and data privacy, management provides updates on these topics. For example, the Chief Information Security Officer addresses information security risks and controls, cyber threats, and other program updates, and senior members of the risk team provide enterprise risk management program updates. In addition, the Board of Directors receives updates from management regarding Target's overall risks, which include risks related to these topics. • Integration into enterprise risk management program. By aligning the identification, assessment, and management of risks related to information security, cybersecurity, and data privacy with our overall approach to risk oversight by the Board of Directors, its committees, and management, we have integrated these practices into our enterprise risk management program. • Management expertise. Our Chief Information and Product Officer leads the strategic direction and management of Target's product and engineering teams. He is responsible for Target's enterprise technology systems and oversees Target's cybersecurity, data platforms, data science, infrastructure, product engineering, and enterprise product teams. He previously served as Target's Chief Digital and Product Officer and held a variety of leadership roles in enterprise technology and product management prior to joining Target. He has developed significant knowledge and skills regarding enterprise technology systems, including cybersecurity. Our Chief Information Security Officer has a strong background in technology, information security, cybersecurity, risk management, audit, and compliance and held executive roles in information security prior to joining Target. He contributes to the broader cybersecurity community by serving in several board and advisory roles and promoting collaboration, best practice sharing, and talent development. Our Chief Legal & Compliance Officer and Chief Corporate Affairs Officer have extensive experience, and have developed critical knowledge and skills, in the areas of risk oversight and compliance, including as such areas relate to cybersecurity.

companyName: TARGET CORP

ticker: TGT


text: We use our Information Security teams, as well as trusted third-party auditors, recognized cybersecurity consultants and certified assessors, to assess cybersecurity risks, related controls, and alignment to relevant regulatory and legal requirements. A third party evaluates our Information Security Program and control environment at least annually. Assessments are performed against industry best practices and widely recognized security frameworks.

companyName: Elevance Health, Inc.

ticker: ELV


text: Considering the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives and requests management report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks, including artificial intelligence. Both the Audit Committee and the full Board receive quarterly reports from the Chief Information Officer on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our Board has risk management experience, including members with experience in overseeing teams responsible for data security and cybersecurity and assessing technology-related risks and development of risk mitigation strategies.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: We have developed and implemented a cybersecurity risk management program intended to protect our confidential and proprietary data, and information technology and systems, from cybersecurity threats, including unauthorized access or attack. We leverage the SOC 2 TYPE II Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to the business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: We recognize the critical importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks, and resiliency against incidents. This strategy is supported by both management and our Board of Directors.

companyName: ASTRONICS CORP

ticker: ATRO


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, please refer to Item 1A: Risk Factors for further insights into cyber attack-related risks. Board considers cybersecurity risks as part of its risk oversight function of cybersecurity and other information technology risks.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: In the event of an incident that jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated information security incident response plan ("IRP"). The IRP is overseen by the Information Technology Steering Committee and sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Pursuant to our IRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. The IRP also specifies the approach to reporting findings and keeping senior management and other key stakeholders (including the Audit Committee and the Board of Directors for certain incidents) informed and involved as appropriate and specifies the use of third-party experts for legal advice, consulting and cyber incident response.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the CISO is focused on assessing, managing, mitigating and reporting on cybersecurity threats and risks.

companyName: Rithm Capital Corp.

ticker: RITM


text: However, there can be no assurance that these measures will be effective in preventing or mitigating the impact of a cyber-attack or data breach. We cannot predict the occurrence, timing, or severity of cybersecurity incidents, but we remain committed to protecting our information assets and maintaining the trust of our stakeholders.

companyName: Xenous Holdings, Inc.

ticker: XITO


text: Our cybersecurity program is ultimately overseen by the Board of Directors. The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry. The team has decades of experience with varied certifications and is led by our Chief Information Officer ("CISO"), who has over 17 years of experience as an IT professional and in cybersecurity and reports to our Vice President of IT. The CISO makes regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. Management provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.

companyName: Woodward, Inc.

ticker: WWD


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management system and processes, and includes: • a team of professionals within our Global Technology Organization team who are responsible for identifying and mitigating cybersecurity risks and managing our security controls and response activities; • risk assessment processes designed to identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • an annual tabletop exercise to simulate a response to a cybersecurity incident; and • mandatory training annually and upon hiring for all employees on data privacy and cybersecurity topics.

companyName: Broadcom Inc.

