text: In addition, we maintain policies over areas such as protecting and handling confidential information, processing of personal data, access on/off boarding, user management, acceptable use, and IT change control management to help govern the processes put in place by management designed to protect our IT assets, data and services from threats and vulnerabilities. We employ additional key practices within the cyber risk management program including, but not limited to maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access to privileged accounts, and physical security measures at our facilities. We also utilize information protection/detection systems, or IPS/IDS, including maintenance of firewalls and anti-malware tools, network and data traffic monitoring with automated alerting, ongoing cybersecurity user awareness training, industry-standard encryption protocols, formalized change management processes and critical data backups to reduce cybersecurity risk.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We utilize various methods to assess and manage risks associated with third-party service providers, which may be reevaluated periodically, such as upon detection of an increase in a third-party's risk volume and variability. Further, our Code of Vendor Conduct & Ethics sets forth our expectations for third-party vendors related to data privacy and protection.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP

secItem: Item 1C


text: Luxfer's IT Steering Committee continues to carry out internal phishing simulations to engage employees with cybersecurity, raise awareness, and educate employees on how to recognize and report phishing attacks. Through the simulations, we are able to test our employees' reaction to phishing emails and collect important metrics such as click rate. Data collection allows us to pinpoint trouble spots and target additional trainings to specific teams or locations. This information is also reported once quarterly to Luxfer's Senior Leadership Team and is an important supplement to our overall IT security training program.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also require annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: PepGen Inc.

ticker: PEPG


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management members, including Mr. Henry He Li, our chief technology officer, Chris Williams (SecurePoint 360), our virtual chief information security officer, and Mr. David Rice, our global IT manager.

companyName: Moatable, Inc.

ticker: MTBLY


text: As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer, is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our Chief Execuctive Officer, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.

companyName: CORVEL CORP

ticker: CRVL


text: Our Company maintains a comprehensive information technology security program based on the National Institute of Standards (NIST) Cyber Security Framework. The information technology security program aims to protect our Company from cybersecurity threats and ensure the confidentiality, integrity and availability of our data and systems. To provide such protection, our program implements a significant number of controls, including but not limited to physical and digital access controls, data protection controls, system development controls, acceptable use controls and monitoring controls. We deploy technical and administrative safeguards, such as firewalls, intrusion prevention and detection systems, anti-malware functionality and security awareness and phishing prevention training programs, which are regularly evaluated and improved. Further, in the event of a cybersecurity incident, our Company has a Cybersecurity Incident Response Team (the "CSIRT"), consisting of stakeholders from across the Company, to respond appropriately. The CSIRT provides a proactive approach to managing cybersecurity incidents and ensures incidents are controlled as quickly as possible to avoid and minimize the damage to systems, limit impact to client information, protect the Company's reputation and integrity and prevent future incidents. The Company also has a data incident response plan in place that outlines expected actions in the event of a data security incident. The Company prioritizes protecting and informing customers, clients and employees in the event of a data security incident, as is appropriate.

companyName: Finance of America Companies Inc.

ticker: FOA


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. The Audit Committee members receive presentations on cybersecurity topics from our Director of Information Technology, or external experts as part of the Audit Committee's continuing education on topics that impact public companies.

companyName: CG Oncology, Inc.

ticker: CGON


text: Our Chief Privacy Officer and Data Protection Officers oversee our focus on the proper processing of personal information in alignment with our privacy policy and applicable privacy laws and regulations.

companyName: CARNIVAL PLC

ticker: CUK


text: Our management team, including our Chief Operating Officer, Chief Financial Officer, Chief Compliance Officer, Chief Technology Officer and Head of Risk Management, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer, Scott Cardenas, is responsible for all aspects of technology across the Company and has extensive experience in cybersecurity and technology, including 15 years of experience managing technology organizations. Before joining the Company in 2018, Mr. Cardenas was chief technology officer for Kiewit Corporation and chief technology officer for the City and County of Denver before being promoted to chief information officer. Mr. Cardenas received a B.S. in Computer Information Systems and Management from Metropolitan State University of Denver and a M.B.A. from the University of Denver. As Chief Technology Officer, Mr. Cardenas is a member of the Company's Risk Management Committee, a cross-functional committee that governs and oversees our cybersecurity risk management program, among other responsibilities and includes the Chief Operating Officer, Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Technology Officer, and Head of Risk Management and Director of Internal Audit.

