text: The cybersecurity team, with external third-party involvement, conducts risk assessments and system enhancements, and provides employee training during the onboarding process and annually with additional training as we deem appropriate. We have adopted and implemented an Information Security Program that outlines our security and data protection policies and procedures. This program is approved by the CISO and is reviewed and updated at least annually, or more frequently on an as-needed basis, to account for changes in the evolving cybersecurity threat landscape as well as legal and regulatory developments. Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over critical third parties with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such third parties remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties. When we do become aware that a third-party vendor or service provider has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate.

companyName: AssetMark Financial Holdings, Inc.


text: require employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential;

companyName: GLAUKOS Corp

ticker: GKOS

secItem: Item 1C


text: We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. We periodically send "Test" phishing assessments to our members. Any failures trigger a retraining exercise. Also, we have specific and regular training for our IT and finance members, as well as our system administrators.

companyName: Woodward, Inc.

ticker: WWD


text: Phreesia takes a cross-functional approach to address the risks from cybersecurity threats. The Company's Board of Directors (the "Board") holds oversight responsibility over the Company's enterprise risk management ("ERM") program, which incorporates the Company's cybersecurity risk management program. The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Technology Officer, who serves as the Company's Security Officer, along with other members of management including the Senior Director of Security Engineering, the Chief Privacy Officer, and the compliance, audit, and risk teams.

companyName: Phreesia, Inc.

ticker: PHR


text: Our management team supervises efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: Role of Management Our CTO oversees and provides accountability related to our cybersecurity risk management strategy and overall information security program. The CTO's cybersecurity team is led by a Director of Information Technology Security. The cybersecurity team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The program incorporates policies and practices designed to protect the privacy and security of our sensitive information.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: Role of Management Through our services agreement with Liberty discussed in Item 1 of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and at Braves Holdings.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: The Company provides periodic training for personnel regarding cybersecurity threats, with such training scaled to reflect the roles, responsibilities, and access of the relevant Company personnel.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Although the Company has designed its cybersecurity program and oversight to mitigate cybersecurity risks, the Company faces unknown cybersecurity risks, threats, and attacks. On March 1, 2025, the Company experienced a system outage caused by a cybersecurity incident. Upon discovery, the Company activated its incident response team, comprised of internal personnel and external cybersecurity experts retained to assist in addressing the incident. While the full scope of the impact is not yet known, the incident could have the potential to have a material impact on the Company's financial condition and results of operations. The Company is continuing its forensic investigation and analysis to assess the potential impact.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Corporation's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: As mentioned above, the Company employs a layered, defense-in-depth approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block and provide alerts regarding suspicious activity and to report on any suspected threats. These controls include appropriate access controls based on least privilege, multifactor authentication for remote and privilege access, and encryption to protect data. The information security program is designed to comply with applicable laws and regulations and is driven by industry standards for financial institutions, including the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, as well as by the guidance promulgated by the National Institute of Standards and Technology ("NIST"). We work closely with government and industry associations to stay abreast of developments and share best practices with respect to cybersecurity. The following paragraphs describe how we test, or otherwise obtain feedback about, the Company's cybersecurity and other information security. The feedback we develop through testing and assessment, in addition to information about cybersecurity threats or incidents impacting other entities, is incorporated into the Company's information security program to enhance our cybersecurity; in certain circumstances a new or emerging cybersecurity threat may require modifications to how we conduct business.

companyName: RENASANT CORP

ticker: RNST


text: The Company's cybersecurity policies and procedures are reviewed by the CISO and updated at least annually. In addition, under the IRP, following the resolution of a cybersecurity incident, the Company will generally consider the effectiveness of the Program and the IRP, make adjustments as appropriate, and report to senior management and the Audit Committee as appropriate on these matters. The cybersecurity policies and procedures are communicated and enforced throughout the Company, as well as with the third-party service providers that have access to the Company's information systems or nonpublic information. Cybersecurity policies and procedures are also subject to periodic review and audits by internal and external parties, such as the internal audit function, external auditors, regulators, or independent assessors. The Company requires employees to undergo cybersecurity-related training, including phishing prevention training, and employees are tested regularly through phishing exercises.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: The audit committee receives periodic reports from the Head of IT and Chief Operating Officer concerning the company's significant cybersecurity threats and risk and the processes the company has implemented to address them. The audit committee also receives summaries or presentations related to the company's information systems and data and cybersecurity threats, risk and mitigation.

companyName: Equillium, Inc.

ticker: EQ


text: We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection and alerting tools, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology ("NIST") cybersecurity framework.

companyName: MBX Biosciences, Inc.

ticker: MBX


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents, have had, or are reasonably likely to have, a material effect on our business strategy, results of operations or financial condition, but we cannot assure that our business strategy, results of operations and financial condition will not be materially affected in the future by cybersecurity risks or future cybersecurity incidents.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: S&T performs periodic risk assessments that seek to identify both technical and physical risks to information systems. The assessments incorporate cybersecurity-related principles from the Federal Financial Institutions Examination Council, or FFIEC, Information Technology Examination Handbook, regulatory guidance and concepts from other industry standards, including the NIST Cybersecurity Framework. An assessment typically includes: • identifying reasonably foreseeable internal and external threats that could result in a cybersecurity incident; • assessing the likelihood and potential impact of those threats; and • assessing the sufficiency of policies, procedures, practices, and technical measures in place to manage risks. In addition to periodic risk assessments, S&T evaluates changes to IT systems or physical systems for any information security impacts. S&T utilizes staff and independent third parties to conduct annual penetration testing and IT security health assessments. We engage third parties to facilitate tabletop incident response and business continuity exercises. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.

companyName: S&T BANCORP INC

ticker: STBA


text: Although we did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: ACORN ENERGY, INC.