ticker: AVGO


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the UK governments' National Cyber Security Centre. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Risk Management and Strategy Risk Assessment and Management: OPKO employs rigorous assessment and management of cybersecurity risks, aligning with NIST and other industry standards. Our strategy is integrated into our overall risk management program, reflecting our commitment to safeguarding data.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Management Role in Cybersecurity Risk Management At the management level, our CISO has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at Mondel z and other major consumer goods and financial services companies. Our CISO currently reports to our Chief Financial Officer and has operational responsibility for our information security programs, protections, and efforts, along with leading the team responsible for implementing, monitoring, and maintaining cybersecurity and data security strategy, policy, standards, architecture, and practices across our business. Our CISO is supported by a team of enterprise information system security and risk professionals, including regional information security officers responsible for overseeing cybersecurity strategy and operations in each business unit. Our CISO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. Our CISO updates the Management Leadership Team on these matters and works closely with Corporate and Legal Affairs to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: PAR's cybersecurity risk management program leverages industry-recognized security frameworks, including the U.S. National Institute of Standards and Technology (NIST) and the CIS Critical Security Controls. We also engage third-party independent auditors to attest to the implementation and operational effectiveness of security controls implemented within our product and service environments in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC") as well as financial systems in scope for Sarbanes-Oxley information technology general controls. Our internal audit team conducts regularly scheduled audits of our IT and business systems. The results of these audits are reported to senior management and the audit committee as part of the quarterly reporting process discussed above.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including those set forth in the International Organization Standardization ("ISO") 27001 standard. The Company has an annual assessment, performed by a third party, of the Company's cyber risk management program against this standard.

companyName: XPEL, Inc.

ticker: XPEL


text: The Information Security Program also incorporates a vendor due diligence process that is designed to evaluate whether a vendor or third-party service provider that receives confidential data meets MGIC's information security governance, risk, and compliance requirements. The process includes assessing and managing the cyber risks associated with engaging third-party vendors and reviewing their information security practices.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to our Information Technology, Intellectual Property, and Data Security and Privacy."

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Our corporate cybersecurity team is responsible for operating our cybersecurity risk management program. The cybersecurity team determines with management an annual workplan for risk assessments, reviews, audits and tests. The cybersecurity team also conducts vulnerability assessments, security reviews and penetration tests on a regular basis in accordance with such workplan. Following risk assessments that require any remediation, the cybersecurity team then conducts a risk treatment and response process, including mitigation, remediation and risk reduction efforts. Our policies also require that Internet-accessible enterprise systems and applications must undergo a penetration test at least annually, and we engage specialized, independent, third parties to conduct penetration tests and specific in-depth reviews of certain enterprise systems and applications.

companyName: Mobileye Global Inc.

ticker: MBLY


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to ERM, including risks from cybersecurity threats, and the steps management has taken to monitor and mitigate those risks. The audit committee receives reports semiannually from Abbott's Chief Information Officer (CIO) and Chief Information Security Officer (CISO) on Abbott's cybersecurity strategy and program. In addition, the audit committee conducts an annual review of the ERM process, including the program structure, risk assessment, and risk mitigation.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business.

companyName: RenX Enterprises Corp.

ticker: RENX


text: The Company has a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, which includes a cybersecurity Incident Response Plan ("IRP"). Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Extra Space Storage Inc.

ticker: EXR


text: The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its IT systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO), whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The CISO has worked in the cybersecurity and national security fields for more than 30 years. He has a Master of Science in Telecommunications and Computers. He has served as a board member of the Health Information Sharing and Analysis Center for 10 years. Oversight of the information security program has been integrated into the Company's overall enterprise risk management program.

companyName: Merck & Co., Inc.

ticker: MRK


text: Under the oversight of our Board of Directors, and the Board's risk committee, our management has established comprehensive processes identifying, assessing, and managing material risks from cybersecurity threats. These processes are integrated into our enterprise risk management program and include proactive measures such as advanced threat monitoring, penetration testing, multi-factor authentication, and team member training. We also align our practices with recognized standards such as the NIST Cybersecurity Framework. Our detailed incident response plan outlines steps for detection, assessment, notification, and recovery, including escalation to management, the Risk Committee, and the Board when appropriate.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: IT leadership is made up of senior managers with the appropriate qualifications and business experience required for their roles overseeing Innospec's IT operations. In addition, the IT leadership team includes specialists with many years cyber security experience at both Innospec and previously with other organizations, combined with multiple cyber security qualifications. Innospec's IT leadership formally reports through the CEO and CFO to the Board.

companyName: INNOSPEC INC.

ticker: IOSP


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee, which reports on its activities and findings to the full Board after each meeting. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Our SVP IT provides periodic presentations to the Audit Committee on cybersecurity risks. These briefings include assessments of cyber risks, the threat landscape, updates on any incidents, and reports on our investments in cybersecurity risk mitigation and governance. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee is notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate. Three of the members of our Audit Committee have significant expertise in various aspects of cybersecurity programs.

companyName: Daseke, Inc.


text: MPC applies an enterprise risk management ("ERM") methodology as established and led by the MPC and MPLX GP executive leadership team to identify, assess and manage enterprise-level risks. MPC's cybersecurity risk program directly integrates and is intended to align with MPC's governing ERM program.

companyName: MPLX LP

ticker: MPLX


text: We are a blank check company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Roth CH Acquisition Co.

ticker: USCTF


text: Board of Directors' Oversight and Management's Role Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. The Company's IT function focuses on current and emerging cybersecurity matters. The Company's IT department is led by the Director of IT, who reports to the Company's Executive Vice President, Operations, including with respect to emerging cybersecurity incidents. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. To facilitate effective oversight, the Director of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. The Director of IT has served at Sitio since 2022 and has over 18 years of experience in managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs at Sitio and similar companies.