companyName: Bridge Investment Group Holdings Inc.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and our proprietary, strategic or competitive data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We have an incident response process that relies on a multidisciplinary team for assessing and managing cybersecurity incidents, including an escalation framework based on the materiality of incidents. The multidisciplinary team includes members of our IT security function, executive management of our legal, finance, human resources, corporate communications and internal audit/risk functions and third party service providers of technical, legal and insurance services, as well as coordination with law enforcement as appropriate. Our IT security function also addresses cybersecurity threats through regular vulnerability reviews, risk registry reviews and global team meetings.

companyName: Gentherm Inc

ticker: THRM


text: Our Vice President of Security and Compliance, who has cybersecurity knowledge and skills gained from work experience at the Company, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The cybersecurity team receives reports on cybersecurity threats from a number of experienced information security team members responsible for various parts of the business periodically and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: Leslie's, Inc.

ticker: LESL


text: The Bank's Network Team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Network Team also actively monitors the Bank's networks and systems to detect suspicious or malicious events, and contracts with third-party consultants to perform penetration testing and routine vulnerability scans. A third-party managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.

companyName: Primis Financial Corp.

ticker: FRST


text: Governance of Cybersecurity Risk Management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The board of directors has delegated to the audit committee the responsibility of reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, regularly reports on its review with the board of directors.

companyName: Adeia Inc.

ticker: ADEA


text: We have allocated substantial cross functional internal resources with expertise in information security, information technology, operations, risk management, human resources, finance, and legal to form a governance counsel known as the ISG. The ISG is an internal working group that collaborates with the Director of Information Security to ensure our cybersecurity program is adequately responsive to the evolving threat landscape. Our Director of Information Security has twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: MGIC Investment Corporation and Subsidiaries The Company's current CISO, Jennifer Westphal, is responsible for assessing and managing the material risks posed by cybersecurity threats. Ms. Westphal has over 25 years of experience in information technology, with 18 of those years focused on cybersecurity. Ms. Westphal has been with the Company for more than ten years and was promoted to the position of CISO in January 2021. Prior to 2021, Ms. Westphal served as the Deputy CISO and before that, as the Director of Information Risk Management.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (such as outside legal counsel), penetration testing firms, threat intelligence service providers, dark web monitoring services, forensic investigators, cybersecurity software providers, managed cybersecurity service providers, and cybersecurity consultants.

companyName: Definitive Healthcare Corp.

ticker: DH


text: Management Responsibilities Our cybersecurity program is managed by our Information Security Officer (ISO). Our ISO has over five years of cybersecurity experience working in publicly traded companies, with expertise leading risk remediation efforts in vulnerability management, network security, security awareness, threat monitoring, data security and cloud security.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;

companyName: Fold Holdings, Inc.

ticker: FLD


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a)

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: The Cyber Program is organized under our Chief Information Security Officer. The current Chief Information Security Officer has extensive information technology and program management experience and has served for over a decade in our corporate information security organization. He has a Masters in cybersecurity from Valparaiso University. Additionally, he has both Certified Information Systems Security Professional-Information Systems Security Management Professional ("CISSP-ISSMP") and Certified Information Systems Auditor ("CISA") certifications, and is also a recognized Information Technology Infrastructure Library ("ITIL") expert. The Chief Information Security Officer reports to the Executive Vice President, General Counsel & Secretary with oversight by the Board of Directors. Over the course of the last decade, our management team has gained extensive experience investing in, providing oversight of, and setting the strategy for our cybersecurity program. Prior to joining DRS, our Chief Executive Officer oversaw the development of the DoD cybersecurity strategy while serving as Deputy Secretary of Defense from 2009 to 2011.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Threats from Third Party Service Providers Our processes also address cybersecurity threat risks associated with our use of third-party software and system providers. Third-party risks are included within our enterprise risk management assessment program, which is discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on high-risk third-parties that provide us software or have access to our systems or highly sensitive information, and monitor cybersecurity threat risks identified through such diligence. New software is evaluated for risk and approved by our internal Software Approval Board before purchase or installation on our systems.

companyName: GLAUKOS Corp

ticker: GKOS


text: CEL-SCI's management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over its third-party IT consultant, monitoring systems and employee engagement. The management team is responsible for reporting any cybersecurity risks identified by CEL-SCI's third-party IT consultant to its board of directors.