ticker: ACFN


text: Conagra's Cybersecurity Team is led by our Chief Information Security Officer (CISO). Our CISO, a certified information security professional, has more than 25 years of cybersecurity leadership experience across multiple industries and holds a Doctor of Science (DSc) degree in Cybersecurity. The CISO reports to our Chief Information Officer (CIO), who has been with Conagra for more than 20 years serving in various leadership roles in information technology, finance, and business services. We believe our CIO possesses a firm understanding of the Company's cybersecurity landscape, risks, and knowledge of the capabilities of our cybersecurity and information systems personnel.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Our policies and procedures concerning cybersecurity matters apply to all employees. These policies and procedures address encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information, and the use of the internet, social media, email and wireless devices.

companyName: Enhabit, Inc.

ticker: EHAB


text: The Company performs an annual cybersecurity risk and control assessment as part of the Enterprise Risk Management team's risk assessment processes. The CISO and the Chief Financial Officer of the Company's Technology group review and approve the cybersecurity assessment. The Company's Chief Technology and Operations Officer reviews and approves the list of emerging, strategic and transformative risks upon which the Enterprise Risk Management team's cybersecurity risk and control assessment processes are based. In addition, as part of their regular responsibilities, the Company's Governance, Risk and Compliance officers within its Technology and Cybersecurity groups assess technology and cybersecurity risks by leveraging the Company's risk framework related to technology and cybersecurity, which aligns with the Company's enterprise risk management strategy.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Material risks are those that have the potential to cause substantial harm or financial loss. Our approach involves a targeted strategy to protect critical data, systems, and infrastructure against cybersecurity challenges including cyber threats, data breaches, or regulatory compliance issues.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Automated threat and vulnerability management systems are in place and updated per industry standards and best practices. Our IT team further manages risk by evaluating external providers of threat, vulnerability, and risk mitigation information. This information is used to proactively implement new methods or controls for reducing risk associated with a particular emerging threat or vulnerability.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: The Company's Board of Directors oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually. In the event of a cybersecurity incident determined to be significant, management will notify the Board.

companyName: C-Bond Systems, Inc

ticker: CBNT


text: In fiscal 2024, we engaged an independent cybersecurity advisory firm to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we engaged an international cybersecurity company, specializing in IT services and software development, to augment our monitoring, incident response, detection, and forensics efforts; various Information Sharing and Analysis Centers (ISACs) for threat intelligence, and a recognized cyber defense company that specializes in threat intelligence and incident response services.

companyName: Aramark

ticker: ARMK


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor's managed cybersecurity provider, notifications from our Advisor's employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor's incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: Net Lease Office Properties

ticker: NLOP


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Bancorp 34, Inc.

ticker: BCTF


text: To oversee cybersecurity risk at the management level, we employ a Chief Data and Information Officer ("CDIO") and a Chief Information Security Officer ("CISO"). The CDIO is responsible for the global data landscape and IT systems across our business units, including information security. The CISO leads our Information Security team. The CISO and his team are responsible for administering our comprehensive, company-wide information security program, which includes strategy, regulatory intelligence, IT risk management, policy development, security engineering, cyber threat detection, response, and operations. Our information security program is based upon, informed by, and responsive to industry best practice frameworks such as HITRUST CSF and ISO 27001. Our program undergoes an internal annual review that is conducted by our CISO, as well as an annual third-party external review. Additionally, we leverage a diverse array of internal and external assessors, consultants, auditors, and other third parties to identify opportunities for improvements to our information security program through methods such as penetration testing, independent audits, and consulting on best practices to address emerging risks and challenges. These assessments encompass evaluations of both the design and operational effectiveness of our security measures. They also consider the evolution of different cybersecurity threats, including through artificial intelligence. Additionally, we are a member of H-ISAC, an industry cybersecurity intelligence and risk-sharing organization, which enables us to stay informed about developments, trends, and risks in the cybersecurity threat landscape and consider any necessary updates to our information security program related thereto. We are committed to employing cybersecurity best practices and have obtained and maintain multiple industry best practice cybersecurity certifications such as ISO 27001and SOC1/SOC2.

companyName: Cencora, Inc.

ticker: COR


text: Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will prevent material compromises to our information technology systems in the future that could have a material adverse effect on our business. As of the date of this filing, we are not aware of any current cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Information Technology and Cybersecurity" in our Risk Factors in Item 1A of this Form 10-K.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: Under the Risk Committee's oversight, management works closely with key stakeholders, including regulators, government agencies, peer institutions, and industry groups, and develops and invests in human talent and innovative technology in order to better manage cybersecurity risk. The firm's cybersecurity program is led by our CISO, who, effective October 1, 2024, reports to our Chief Information Officer ("CIO"). The CISO, in coordination with our information technology, compliance (including privacy), and risk management functions, works collaboratively across the firm to implement a program designed to protect the firm's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the firm's incident response and recovery plans. We maintain policies and procedures for the escalation of cybersecurity incidents assessed as potentially being or becoming material. Such incidents are escalated to a multidisciplinary group of senior leaders from our risk management, regulatory, compliance, finance, and legal teams, to assess such incidents for reporting under regulatory guidelines. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework and financial condition, as well as the potential impact, if any, to our business strategy or reputation. Through ongoing communications with these teams, the CISO monitors the mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the Risk Committee when appropriate.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our information security consultant and third-party managed service provider. Our information security consultant has over 40 years of experience in pharmaceutical information technology, including many years as a chief information officer.