companyName: Sitio Royalties Corp.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches. We periodically review our cybersecurity insurance program.

companyName: F5, INC.

ticker: FFIV


text: Our steering committee, typically in joint session with the full board of directors, meets quarterly with Serve executive leadership to receive reports regarding our overall security posture. These reports include updates on the implementation of cybersecurity controls, data security, risk assessments, the status of internal cybersecurity projects, technology compliance, employee awareness training and any notable incidents and remediation that have occurred within the quarter.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: We utilize cross-functional teams and risk assessment tools and technologies to identify potential cyber and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization ' s cyber and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cyber and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: We have implemented processes designed to identify, review and manage risks from potential cybersecurity-related data breaches, unauthorized intrusions of our information technology systems, and other information security losses on or through our information technology systems that could result in adverse effects on the confidentiality, integrity, and availability of our systems and electronic information. These processes are managed and monitored by our third-party information technology service providers, as supervised by our Chief Financial Officer (CFO). Our CFO has experience in overseeing our cybersecurity and information technology programs. We rely heavily on information technology consultants for advice and expertise on monitoring evolving industry standards and to monitor our compliance with applicable policies. Our processes include mechanisms, controls, technologies, and systems designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. With the assistance of our third-party vendors, we conduct regular information technology risk evaluations and security audits. Our information technology team conducts due diligence on key technology vendors, contractors and suppliers. We also provide ongoing education communications on cyber and information security, among other topics, and monitor phishing campaigns or other misrepresented system access requests to identify any employees that might need additional training.

companyName: Cellectar Biosciences, Inc.

ticker: CLRB


text: Over the ordinary course of our business, Arvana and its third-party service providers, such as charter booking services, collect, maintain, and transmit sensitive data including proprietary or confidential business information (such as operational data and personal information). The secure maintenance of this information is critical to our business and reputation.

companyName: ARVANA INC

ticker: AVNI


text: The Company's Information Systems organization, which is led by the Chief Information Officer ("CIO"), is responsible for implementing and maintaining the Company's Program and related risk management. The Company's current CIO has formal education in information technology and extensive work experience gained from over 20 years in various technology leadership roles. As leader of the Company's information systems and technology function, the CIO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation. The team responsible for developing and executing its cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or significant experience working in information technology and cybersecurity, including relevant industry experience in security related industries.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: To operate our business, we use certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs and we rely on such providers to maintain appropriate internal and external cybersecurity practices.

companyName: BRT Apartments Corp.

ticker: BRT


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments, audits and cybersecurity threat intelligence.

companyName: STORE CAPITAL LLC


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Information Technology Steering Committee of the Board of Directors of the Bank at least quarterly. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: The ISRM Committee has two working groups: Information Security Operational Risk Management ("ORM"), and Information Security Incident Response ("IR"). The Information Security ORM working group meets quarterly to collect information security operational risks from our technical, product, and data science team, and reports material risks to the ISRM Committee. The IR working group has core and support teams. Members of this working group review all changes to the InfoSec IR Plan and periodically test the InfoSec IR Plan by participating in information security incident response tabletop exercises. The ISRM Committee reviews all information security risks company-wide reported by both working groups and selects top risks that will be covered and translated into the information security projects for the incoming quarter. The ISRM Committee also reviews and approves our cybersecurity policy, standards, and guidelines annually, and prioritizes information security related projects to mitigate our top information security risks on a quarterly basis. The ISRM Committee is also responsible for the review and approval of all changes of InfoSec IR Plan.

companyName: AdTheorent Holding Company, Inc.


text: SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Sharplink, Inc.

ticker: SBET


text: We rely on certain third party service providers to assist us with the delivery of our products to our customers. A cybersecurity incident at a supplier or subcontractor could materially adversely impact us. Therefore, we evaluate third party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.] Our adherence to Defense Federal Acquisition Regulation Supplement (DFARS) and Cybersecurity Maturity Model Certification (CMMC) requirements ensures strict protection of Controlled Unclassified Information (CUI), mandated by the U.S. Department of Defense. These efforts underscore our unwavering commitment to maintaining the highest cybersecurity resilience standards and regulatory compliance.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: AllianceBernstein Our CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of our ISP. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The defense-in-depth strategy manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. Our ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls. We periodically execute table top exercises as a part of our ISP program.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: The Company provides periodic training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices.

companyName: Revance Therapeutics, Inc.


text: The program includes a well-defined risk assessment and analysis process, identifying critical digital assets, conducting thorough threat and vulnerability assessments, and quantifying risks based on potential impact and likelihood. This information prioritizes risks, allowing us to allocate resources effectively and focus on mitigating the most significant threats. Policies and procedures form the foundation of the cyber risk management program, with comprehensive guidelines covering data protection, access controls, incident response, and employee training. Security controls, such as robust identity governance and access controls, AI-based email security solutions, endpoint protection, and network security measures, are implemented to fortify our defenses. An effective incident response plan ensures a swift and coordinated response to security incidents, minimizing potential damages. Continuous monitoring through MDR (Managed Detect and Respond) solutions and staying informed about the latest threat intelligence feeds enhance our ability to detect and respond to evolving cyber threats.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: We have implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is an element of and is integrated into our overall enterprise risk management program, and is a key component of our annual organizational risk assessment. Our cybersecurity risk management program is based in part on, and incorporates elements of, the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Azenta, Inc.