companyName: CEL SCI CORP

ticker: CVM


text: Management's Responsibilities. Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. Accordingly, management assesses and responds to cybersecurity threats as part of our ongoing risk assessment and as an internal control over financial reporting. Our Security Ops Team directs our cybersecurity operations and risk responses. Members of the SecOps Team then meet with the InfoSec Committee at least once every quarter to review and assess cybersecurity incidents and non-incident threats (and response measures undertaken) to determine if any adjustment to our cybersecurity risk assessment is required. At least once every year, members of the Security Ops Team and the Vice President of Information Technology present our cybersecurity risk evaluation and threat response to the Ethics Committee and to the Risk Committee of the Board of Directors as needed. The InfoSec Committee is a subcommittee comprised of IT department leaders and members of the senior management team, including the Chief Executive Officer, Chief Financial Officer (who has oversight of our IT and cybersecurity activities), General Counsel (who has oversight of our compliance activities), and Vice President of Information Technology (who has 20 years of experience managing IT systems and personnel). The Security Ops Team reports to the Vice President of Information Technology, as well as the broader InfoSec Committee. Members of the Security Ops team include IT professionals with extensive experience and education in technology and cybersecurity, and most have attained accreditation as Certified Information Systems Security Professionals, as granted by the International Information System Security Certification Consortium (also known as ISC2).

companyName: EXELIXIS, INC.

ticker: EXEL


text: Our CISO, who reports to the Chief Operations Officer, has primary responsibility for Jack Henry's information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response. Our CISO brings more than 20 years experience in technology and cybersecurity, including senior leadership roles at major financial institutions. Under the CISO's direction, the information security team continuously monitors cybersecurity trends and implements proactive and defensive measures to protect against cybersecurity threats.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Cyber Risk Management and Strategy LivaNova's enterprise risk management process consists of risk identification, evaluation, control and monitoring, and documentation. The LivaNova Board oversees risk management within the Company, and the legal and compliance teams work in tandem to provide the framework to identify and reduce risks that may materially impact the Company's business. As part of the enterprise risk management process, regular inquiries and discussions are held with, among others, the CISO, Chief Information Officer, Chief Privacy Officer, and their respective teams to review the cybersecurity risk landscape.

companyName: LivaNova PLC

ticker: LIVN


text: Depending on the products and services provided and the potential for data exchange and technology risk, we may require vendors and service providers to pass APS's vendor risk management program, which sets forth security and data protection requirements, as a condition to doing or continuing to do business with us. For contracts with vendors that will handle or have access to certain sensitive data, APS requires contractual provisions setting forth cybersecurity controls, vulnerability management, secure development practices, and other security and data protection requirements. A subset of vendors that meet a predetermined risk profile due to strategic relationships, technology risk, or other factors is continually monitored by a third-party risk management service, and the Company annually reviews independent assessments of these vendors.

companyName: ARIZONA PUBLIC SERVICE CO


text: We assess the cyber risk of potential third-party service vendors, partners, and other service providers. We evaluate third parties before onboarding and periodically afterwards or if we detect a significant change in their cyber risk rating. We also perform security assessments on third-party code libraries before internal use. We categorize third parties in tiers based on the services that they provide to our company, the information and data that they have access to, and our overall assessment of the significance and risk of their operations to Dynatrace. We focus more detailed reviews and more frequent assessments on third parties that are in our highest tier.

companyName: Dynatrace, Inc.

ticker: DT


text: The Chief Information Officer manages both an Information Security team and an IT Risk team within the Department of Information Technology. The IT Risk team works closely with our Data Privacy Officer for governance and compliance related to regulations and frameworks for data classification, data privacy, handling of private data and controlled unclassified information, and internal policies and procedures. The Cyber Security team is responsible for identifying and implementing technologies to mitigate IT risk, enhance data security, and identify and defend against attacks. Both teams work closely together to establish the cybersecurity policies for the Company, evaluate the current risk profile, and to prevent, investigate, mitigate, and remediate any cyber-attacks on the Company.

companyName: Mistras Group, Inc.

ticker: MG


text: Other members of the CCDC include top executives and management from the Company and its subsidiaries, including A-Mark's General Counsel, President, Chief Financial Officer, Chief Operating Officer, Senior Director of Financial Reporting, Director of Internal Audit, and Director of Enterprise Development and Administration, as well as JM Bullion's President and Chief Executive Officer and its Chief Financial Officer. Finally, the CCDC is assisted by an external compliance consultant with over twenty years of IT experience, and A-Mark's outside legal counsel for privacy and data security.

companyName: Gold.com, Inc.

ticker: GOLD


text: We have internal guidelines governing our identification, assessment, communication, and escalation upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to the chair of the audit committee, among others as needed, to manage our response.