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: The company maintains a program, run by the company's Director of Information Technology, overseen by the company's Chief Financial Officer, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by or in the care of the company. The company has implemented a cybersecurity incident response plan that provides controls and procedures to facilitate timely and accurate reporting of any material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by a designated cybersecurity team using established risk criteria. If a cybersecurity event meets certain of these criteria, it is escalated to an internal cross-functional Cyber Incident Response Team and external incident responders. The company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The plan also contains procedures for escalating cybersecurity incidents to the Board of Directors.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Cybersecurity Risk Assessment We work to identify and manage cybersecurity risks through established processes and accountability. We also conduct periodic reviews and updates to uphold our security standards. Our management has implemented ongoing and annual risk assessment processes to identify and manage risks that could affect our ability to safeguard sensitive data or provide reliable transaction processing. These risks include, but are not limited to: • Regulatory compliance • Third-party management, including risks from business partners and software providers • Mergers and acquisitions • System availability and disruption of business operations • Data security • Vulnerability and configuration management • Fraud and extortion • Reputational risk As of December 31, 2023, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, cash flows, financial condition or results of operations. See Part I, Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: Elevance Health, Inc.

ticker: ELV


text: Post-Incident Activity After recovery, the IRT gathers and preserves all incident-related documentation and conducts a post-incident analysis to identify and implement enhancements to the cybersecurity program that can mitigate the risk and/or severity of future incidents. The results of these reviews are shared with management and the Audit Committee. The incident response coordinator typically oversees the preparation of the formal incident report, its distribution, and the implementation of any enhancements identified through these reviews.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: The Company adheres to strict protocols for evaluating and reporting cybersecurity incidents. Any incidents determined to have a material impact—assessed based on financial, operational, or reputational factors—are raised with the Board of Directors and, if necessary, disclosed in accordance with regulatory requirements.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").

companyName: ISHARES GOLD TRUST

ticker: IAU


text: Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats. The Board's Audit Committee oversees management of financial, regulatory, compliance and security risks and receives reports at least quarterly from our Chief Information Officer regarding our cybersecurity programs, vulnerabilities, threats and risks. The full Board is regularly informed about such risks through committee reports, attendance at committee meetings and other communications.

companyName: COMSCORE, INC.

ticker: SCOR


text: Our cybersecurity risk management strategy is designed to detect, evaluate, and manage risks from cybersecurity threats and incidents. Our program is intended to identify cybersecurity risks facing our organization and inform our risk-based approach to cybersecurity preparedness and incident response procedures.

companyName: UNIFIRST CORP

ticker: UNF


text: Management's Responsibilities In the event we identify a potential cybersecurity or data privacy issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders, and law enforcement when responding to such issues. We have a dedicated management team overseeing our cybersecurity and data privacy initiatives, led by our Chief Information Officer, our Vice President and Global Data Privacy Officer, and our Vice President of Cybersecurity, each in consultation with professional advisors. Our Chief Information Officer has over 25 years' experience overseeing and managing information technology teams and complex IT systems, and our Vice President of Cybersecurity has over 15 years' experience developing and managing cybersecurity functions and strategies. Our Vice President of Global Data Privacy is a recognized leader in the industry with over ten years of experience in managing global data privacy programs. Our cybersecurity and data privacy management team regularly meets with senior executives and other team members to provide oversight with respect to our cybersecurity and data privacy risk detection, identification, assessment, classification, and mitigation efforts.

companyName: Bally's Corp

ticker: BALY


text: Reviewing the scope of the security measures in the cybersecurity program at least annually, or whenever there is a material change in our business practices that may implicate the security or integrity of records containing personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Company's cybersecurity risks are theft of intellectual property, theft of other business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational risk, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if the Company were to sustain a breach of its systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: enVVeno Medical Corp

ticker: NVNO


text: Our Director of IT Operations and Security and Senior Director of IT are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. For example, our Director of IT Operations and Security holds a Master of Science in information security and assurance, holds relevant certifications such as Certified Ethical Hacker, Computer Hacking Forensics Investigator, Security+ and Network+, and has worked for approximately nine years in the field of cybersecurity. Our Senior Director of IT has 25 years of IT management experience at various public biotechnology companies. Our Chief Financial Officer is responsible for helping prepare budgets, helping prepare for cybersecurity incidents, and approving certain cybersecurity processes.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as our business depends on customers trusting that their shopping experience with us is both reliable and safe. We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our regular enterprise risk management updates to the Audit Committee, (ii) our information technology and security related internal controls and (iii) our global incident response and vulnerability management programs.

companyName: Wayfair Inc.

ticker: W


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: YHN Acquisition I Ltd

ticker: YHNA


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BREIT, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: We provide various training programs and tools to employees so they can avoid risky practices and help us promptly identify potential or actual issues. We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow up on matters already reported. The Compliance team, led by our Chief Technology Officer, develops and implements our strategy, as well regularly review and update our policies, procedures, processes and practices to address changes in the threat landscape and as a result of lessons learned from suspected, actual or simulated incidents. We also conduct tabletop exercises and engage third party services to conduct evaluations of our security controls through penetration testing and independent audits. We also review industry best practices to assist in evaluating responses to new challenges and risks. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: VEEA INC.

ticker: VEEA


text: While acknowledging the existence of various cybersecurity risks, to date, they have not materially affected our business strategy, results of operations or financial condition. Although we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: Audit Committee assists our Board in overseeing Cybersecurity risk management and the integrity of our information technology systems, processes, and data. Periodically, the Audit Committee reviews and discusses with management, and, in its discretion, third party vendors or other external experts, the adequacy of security for our information technology systems, processes, and data; our incident response and contingency plans in the event of a breakdown or security breach affecting the security of our information technology systems or data or the information technology systems, processes, and data of our clients; and any new threats or incidents that have or may impact us. The Audit Committee receives reports on the operation of such programs from the Chief Financial Officer as appropriate. The Audit Committee also reviews management reports regarding the evolving threat environment, vulnerability assessments, and specific Cybersecurity incidents. Periodically, the Audit Committee reports on Cybersecurity matters, incidents, and risk oversight to the Board.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: Our Board of Directors is responsible for oversight of the risks that the Company faces, including cybersecurity threats. Our operating divisions and management teams help identify risks that are relevant to the Company during our periodic business planning and review cycle and rank these risks in relation to the achievement of business objectives. We understand cybersecurity threats to be dynamic and to intersect with various other enterprise risks within the organization. We have therefore integrated cybersecurity risk into our overall risk management program.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: The Company faces significant and persistent cybersecurity risks due to: the breadth of geographies, networks, and systems ADM must defend against cybersecurity attacks such as exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats; the attractiveness of the Company's systems and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on ADM or its customers; the substantial level of harm that could occur to the Company and its customers in case of a material cybersecurity incident; and ADM's use of third-party products, services and components. During the year ended December 31, 2024, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the Company, including its business strategy, results of operations, or financial condition. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving. For more information on the Company's cybersecurity risks, refer to Item 1A. Risk Factors. ADM is committed to supporting the governance and oversight of cybersecurity risks and to implementing mechanisms, controls, technologies, and processes designed to help the Company assess, identify, and manage these risks.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, due to the evolving nature of cyber threats and their increased sophistication, there remains the potential for adverse impacts on the Company should a cybersecurity incident occur. These impacts could include reputational damage, competitive harm, operational disruptions, financial costs, and regulatory actions. Please refer to the risk factor titled "Cybersecurity attacks may threaten our confidential information, disrupt operations and result in harm to our reputation and adversely impact our business and financial performance." See Part I, Item 1A for further information regarding cybersecurity risks and potential impacts on our business and results of operations.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. We face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We, our tenants, and our property managers face risks associated with security breaches through cyber-attacks, cyber-intrusions, or otherwise, as well as other significant disruptions of information technology networks and related systems."