ticker: AZTA


text: We conduct regular cybersecurity education through a security awareness, training, and education program. All employees are required to participate in interactive training at least annually on information security and data privacy. As part of this training program, security campaigns are launched to test the effectiveness of the training provided, and all employees receive periodic security bulletins and updates on a periodic and as-needed basis.

companyName: PACIFIC PREMIER BANCORP INC


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: FS KKR Capital Corp

ticker: FSK


text: Senior leadership regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: Unicycive Therapeutics, Inc.

ticker: UNCY


text: Our employees are a key element of our cybersecurity and data privacy defenses. We administer mandatory and regular awareness programs for employees on cybersecurity. We require all new employees to complete security awareness training upon hire, and existing employees must complete security awareness training annually thereafter. We also conduct internal incident response tests, phishing test campaigns and other security-enhancing exercises throughout the year. In addition, we established measures to help mitigate the risk of exposure of personally identifiable information ("PII"). We have also implemented phishing protection and data loss prevention tools designed to enhance our cybersecurity throughout our information technology systems.

companyName: Open Lending Corp

ticker: LPRO


text: We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the NIST. The NIST CSF is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters. Based on the NIST CSF, our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: Identify

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The Technology Committee is briefed at least quarterly, on the quality and effectiveness of our cybersecurity practices and policies, information security program, and data governance and security program, along with key initiatives in these areas. The Technology Committee also periodically assesses the cybersecurity risk management strategy. This assessment includes reviews of the results of audits, testing, and metrics, including reports of third-party reviewers.

companyName: MAXIMUS, INC.

ticker: MMS


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Cybersecurity Team is tasked, among other things, with evaluating, reporting and advising about cybersecurity risks, defining and leading the enterprise cybersecurity program to protect Logitech business against cybersecurity threats, maintaining and updating the cybersecurity framework, monitoring the level of compliance with the cybersecurity framework across Logitech digital assets and services, providing enterprise-wide cybersecurity services, defining cybersecurity standards and advising on secure architectures, performing assessments and due diligence checks internally and with business partners, providing cybersecurity guidance for digital projects, creating and deploying cybersecurity training programs, managing cybersecurity incidents and breaches, and monitoring cybersecurity threats. The Cybersecurity Team, which is part of the IT organization, is led by the CISO, who has 20 years of cybersecurity experience across different industries. The Cybersecurity Team leads the enterprise cybersecurity strategy and roadmap, which applies to all information and digital assets, used at Logitech to conduct business. Our cybersecurity is managed based on industry-leading standards such as ISO 27001, National Institute of Standards and Technology (NIST) and Center for Internet Security (CIS).

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: The PPG Board of Directors (the "Board") has overall responsibility for the oversight of risk management at PPG, which includes cybersecurity risks. The Audit Committee of the Board (the "Audit Committee"), is responsible for oversight of the Company's enterprise risk management ("ERM") program which provides oversight and governance of all of the Company's operational and financial risks including risks from cybersecurity threats to the Company. The Audit Committee receives bi-annual reports and periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from our Vice President and Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who are both responsible for overseeing our cybersecurity program. In addition, the full Board receives bi-annual briefings from our CIO on our cybersecurity program. The Board and the Audit Committee also periodically review the results of exercises performed by our advisors as part of an independent assessment of PPG's cybersecurity program and internal preparedness.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: In 2023 we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: The Company employs a comprehensive, cross-departmental approach to continuously assess, identify, and manage potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the information technology ("IT") team, our Chief Information Security Officer ("CISO"), and our Enterprise Risk Management Committee, as overseen by the Board of Directors, primarily through its Audit Committee. The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management program and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: The Company's Information Security Incident Response Plan includes detailed processes and controls related to cybersecurity awareness training for employees, phishing simulations, backup and recovery, response planning, vulnerability management and endpoint protection as well as ongoing cybersecurity requirements for third-party service providers. The framework is regularly reviewed, assessed, and updated. This framework is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: WEIS MARKETS INC