companyName: Chiron Real Estate Inc.

ticker: XRN


text: QNB uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing, and vulnerability assessment. The Information Security Committee has established risk management guidelines for third-party vendors. QNB conducts due diligence reviews of third-party vendors before contracts or agreements for the provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, QNB's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed at least annually. QNB cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, QNB may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that QNB shares with such providers.

companyName: QNB CORP.

ticker: QNBC


text: Overview of Processes for Assessing, Identifying and Managing Material Cyber Risks Because technology, data and information security is a top priority at Blackbaud, we maintain and continuously assess and strengthen our cybersecurity program. Comprehensive cybersecurity risk management, including identification, analysis and response to risks affecting our business and its customers, provides the foundation for our program. Our cybersecurity program has been and will continue to be further enhanced by our compliance with the settlement of governmental investigations relating to the Security Incident. See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident.

companyName: BLACKBAUD INC

ticker: BLKB


text: Collaborative Approach: Our cybersecurity program leverages a defense-in-depth strategy to proactively identify and remediate threats. The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Matterport, Inc./DE


text: Additionally, the Cybersecurity Program includes quarterly general cybersecurity awareness and data protection training for employees as well as regular phishing simulations. The Company also has annual certification requirements for employees with respect to certain policies supporting the cybersecurity program including the IT, Cybersecurity and Physical Security Policies and Procedures, the Disaster Recovery Business Continuity Plan, the Social Media and Electronic Communications Policy and the Privacy Policy.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.

companyName: TaoWeave, Inc.

ticker: TWAV


text: The audit committee of the Company's board of directors, with the assistance of the Company's Chief Executive Officer, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.

companyName: MDWerks, Inc.

ticker: MDWK


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We may be vulnerable to security breaches or cyber-attacks which could disrupt our operations and have a material adverse effect on our financial performance and operating results."

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: Our Board Risk Oversight Committee is charged with overseeing the Company's management of credit, market, liquidity, operational (including information technology and cybersecurity), compliance, reputational and strategic risks, including the annual approval and recommendation to the Board of Directors of the Company's risk appetite statement and approval of the Company's risk management framework.

companyName: Independent Bank Group, Inc.


text: Network and Systems Luxfer's operations are increasingly dependent on IT systems and management of information, and a cyber-attack could inhibit our business operations including disruption to sales, production and cash flows.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Our cybersecurity framework is integrated into Entero's broader enterprise risk management strategy, sharing methodologies, reporting mechanisms, and governance structures with other risk domains including legal, compliance, strategic, operational, and financial risks. Conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;

companyName: GridAI Technologies Corp.

ticker: GRDX


text: During the year ended December 31, 2023, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Company. For discussion of the risks from cybersecurity threats, including potential impact to the Company's business strategy, results of operations, and financial condition, refer to "Item 1A – Risk Factors – The Company's information systems may experience an interruption or breach in security" in this Report, which is incorporated by reference in this paragraph.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Our Vice President of Internal Audit, in collaboration with our General Counsel, facilitates our enterprise risk management ("ERM") process. Cybersecurity related risks are included in our overall risk evaluation for our ERM process to determine top risks for the Firm on an annual basis. Our internal audit team, which reports directly to the Audit Committee, uses the ERM program to develop a risk-based audit plan, which is approved by the Audit Committee annually.

companyName: KFORCE INC

ticker: KFRC


text: The Board of Directors is responsible for the development, implementation, and maintenance of the ISP. Specifically, the Board is oversees: • Continuous administration of the ISP; • Perform an annual review and approval of the ISP policies; • Assignment of critical roles, including the vCISO; and • Review of reports provided by the ISGC at least annually.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: As discussed within "Item 1A, Risk Factors", we rely on service providers to process sensitive business information. As part of our risk management program, we have implemented a process to conduct a security review of third-party service providers, including through vendor questionnaires and contractual-related security requirements, as appropriate. In addition, we engage third-party experts, including external legal counsel and cybersecurity advisors, to assist in our identification and management of cybersecurity risks as needed. We have established an incident response process to assess, respond, and report in the event that a cybersecurity incident is detected. Management has assembled a committee to assess the materiality of the impact of identified cybersecurity incidents on our business and determine any disclosure obligations arising from such incidents.

companyName: Toast, Inc.

ticker: TOST


text: We have extensive incident response plans in place that provide a documented framework to, among other things, identify the critical steps to be taken for immediate rescue and recovery actions when a system disruption occurs. We also have comprehensive business continuity plans in place for disruptions, including a system disruption, that include recovery actions and alternate methods including manual work arounds that allow us to continue operating and shipping products. Our incident response plans and business continuity plans are regularly reviewed and updated, with a focus on continuous improvement.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Our business is highly dependent on electronic information resources used for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our and our clients' information, which we refer to as "information systems", including our computer systems, hardware, software and networks and those of our third-party vendors and service providers. Our operations rely on the secure processing, storage and transmission of confidential and other information by our information systems and those of third parties.

companyName: Lazard, Inc.

ticker: LAZ


text: The Company has seen an increase in cyberattack volume, frequency, and sophistication. ADM seeks to detect and investigate unauthorized attempts and attacks against its network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to the Company's internal processes and tools; however, ADM remains potentially vulnerable to known or unknown threats. The Company's cyber incident response plan includes an escalation process if a cybersecurity incident meets specific rating criteria to trigger swift and effective action designed to minimize potential disruptions and protect the integrity of our operations. The Company also conducts periodic cybersecurity scenarios with senior management to enhance preparedness.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats, who limit the persons who have authorized access to our online accounts and limit the vendors whose services we utilize to a small number of reputable service providers. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. As of the date of this report, we have not encountered any cybersecurity incidents since our IPO.

companyName: ShoulderUP Technology Acquisition Corp.


text: To support incident response preparedness, Mattel has developed a cybersecurity incident response plan and conducts an annual simulated incident exercise. The cybersecurity incident response plan addresses cybersecurity incidents that directly impact Mattel or arise from Mattel's use of third-party technology, information systems, and service providers. Mattel also utilizes business continuity and disaster recovery plans to prepare for potential disruptions in technology that Mattel relies upon. Further, Mattel monitors novel and advanced cybersecurity threats and provides ongoing employee security awareness training.

companyName: MATTEL INC /DE/

ticker: MAT


text: The full Board receives updates periodically or as needed during the year from the Company's Chief Information Officer and actively participates in discussions with management and amongst themselves regarding cybersecurity risks. Updates delivered to the full Board typically include discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. These updates also typically include a review of any recent enhancements to the Company's defenses and management's progress on its cybersecurity, as well as reports on key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: The Company faces a variety of cybersecurity threats that could impact its business, financial condition, results of operations, cash flows or reputation. The Company has established a Cybersecurity Incident Response Team (the "CIRT") to develop and continually enhance a cyber incident response plan, which guides the Company in identification, containment, eradication and recovery from cybersecurity incidents. The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of training procedures and exercises to mitigate and remediate potential cybersecurity incidents. The CIRT members are comprised of representatives from management, including the Company's Chief Executive and Financial Officers, information technology, legal and communications teams and reports to the Risk & Sustainability Committee of the Company's Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company. The Board has an active role in overseeing management of the Company's risks and regularly reviews information regarding the Company's operations, liquidity and associated risks. While each committee of the board is responsible for evaluating certain risks and overseeing the management of those risks, the entire board is regularly informed through committee reports.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct thorough security assessments of all third-party providers before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Executive Director of IT, who oversees the Company's cybersecurity function. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Management is responsible for day-to-day risk management activities, including identifying, assessing and managing our exposure to cybersecurity risks, establishing processes and procedures to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures as needed, and maintaining cybersecurity risk management programs. Our vice president acting as chief information security officer is responsible for defining, overseeing, managing, implementing, and reviewing compliance with the information security programs described above under the heading "Cybersecurity Risk Management and Strategy. " This vice president receives regular reports from our information security team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks. In addition, as described in further detail above under the heading "Cybersecurity Risk Management and Strategy," a cross functional team is involved in assessing and managing the risks from cybersecurity threats and incidents, and reporting information about risks to the Security Committee.

companyName: Palo Alto Networks Inc

ticker: PANW


text: The Company has in place a documented cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Cybersecurity threats and incidents are analyzed by the security operations center and based on the severity of the event, promptly reported by the Chief Information Security Officer to the Vice President Compliance & Audit to initiate cross-functional response team support. The role of the response team includes evaluating compliance with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. As part of the Company's documented response plan, management members of the Board of Directors, who represent a majority of the Board of Directors and who have been delegated responsibility for cybersecurity, are notified of significant cybersecurity events and provide strategic direction through the incident response and communication. The management members of the Board of Directors are regularly briefed on cybersecurity threats relevant to the Company as well as the Company's cybersecurity program, incident response and remediation efforts. The Company's cyber incident response plan is tested periodically through third-party conducted executive and technical tabletop exercises. A summary report identifying strengths and areas for improvement is provided to tabletop exercise participants and utilized by the Company to enhance its response plan.

companyName: BURLINGTON NORTHERN SANTA FE, LLC


text: g.the capabilities and qualifications of the Company's cyber and data privacy personnel; and h.the Company's cybersecurity strategy, related priorities and objectives, and the appropriateness of the resources allocated thereto, including, but not limited to, investments in cybersecurity infrastructure.

companyName: MANNATECH INC

ticker: MTEX


text: The cybersecurity incident response process is governed by our Incident Response Plan ("IRP") and overseen by leaders from our IT security and legal teams. The IRP guides how security events are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: The Information Security Office is comprised of professionals who collectively have significant experience in a wide range of cybersecurity matters, including threat assessment and detection, incident response, and risk management. The Information Security Office works with Dynatrace's other business and corporate functions and keeps the CISO informed and updated regarding key cybersecurity-related matters in accordance with our internal reporting processes.

companyName: Dynatrace, Inc.

ticker: DT


text: Our Chief Executive Officer provides periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: IMMUNIC, INC.

ticker: IMUX


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter. Reports on these topics are provided to the Audit Committee by the Senior Vice President, Chief Technology Officer and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: JFG tests its cybersecurity defenses regularly through automated vulnerability scanning by GIS's 24/7 Security Operations Group to identify and remediate critical vulnerabilities. In addition, an independent vendor conducts annual "white hat" penetration tests to validate its external security posture. For certain JFG businesses, JFG also conducts cyber incident tabletop exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by JFG's IT Risk team in collaboration with outside service providers as appropriate and members of JFG's senior management and Legal and Compliance teams. Learnings from these tabletop exercises and any events that JFG experiences are reviewed, discussed, and incorporated into its cybersecurity risk management processes as appropriate. In addition to JFG's internal exercises to test aspects of its cybersecurity program, JFG annually engages an independent third party to assess the risks associated with its information systems and information assets and the JFG risk management program. The independent third party assesses the cybersecurity program against the Cyber Risk Institute Cyber Profile, a financial sector-focused framework based on the NIST Cybersecurity Framework, the results of which are reported to the JFG Board of Directors (the "JFG Board") and inform JFG's program.