ticker: WMK


text: Our cybersecurity risk management program, which is informed by and incorporates elements of recognized industry standards, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. This program includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management program, we leverage a managed service provider, or MSP, that provides ongoing support for the protection of our information technology infrastructure as well as a virtual Chief Information Security Officer, or vCISO. Our cybersecurity risk management strategy is informed by periodic conversations with, and risk assessments conducted by, our vCISO.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: We, with assistance from our contracted third-party cybersecurity advisors, identifies, protects, and responds to our cybersecurity risks and incidents, through the following activities: • monitoring emerging data protection laws and implementing changes to processes that are designed to comply with such laws; • requiring employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employing technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, double verification software, and access controls; • performing backups of local hard drives and our financial systems in the cloud and on physical media that are stored off-site in locked locations; • providing mandatory training for our employees regarding cybersecurity threats; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: The full Board is responsible for oversight of cybersecurity risk and receives regular reports from the CTO or CEO. Our CTO also present his assessment of material risks from cybersecurity threats to the Board at least annually. If a cyber incident is reported to the Board of Directors, our Incident Response Plan is triggered which involves a number of immediate actions be initiated. The impact, if any, of cyber incidents on internal control over financial reporting is discussed with the full Board.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: The Company faces various risks from cybersecurity threats in connection with its business on a day to day basis, including, without limitation, information theft, destruction and inaccessibility; unauthorized disclosure of sensitive or confidential information; extortion; harm to clients and employees; reputational risk, legal and regulatory risk and increased costs to manage cyber risk, which could materially adversely affect our business, strategy, results of operations and financial condition. Our cybersecurity risks arise out of managing sensitive and confidential information of our clients, as well as our own confidential and proprietary information, and our dependence on information technology systems and networks to securely process, transmit and store this information and to communicate among our global locations and with third parties, including our clients and other key stakeholders involved in our clients' transactions. The cyber threat landscape is constantly evolving, and the increase in periodic work-from-home workforce and their reliance on technology that enables such work has increased the cyber threat landscape and related risks. While we do not believe we have, as of the date of this Form 10-K, experienced a cybersecurity incident that materially affected our business, our business strategy, our results of operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For further information, see "Our business is subject to various cybersecurity and other operational risks" and "We may incur losses as a result of unforeseen or catastrophic events, including the emergence of a pandemic, cybersecurity incidents and events, terrorist attacks, war, trade policies, military conflict, climate-related incidents, or other natural disasters" in Item 1A, Risk Factors of this Annual Report.

companyName: Moelis & Co

ticker: MC


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Senior management, including the Company's Chief Executive Officer, Chief Financial Officer and Chief Operating Officer, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable and resilient technology infrastructure, fostering a culture of technology risk awareness and continuously improving its technology risk management practices. Our process for monitoring and mitigating cybersecurity risk is designed in conjunction with our overall Risk Management Policy and Information Security Program. One of the key aspects of these programs are various risk assessments that are used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program. Annually, we engage a third party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements as well as a full-scope independent audit of IT and Information Security processes.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: Tarak Patel, Information Security Officer - Mr. Patel has facilitated the management of information security programs at financial institutions for over 17 years.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Blackstone's CSO reports to both our executive officers as well as our board of directors and/or the audit committee annually on cybersecurity matters, including risks facing us and our Manager and, as applicable, certain incidents. In addition to such annual reports, our board of directors and/or audit committee receive periodic updates from Blackstone on the primary cybersecurity risks facing us and our Manager and the measures we and our Manager are taking to mitigate such risks, as well as on changes to our and our Manager's cybersecurity risk profile or certain newly identified risks.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: The Cyber Incident Response Team ("CIRT") is responsible for the incident response process and provides direction and guidance to users of Booz Allen information systems when responding to cybersecurity incidents. The CIRT also provides intrusion monitoring of networks and information systems, and performs triage and analysis of events to identify potential incidents, including potential incidents occurring on third-party systems. The CIRT categorizes anomalous cybersecurity events into discrete levels in which cybersecurity events are escalated to appropriate levels of management, as well as our Cyber Incident Materiality Committee, Audit Committee, and Board, based on the severity of the incident. While typical cybersecurity management and incident response is provided by internal resources, we have arrangements with certain third parties whom we can engage if additional support and resources are required.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: As many security threats involve email and social engineering, the IT Provider has a multifaceted security training program for Affiliated Group employees. Cybersecurity training classes are administered at least annually. Testing and assessment of employees' ability to thwart attacks are performed throughout the year, with training being targeted at areas of users' weakness.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: management and strategy have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: The Company's cybersecurity risk management program is based on industry standards and best practices and aligns with the Center for Internet Security and National Institute of Standards and Technology ("NIST") cybersecurity frameworks. On an annual basis, GoHealth engages a third-party vendor to assess the maturity of its cybersecurity processes, which assigns the Company an NIST Cyber-Security Framework implementation tier score upon completion of the assessment. A third-party vendor is also currently conducting a qualitative assessment of GoHealth's cybersecurity controls, policies and programs, the output of which will be a comprehensive report issued to the Company.

companyName: GoHealth, Inc.

ticker: GOCO


text: The Risk & Technology Committee periodically reports to the Board of Directors regarding its activities, including those related to cybersecurity. As part of its oversight of major financial risk exposures, the Audit Committee also reviews with management and the Company's internal and independent auditors the Company's risk assessments and risk management program, including with respect to cybersecurity. Board members receive presentations on cybersecurity topics from our CISO or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: The Company holds ISO 27001-2022 certification for information security at our corporate headquarters. Our Chief Information Security Officer ("CISO"), who has over 30 years of experience in information security and technology leadership, has primary responsibility for (i) leading our global information security program, (ii) managing the cybersecurity risks identified as part of the ERM program, and (iii) developing, implementing, and enforcing security policies and maintaining information security systems.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: Our Audit Committee oversees our ERM program, including the management of risks arising from cybersecurity threats. The Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Internal Audit function performs periodic audits of our cyber security program and reports results to the Audit Committee. On a periodic basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 (a) of Regulation S-K promulgated under the Securities Exchange Act of 1934.