companyName: Senior Credit Investments, LLC


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Director Cyber Security under the oversight of the Chief Information Officer. With over 20 years in the field of IT and cybersecurity, the Director, Cybersecurity has significant professional experience including senior technical leadership roles along with consulting and management roles at public and private companies in the manufacturing, chemical and oil and gas sectors. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. He holds a masters in science degree from the University of Texas at Austin and professional certifications that include a CISSP and an active U.S. Government security clearance. Our Director Cyber Security oversees our cybersecurity governance programs and leads a team responsible for cybersecurity risk assessment, continuous monitoring for internal and external threats and vulnerabilities, remediation of known risks, and employee cybersecurity training.

companyName: Cornerstone Building Brands, Inc.


text: We also maintain an Enterprise Cyber Response Plan ("ECRP") for handling potential or actual cybersecurity events that could impact us and our personnel, data, systems and customers. The ECRP defines the roles and responsibilities of various teams, individuals, and stakeholders in performing this enterprise response, guides decision making for escalation and other actions, and helps to plan follow-on actions designed to reduce the likelihood of similar events' recurrence in the future.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business, strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see Part I, Item 1A of this Form 10-K under the risk factor entitled Risks Specific to Our Business.

companyName: I-ON Digital Corp.

ticker: IONI


text: Reviewing the Plan at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, though we and the third parties with whom we do business have experienced certain cybersecurity incidents, we are not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains and recognize cybersecurity measures have become more critical due to remote work, and we continuously evaluate improvements and new measures to protect our information and computing systems. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security or eliminate all risks associated with cyberattacks on us or third parties with whom we do business. No security measure is infallible. See Part I, Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Cybersecurity risk management under the Program is an integrated part of the Company's overall management of operational risk, as described further below under "Cybersecurity Risk Management Governance." The Company did not experience any material cybersecurity incidents during the period covered by this report. Nor did the Company identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, the Company recognizes that cybersecurity risks are constantly evolving, and the Company continuously monitors and adapts to these risks to protect its systems and data. It is possible that the Company will experience a material cybersecurity incident in the future. For more information on operational and cybersecurity risks, see "Item 1A. Risk Factors – Operational Risk" earlier in this report.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: Due to limited resources and personnel, we do not anticipate having in place on a going forward basis formal cybersecurity risk management programs or processes for assessing risk, which may make us susceptible to heightened cybersecurity risks. We also depend on third parties to provide certain software and related services, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to the corruption or misappropriation of our information. Because we expect to further rely on third parties, we will also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we will have no personnel or processes of our own for this purpose. Prior to the Chapter 11 Cases, the Audit Committee of our Board was responsible for the oversight of risks from cybersecurity threats. With few remaining Board members since the completion of the Asset Sale, the Board has assumed responsibility for overseeing risks from cybersecurity threats.

companyName: BOWFLEX INC.


text: For a description of the risks from cybersecurity threats that are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "A cyberattack could lead to a material disruption of our information technology ("IT") systems or the IT systems of our third-party providers and the loss of business information, which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs."

companyName: AIR LEASE CORP

ticker: AL


text: While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks. See "Item 1A –Risk Factors – Our business could be negatively affected by cybersecurity incidents and other technology disruptions" for more information about cybersecurity risk.

companyName: Weatherford International plc

ticker: WFRD


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties to perform assessments of our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Company's Cyber Security Committee, and when appropriate, the Audit Committee and the Board. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by the assessments, audits, and reviews.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: cybersecurity awareness training of our employees and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: The Company has a Cybersecurity Council, which is composed of representatives of the Company's senior management and exercises management-level oversight of cybersecurity matters. Our Chief Information Security Officer ("CISO") has primary responsibility for the development, operation, and maintenance of the Company's cybersecurity risk management program. The CISO holds multiple cybersecurity certifications and has approximately 15 years of cybersecurity experience with public retail companies.

companyName: Container Store Group, Inc.


text: Related to Cybersecurity Risks Our Vice President of Information Technology, or VP of IT, is responsible for the direction of our information technology organization. Our VP of IT has over twenty-five years of cybersecurity and incident management experience. Our VP of IT is supported by a third-party virtual chief information security officer, or vCISO, who also has over twenty-five years of cybersecurity experience. Our VP of IT, supported by our vCISO, assesses our cybersecurity risks through regular meetings with our IT team, and escalates cybersecurity matters as needed to management.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: Adient's cybersecurity strategy is enhanced by the integration of specialized third-party services. These providers offer critical support in pinpointing, evaluating, and managing cybersecurity risks. Adient's suite of external resources includes threat intelligence, risk reduction, surveillance of the dark web, external assessments, scoring services, monitoring of threats and reputation, forensic analysis, cyber insurance, consultative expertise, and legal advice.

companyName: Adient plc

ticker: ADNT


text: Security awareness and training We provide ongoing security awareness and training to educate internal users on how to identify and report potential issues. Professional-level employees receive mandatory cybersecurity education and training. Employee phishing tests are conducted on a regular basis. Employees who do not follow protocol are redirected for additional training. We also provide periodic updates to employees on emerging cybersecurity trends and ways to protect themselves and our company.

companyName: PENTAIR plc

ticker: PNR


text: We have an Information Security Team to strengthen our cybersecurity risk management activities across the Company, with its members having experience in public and private companies within the healthcare industry, as well as various cybersecurity certifications. The Information Security Team reports to our CISO who works in collaboration with our CIO, Chief Compliance Officer and General Counsel. The Information Security Team is responsible for the oversight and operation of our Program, and the management our security standards and operating procedures.

companyName: InnovAge Holding Corp.