companyName: PARKERVISION INC

ticker: PRKR


text: As of the date of this filing, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our company, including our financial condition and results of operations.

companyName: INTRUSION INC

ticker: INTZ


text: Our management team, including our Chief Information Officer, Senior VP Global IT Operations and IT Security Director, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The cybersecurity team leads dedicated cybersecurity meetings with the Chief Corporate Governance & Compliance Officer and key members of the legal and compliance department. This group meets monthly and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. The leadership of our cybersecurity team averages approximately 25 years of experience with information technology, with a background deeply rooted in data management and protection and data analytics and brings extensive experience in information security strategy and risk management at Houlihan Lokey and in previous roles.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: The Bank's CISO has over 20 years of experience serving in various IT roles, and he maintains a number of technology and cloud certifications, including the Certified Information Systems Security Professional certification.

companyName: Federal Home Loan Bank of Dallas


text: We collect, store, process and use data necessary to conduct our business, including information regarding our customers and employees in digital form. Data maintained in digital form is subject to unauthorized access, modification, theft, misuse or other cybersecurity risks.

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at Tripadvisor. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: Liberty TripAdvisor Holdings, Inc.


text: The Security and Technology Risk Leadership Committee provides leadership and oversight of our cybersecurity program. It is chaired by our CISO and composed of Company technology leaders as well as a cross-functional group of representatives from other departments. Our Privacy and Data Governance Committee provides leadership and oversight of our privacy and data governance programs. It is chaired by our Chief Privacy Officer and composed of a cross-functional group across approximately 20 departments. These committees generally meet monthly or every other month and report to the Data Security and Privacy Governance Committee on a regular basis.

companyName: HOME DEPOT, INC.

ticker: HD


text: Cybersecurity training and safety are fundamental pillars to our overarching global information security strategy. The Global Information Security Team periodically shares security tips and best practices for all employees to raise awareness around digital security and routinely conducts phishing simulations and testing scenarios to complement required employee trainings on cybersecurity fundamentals, awareness, common threats and data loss prevention.

companyName: COTY INC.

ticker: COTY


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, including through vendor security questionnaires as appropriate.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.

companyName: Veris Residential, L.P.


text: of JiuGe Technology oversees this assessment, which is performed by a third party hired by JiuGe Technology and includes some government oversight, called the Multi-Level Protection Scheme ("MLPS"), the objective of which is to protect data and information systems from security threats. The assessment stratifies IT systems based on the risk and severity of potential security breaches related to the data handled and assesses the effectiveness of the systems in safeguarding against cyber threats. The MLPS includes attributes such as physical security, network security, host security, application security, and data security. The final MLPS report is submitted to the appropriate authorities, and the IT Manager also reviews this report with our CFO.

companyName: FingerMotion, Inc.

ticker: FNGR


text: The Board of Directors takes an active role in overseeing management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure and our strategies for dealing with this risk with our long-term objectives. The Board has delegated the cybersecurity risk oversight function to the Audit Committee. To support our Audit Committee in this function, our Audit Committee has engaged a third-party expert to advise it and the Board on cybersecurity matters, including oversight of the Company's continued development, evolution and investments in cybersecurity infrastructure, policies and practices. Senior leadership, including our CIO and CISO, brief the Audit Committee quarterly, or more regularly, as needed, on the Company's cybersecurity program, including cybersecurity risks, business-impacting incidents and ongoing and future cybersecurity project status. In addition, the Audit Committee's third-party cybersecurity advisor meets regularly with the CIO and CISO to review our cybersecurity strategy and key initiatives and progress toward meeting our objectives. The Audit Committee reports to the full Board at least quarterly regarding its oversight of cybersecurity risks, events, developments and other related matters, as relevant. The full Board also periodically receives briefings from management on our cybersecurity risk management program.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Our cybersecurity operations are led by our Senior Vice President of Technology, who has over 20 years of experience in the field of cybersecurity. He is responsible for developing and implementing our cybersecurity strategy, policies, standards, and practices. He also oversees our cybersecurity team, which includes a staff member who recently completed his master's degree in cybersecurity. Our cybersecurity team monitors, detects, responds, and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.

companyName: urban-gro, Inc.

ticker: UGRO


text: We recognize the importance of assessing, identifying, and managing material risks associated with cyber security threats, as such term is defined in Item 106(a) of Regulation S-K. We have established internal procedures for assessing, identifying and managing cyber security risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and refine our practices. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: TOMI Environmental Solutions, Inc.

ticker: TOMZ


text: To supplement our own internal processes and controls, we regularly engage consultants and other third parties as part of our Program, including to periodically: • Test our information security defenses and to perform external penetration assessments; • Review and assess the Program and its maturity; and • Advise our Board of Directors and management regarding the structure and oversight of the program, incident response services and various cybersecurity related matters We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers and their information systems. As part of these processes, we conduct cybersecurity due diligence around significant third-party service providers who access our information technology systems before their engagement. We require third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations. Additionally, we obtain System and Organization Controls ("SOC") 1 or SOC 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk associated with our relationship with the host vendor. If a host vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess information security risk associated with the relationship.

companyName: YUM BRANDS INC

ticker: YUM


text: Our Vice President, Information Technology ("VP IT"), with support from our Information Technology Infrastructure Team ("Infrastructure Team" and, together with the VP IT, the "Cybersecurity Team"), has primary responsibility for the assessment and management of risks from cybersecurity threats. Collectively, the four members of the Cybersecurity Team have over 75 years of cybersecurity-related experience in both the private and public sectors, including perimeter and internal network security, secure email gateway, B2B and B2C eCommerce, on-premises and cloud storage environment security, and ransomware protection solutions. In addition, members of the Cybersecurity Team have multiple network-security certifications relevant to the technologies we deploy.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Our chief information officer and our security architect are responsible for day-to-day assessing and managing the cybersecurity risk and threats through internal assessment tools as well as third-party control tests, for audits and evaluation against industry standards and regulations.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates periodically from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties and employees) and other data, confidential information or intellectual property. To date, these incidents have not had a material impact on our service, systems or business and we do not believe cybersecurity risks from these prior incidents are reasonably likely to materially affect our operations. For further information on cybersecurity risks and potential related impacts on us, see "Risk Factors – Our business and our reputation could be adversely affected by the failure to protect sensitive customer, employee or vendor data, whether as a result of cyber security attacks or otherwise, or to comply with applicable regulations relating to data security and privacy."

companyName: CrossAmerica Partners LP

ticker: CAPL


text: We do not currently identify any major cybersecurity threats that have materially affected or are reasonably likely to materially affect us (including our business strategy, results of operations, or financial condition).


text: Operations Officer (COO): The COO, reporting to the Chief Executive Officer (CEO), leads the development and implementation of our cybersecurity strategy. With over 15 years of experience in cybersecurity the COO oversees risk assessments, incident response, and compliance with industry standards.

companyName: Quality Industrial Corp.

ticker: QIND


text: In the last three years, we have not experienced a cybersecurity threat or incident that materially affected our business strategy, results of operations, or financial condition. However, there can be no guarantee that we will not experience such an incident in the future.

companyName: Atlas Lithium Corp

ticker: ATLX


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented cybersecurity measures and protocols for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall risk management framework. We aim to ensure a comprehensive and proactive approach to safeguarding our assets and operations.

companyName: TEN Holdings, Inc.

ticker: XHLD


text: The CIO, in coordination with senior management including the CFO, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. The CIO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises developed in partnership with external security experts. These events are designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive/evolving, simulated scenario. This exercise provides an opportunity for us to test our response procedures, escalation and communication protocols, roles and responsibilities, legal/privacy considerations and key decision-making processes, in a safe and controlled environment. The participants in these exercises include leaders, stakeholders, subject matter experts and certain executives. In addition to these internal measures, the effectiveness of components of our overall cybersecurity program is frequently evaluated by external third parties, exclusive to our independent registered public accounting firm and scope of internal control over financial reporting. This includes work performed over various levels of controls assessments for specific business lines and core processes. These include Health Information Trust Alliance ("HITRUST") for health care data security, Payment Card Industry Data Security Standard (PCI DSS) for payment security, and System Organization Controls (SOC) 2 for information security and related controls. We also perform an annual maturity assessment and benchmark our security controls to identify opportunities to strengthen our cybersecurity program.

companyName: Cigna Group

ticker: CI


text: Our management is actively involved in the oversight of our cybersecurity risk management program. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations. We have incorporated cybersecurity processes to assess, identify and manage risks from cybersecurity threats into our overall risk assessment process. The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats along with risk assessment procedures designed to allow such processes to remain responsive to emerging risks. Our processes include, but are not limited to, the following: • we engage third-party cybersecurity firms and tools to assist with network monitoring, endpoint protection, vulnerability assessments and penetration testing; • we engage cyber security consultants and auditors to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures. Identified risks are formally tracked until mitigated or eliminated; • we perform regular scanning of our systems to identify and resolve critical vulnerabilities; • we provide periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • we insure against potential losses from cyber incidents by maintaining cybersecurity insurance.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: We have not previously experienced a cybersecurity incident that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, " Risk Factors," in this Annual Report on Form 10-K.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: Within management, the Group Chief Technology Officer of our business units are primarily responsible for assessing and managing our material risks from cybersecurity threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.

companyName: SOCIETY PASS INCORPORATED.

ticker: SOPA


text: The Company employs a software platform designed for tracking, monitoring, and managing cybersecurity threats across its systems and networks. The platform serves as a centralized hub that aggregates data from various sources, allowing the cybersecurity team, led by the CISO, to take action to mitigate risks. This technological tool serves as a key component in the Company's cybersecurity arsenal, enhancing its ability to monitor, analyze, and respond to evolving cyber threats.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Cyber threat actors and cybersecurity incidents are a reality and the Company and our third parties face cybersecurity threats in the normal course of business. As of the date of this report, we are aware of the incident described in Item 9B "Other Information" of this report and, as of the date of this report, we have not experienced material losses or consequences relating to material cybersecurity incidents experienced by us or our third parties. However, we expect businesses will continue to experience cybersecurity risks that could result in adverse impacts with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by third parties, will not have a material adverse impact on the Company, including its business strategy, results of operations and/or financial condition. Future cybersecurity threats and incidents could have a material impact on our service, systems or business and are discussed in "Risk Factors" to this report.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: The Company has an Incident Response Plan to help reduce the risks related to security incidents by providing guidelines on responding to incidents; focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled appropriately.