ticker: INNV


text: Laura Criscione, Chief Compliance Officer - Ms. Criscione oversees the company's Compliance and Information Security. Ms. Criscione has overseen Compliance and IT Operations throughout her more than 30-year career in financial institutions.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Live Nation, an equity affiliate, as a separate publicly traded company from Liberty, operates its own cybersecurity function. Oversight for Live Nation's cybersecurity functions rests with its board of directors, of which our CEO is the Chairman, in collaboration with Live Nation's Global Data Governance Board and Audit Committee.

companyName: Liberty Media Corp

ticker: FWONA


text: CEO, in his capacity, regularly informs the Chief Financial Officer (CFO) and Board of Directors of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Clubhouse Media Group, Inc.


text: Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Product security vulnerabilities, system security risks, data protection breaches, cyber-attacks, improper use of artificial intelligence ("AI") tools, and other threats and risks, could disrupt or otherwise compromise our products, services, internal operations or information technology systems, or those of third parties with whom we work. Actual or perceived non-compliance with our privacy and security obligations could lead to regulatory investigations or actions, litigation, fines and penalties, business operation disruption, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse business consequences.".

companyName: NETGEAR, INC.

ticker: NTGR


text: We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Management Committee, the Audit Committee or the Board in a timely manner.

companyName: MCCORMICK & CO INC

ticker: MKC


text: The CIO is responsible for managing our information technology strategy. Our CIO has over 30 years of insurance and financial services operations and technology experience, including as chief information officer at large insurance companies; and received a Bachelor of Science in business management and a Master of Business Administration in management information systems.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: Our ERM program is led by our Chief Risk Officer, who reports to our Chief Executive Officer. Our Cyber program is led by our Chief Cybersecurity and Technology Risk Officer, who reports to our Chief Technology Officer. Our C&E program is led by our Chief Ethics and Compliance Officer, who also serves as our chief data protection officer and reports to our Chief Legal Officer. The collective relevant cybersecurity experience and expertise of the persons holding the positions of Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer, and Chief Ethics and Compliance Officer is over 75 years, and includes multiple information security and privacy professional certifications, and various pan-industry leadership roles related to cybersecurity and data risks.

companyName: Dun & Bradstreet Holdings, Inc.


text: Our Privacy team, which is part of the Company's compliance function, has a dedicated incident response team responsible for assessing, identifying and managing risks from cybersecurity threats involving personal information. The team follows documented processes for investigation, research, assessment, notification, regulatory reporting and, if necessary, escalation to management, and such processes have been integrated into our Information Security incident response program. The Information Security team works closely with our Privacy team to respond to any cybersecurity incidents involving personal information. The Privacy team engages third parties to assist with incident assessment and notification.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, providing oversight of cybersecurity risks at the highest levels of our organization. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Data Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Data Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Our Chief Technology & Data Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Data Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Data Protection Culture Chubb actively promotes a data protection culture. We maintain policies and standards designed to protect personal and corporate information. The policies and standards are developed by a multi-disciplinary team, with participation from information security and IT compliance, privacy, IT legal, compliance and business representatives.

companyName: Chubb Ltd

ticker: CB


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee directly oversees our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: We recognize the critical importance of maintaining the trust and confidence of our guests, franchisees and employees. Consequently, our cybersecurity policies, standards, processes and practices are embedded within our overall enterprise risk management ("ERM") program.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our enterprise risk management process is overseen by our Chief Legal Officer and Chief Financial Officer. In collecting information on enterprise risk, cyber security is specifically included as a risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: Peapack-Gladstone Bank's Chief Information Officer, Chief Technology Officer, and Information Security Officer are accountable for managing and ensuring compliance with the Bank's information security program. Included in the responsibilities of this management team is the oversight and the administration of the cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our management team, which includes the SVP Enterprise Technology & Security, Chief Operating Officer (COO), Chief Financial Officer (CFO), and General Counsel, collectively assesses and manages material cybersecurity threats. This team oversees the organization's cybersecurity risk management program and works closely with the SVP Enterprise Technology and Security, who oversees both enterprise IT and Security functions, ensuring alignment of technology and security strategies. With over 30 years of experience, the SVP Enterprise Technology and Security has served as Chief Information Officer and Vice President of IT for leading companies across Consumer Products, Energy and Media sectors on a global scale, with a strong focus in IT and operational technology security governance, compliance, and operations.

companyName: Beachbody Company, Inc.

ticker: BODI


text: Board of Directors (the "Board") is regularly updated regarding the current state of InfoSec, its future roadmap, and any significant or material cybersecurity incidents.

companyName: Rumble Inc.

ticker: RUM


text: Pathward has robust cybersecurity measures in place. Pathward is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Pathward, including its business strategy, results of operations or financial condition, during the fiscal year ended September 30, 2025. Yet, in this modern, evolving world cybersecurity remains a high risk regardless. For further information about the cybersecurity risks Pathward faces, and potential impacts, see Item 1A. "Risk Factors".

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to Morgan Stanley or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity programs to identify the impact of their services on the cybersecurity risks to Morgan Stanley or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or an audit by Morgan Stanley of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.

companyName: North Haven Net REIT


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers, and our dealers are the target of cybersecurity incidents, and such threats are continuing and evolving, which may cause cybersecurity incidents to be more difficult to detect for periods of time. Our networks and Ford's in-vehicle systems, sharing similar architectures, could also be impacted by, or a cybersecurity incident may result from, the negligence or misconduct of insiders or third parties who have access to these networks and systems. A cybersecurity incident could harm our reputation, cause customers to lose trust in our security measures, and/or subject us to regulatory actions or litigation, which may result in fines, penalties, judgments, or injunctions, and a cybersecurity incident involving us or one of our suppliers could impact our business strategy, results of operations, financial condition, or our reputation. For additional information, see "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford and Ford Credit as well as their suppliers and dealers" on page 15.

companyName: FORD MOTOR CREDIT CO LLC


text: Our board of directors oversees the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: PagerDuty, Inc.