companyName: LAKE SHORE BANCORP, INC.


text: We are in the process of implementing various information security procedures designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature.

companyName: SunPower Inc.

ticker: SPWR


text: Although we ascertained that certain information was exfiltrated, we are still investigating the extent of compromise of any sensitive information contained within the accessed IT systems.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: The following is a brief list of some of the cybersecurity risk management tools we employ to identify, assess and manage threat risks: –Third party system and network scanning tools that identify or automatically block potential cybersecurity threats; –Live 24-hour monitoring of corporate and field operations IT networks for cybersecurity threats; –Mandatory annual employee cybersecurity awareness training program that includes phishing simulations and other microlearning courses; –Monthly IT and cybersecurity meetings with management and IT professionals; –Completion of annual IT network cybersecurity assessment and vulnerability scan;

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: Our Executive Director of IT, in coordination with our executive management team, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Executive Director of IT and the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Passage BIO, Inc.

ticker: PASG


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks it faces, including the Company's Executive Vice President and Chief Technology Officer and Director of Information Security. The Company's current Director of Information Security has over 28 years of experience. For the past 7 years, the Company's Director of Information Security has successfully managed teams, implementing and maintaining robust cybersecurity and data protection controls to safeguard the Company's information assets. The Company's Director of Information Security reports directly to our Executive Vice President and Chief Technology Officer, who possesses extensive expertise gained through over 39 years in various IT and leadership roles. This combined experience ensures exceptional guidance and oversight of our cybersecurity program.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: These members of management are responsible for overseeing and monitoring the prevention, mitigation, detection, and remediation of cybersecurity incidents as part of their involvement in the cybersecurity risk management and strategy processes, including the execution of our incident response plan.

companyName: WAFD INC

ticker: WAFD


text: At Precigen, cybersecurity risk management is an integral part of our overall enterprise risk management processes. Our cybersecurity risk management program is managed by our security steering team. Designed to align with industry's best practices, our program provides a framework for identifying, monitoring, assessing and responding to cybersecurity threats and incidents and facilitates coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: PRECIGEN, INC.

ticker: PGEN


text: Prevention. Our cybersecurity program starts with prevention, which includes risk assessment and identification and utilizing that information to design an effective layer of controls as a baseline.

companyName: Anywhere Real Estate Group LLC


text: In the ordinary course of our business, the Company is subject to cybersecurity threats and risk which it manages as an important component of its overall enterprise risk management and mitigation strategy. We use, store and process data for our customers, employees, partners and suppliers. We have not yet implemented a formal cybersecurity risk management program designed to identify, assess and mitigate risks from cybersecurity threats to this data, our systems and business operations. We intend to implement a cybersecurity risk management program before the end of 2024.

companyName: T-REX Acquisition Corp.

ticker: TRXA


text: CONSOL Energy accounts for cybersecurity risk as a part of the Company's overall business strategy and planning. The Board's Audit Committee, which oversees all matters related to risk management and, in particular, the security of and risks related to the Company's information technology systems, receives regular reports on the Company's cybersecurity risk management efforts from various senior officers of the Company. The Company also has a corporate cybersecurity risk Steering Committee, which is a cross-functional group comprised of both senior management and other key business unit leaders that provides input to senior management on the Company's cybersecurity risk program.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. Our management will promptly report to the board of directors on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks. In the event of a cybersecurity incident, we intend to follow an incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the board of directors. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: DT Cloud Acquisition Corp


text: The Company has a structured risk management process for identifying, reviewing, and assessing material risks from cybersecurity threats. These processes are included in the Company's overall risk management process, which is overseen by the Audit Committee of the Company's Board of Directors. As part of the cybersecurity risk management process the Company uses various methods to monitor and evaluate its threat environment and its risk profile. These methods include using manual and automated tools such as vulnerability scanning software; monitoring current and emerging cybersecurity threats; studying reports of threats and threat actors; performing scans of the threat environment; assessing our industry's risk profile; conducting internal and external audits and assessments; and carrying out threat and vulnerability assessments. To manage and mitigate material risks from cybersecurity threats to our information systems and data, the Company implements and maintains a variety of technical, physical, procedural, and organizational measures. These measures include access controls for networks, devices, and applications; firewalls and antivirus/antimalware software; management of network and user device configurations; encryption of data; monitoring of networks, devices, applications, and accounts; penetration testing; asset management procedures; risk assessments; incident detection and response plans; vulnerability management processes; business continuity and disaster recovery plans; internal IT controls; and employee cybersecurity awareness training.

companyName: Crimson Wine Group, Ltd

ticker: CWGL