ticker: PD


text: CarMax's cybersecurity team manages the company's Incident Response Plan, which establishes a comprehensive system and process for tracking and logging cybersecurity occurrences, reviewing the occurrences to determine whether remediation or escalation is appropriate and escalating certain occurrences to the company's Chief Information Security Officer (the "CISO") for further review and assessment. CarMax has an established review and escalation process for assessing cybersecurity occurrences and, if necessary, escalating cybersecurity incidents to members of our senior management team.

companyName: CARMAX INC

ticker: KMX


text: We provide regular, mandatory training for our employees regarding cybersecurity threats and our security policies to equip our employees with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: PROS Holdings, Inc.


text: Risk Management Framework Our security program is risk-driven and integrated into our overall enterprise risk management process. We emphasize risk detection, which serves as the foundation for risk management-related business decisions. Our ISMS provides the structure for our overall security program and serves to assess, manage, monitor, and minimize our cybersecurity risks. The program includes: • Context of the organization • Leadership • Planning • Support • Operation • Performance evaluation • Improvement

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: As of the date of this Annual Report, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. management and strategy.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: In alignment with industry standards, such as the National Institute of Standards of Technology (NIST) Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risks through a layered approach throughout our environment and in our service provider arrangements, including software-as-a-service and infrastructure-as-a-service engagements. We look to continuously improve our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk management program, which works in tandem with the Bank's Enterprise Risk Management program, includes risk management practices, procedures, and technology solutions aimed at addressing potential cybersecurity threats faced by the Bank in alignment with the Bank's strategic plans, risks tolerance, and enterprise operational risk policy. Cybersecurity risk-mitigation processes include, but are not limited to, performing regular risk assessments to identify, understand and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, real-time network monitoring; on-going employee training to educate employees on how to identify and avoid various forms of social engineering; performing routine threat monitoring (including use of a third party service provider monitoring) and controls testing; and maintaining a vulnerability management program to timely identify and remediate cybersecurity risks. The Bank also maintains a Cyber Security Incident Response Plan (CSIRP) to determine how cybersecurity threats and incidents are identified, classified, escalated, mitigated and remedied. The CSIRP is implemented and maintained by the Bank's threat and incident response team and overseen by our Chief Information Security Officer (CISO). Additionally, the Bank maintains a business resiliency management program to mitigate and respond to critical disruptive events (such as fire, cybersecurity incidents, and power loss). Our business resiliency management program (as further discussed below) includes, but is not limited to, testing our disaster recovery plans and reviewing department level business continuity procedures.

companyName: Federal Home Loan Bank of Chicago


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, including legal counsel; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and forensic investigators.

companyName: Fastly, Inc.

ticker: FSLY


text: As part of our IT security program, our Cybersecurity Executive Committee and Information Security Steering Committee meet throughout the year to monitor and assess information security risks. In addition, we perform an enterprise risk assessment that is reviewed by the Committee and our Board of Directors on an annual basis and monitored on a quarterly basis by the Committee. The enterprise risk assessment is an assessment of key risks, including information security risks, data privacy, supply chain, human capital, and other risks.

companyName: Arista Networks, Inc.

ticker: ANET


text: Our cybersecurity risk management measures include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management. In addition to our internal resources, our cybersecurity risk management leverages external service providers who we work with to identify and oversee cybersecurity risks. For example, during 2024, we engaged an independent third-party assessor to assist management in identifying cybersecurity risks and developing ongoing procedures to enhance our cybersecurity risk management measures. In addition, we use our external providers to assist with endpoint monitoring, alerts, and other security management protocols such as regular backups and encryption.

companyName: Smith Douglas Homes Corp.

ticker: SDHC


text: Our Chief Information Officer (the "CIO") is primarily responsible for this cybersecurity component, reporting directly to the Chief Executive Officer, who periodically reports to our Board of Directors. To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents.

companyName: Velocity Financial, Inc.

ticker: VEL


text: Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a material cyber threat or incident in the future. For more information regarding the cybersecurity risks we face, see Item 1A. Risk Factors in this Annual Report.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Our Audit Committee, which is responsible for oversight of cybersecurity risks, periodically reviews and discusses with management, including the Chief Information Officer, risk issues associated with cybersecurity and policies and controls intended to mitigate those risks.

companyName: FLUOR CORP

ticker: FLR


text: As a large company in the financial services industry, we do business with a large number of clients, counterparties, and third-party service providers, and the nature of Schwab's business involves the secure processing, storage, and transmission of confidential information about our clients and us. We process, record, and monitor a high volume of transactions, and our operations are highly dependent on the integrity of our technology systems. As a result, we face extensive cybersecurity risks. It is through a combination of specialized internal and external teams, coupled with security software tools, that Schwab identifies, assesses, and manages material cybersecurity risk, and implements and enhances over time our cybersecurity policies, procedures, and strategies to reduce risk. We also maintain processes and procedures for identifying and investigating cybersecurity threats and remediation should an incident occur. Despite our efforts to protect our systems and data, there can be no assurance that we are able to maintain effective preventive measures against all cybersecurity risks, especially because attacks can originate from a wide variety of sources, and the techniques used change frequently and may not be immediately recognizable. Though the impact of prior cybersecurity events experienced by the Company has not been material to the Company's strategy, results of operations, or financial condition, we continue to face increasing cybersecurity risks.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: Our Board of Directors (our "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee primary responsibility for overseeing our cybersecurity risk management program and engaging with management on cybersecurity and other risks related to our information technology controls and security. Our Information Security Officer ("ISO") reports directly to our Chief Information Officer ("CIO"), a member of our Company Leadership Team and direct report of our Chief Executive Officer ("CEO"). The CIO and ISO together provide updates and discuss our cybersecurity preparedness with the Audit Committee at least semiannually, which its Chair then reports on to our full Board. Management updates the Audit Committee, if and as needed, regarding any significant cybersecurity events, as well as events that may have had lesser potential impact.

companyName: Avery Dennison Corp

ticker: AVY