companyName: Fabrinet

ticker: FN


text: The company has implemented an Incident Response Plan to provide a structured incident response process for information security incidents that affect any of the information technology systems, network, or data of the company. The Incident Response Plan is implemented and maintained by the COO.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as the result of past cybersecurity incidents, have had, or are reasonably likely to have, a material effect on our business strategy, results of operations, or financial condition. While we strive to employ safeguards, no system can guarantee absolute security and we cannot guarantee that any future risk from cybersecurity, including any future cybersecurity incidents, will not be material to our business strategy, results of operations or financial condition.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: During the period covered by this Annual Report, we have not experienced any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, institutions like us, as well as our employees, artists, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks.

companyName: Warner Music Group Corp.

ticker: WMG


text: In addition, we collaborate with third-party advisory firms to periodically review and evaluate our security measures, which informs our ongoing strategy and execution of our cybersecurity program. We also leverage third-party providers to augment our internal security resources, including to support our ongoing monitoring and threat detection capabilities. We have a process to evaluate certain critical third-party providers before engagement as well as periodically thereafter, which may include a review of available audit reports, security documentation, operating controls, and industry reputation, as well as contractual requirements, as appropriate.

companyName: RAPID MICRO BIOSYSTEMS, INC.

ticker: RPID


text: The Company's policies and procedures described above are designed to ensure that the Company's vice president of cybersecurity and chief information officer and other necessary members of any cybersecurity response team are appropriately informed of any cybersecurity matters and the status of our ongoing processes. The Company's vice president of cybersecurity and chief information officer jointly provide periodic reports to the Subcommittee, the Company's CEO and CFO, and other members of management. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The Company's program is regularly evaluated internally and externally and updates are presented to senior management and the Subcommittee. The Company also actively engages with key vendors, industry participants, and knowledge leaders as part of the Company's continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.

companyName: BELDEN INC.

ticker: BDC


text: Our Chief Information Officer and the Director of IT Security & Risk Management, in coordination with the ISGC, work collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Officer, the Director of IT Security & Risk Management, and the ISGC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and the Chief Information Officer reports such incidents to the Audit Committee when appropriate.

companyName: U.S. SILICA HOLDINGS, INC.


text: We have a dedicated Information Security team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including teams within information technology ("IT"), Legal and Privacy, in identifying, analyzing and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements. Where necessary or appropriate, we also engage third-party advisors to assist in the incident response process.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: In 2024, the Board of Directors assumed direct oversight of our cybersecurity program and management of the associated risks. The Board periodically receives presentations and reports on cybersecurity risks on a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board also receives reports regarding cybersecurity incidents that meet established reporting thresholds through the process described above, as well as updates regarding any such incident.

companyName: HERC HOLDINGS INC

ticker: HRI


text: We obtain cybersecurity threat intelligence information from law enforcement reports and our cybersecurity operations providers and communicate this information to relevant stakeholders within the organization. We employ third-party cybersecurity operations providers to monitor cybersecurity events and provide rapid responses to any critical events. In addition, we employ contractual provisions to require our third-party information service providers to implement and maintain appropriate security measures over the information we entrust to them. Because of the relatively small size of our information technology workforce, we have limited internal cybersecurity expertise and monitoring capabilities; accordingly, we seek to augment our internal capabilities by engaging larger, well-known third-party service providers with significantly greater cybersecurity capabilities than we possess. Because we rely on their greater expertise, our ability to identify and remediate weaknesses or vulnerabilities in the services they provide is necessarily limited. We have not engaged third parties to assess our cybersecurity defenses or to audit our cybersecurity program, nor have we conducted direct or indirect technical evaluations of the information systems that our third-party service providers use.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Our Vice President of Information Technology and our Director of Technical Infrastructure, in coordination with management, work to implement our program to protect the Company's information systems from cybersecurity threats. These individuals work to promptly evaluate and address any cybersecurity incidents, and work with management to assess the impact and any necessary remediation efforts following a cybersecurity incident. In addition, the Vice President of Information Technology provides updates to the Audit Committee and the Board on a regular basis and as needed in response to specific incidents. To facilitate the success of our cybersecurity risk management program, we have assigned our Director of Technical Infrastructure and his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management.

companyName: CULP INC

ticker: CULP


text: We are committed to protecting the confidentiality, integrity, and availability of our systems and information. Our security program is intended to assess, identify, and manage risks from cybersecurity threats, and is aligned with the National Institute of Standards and Technology Version 2.0 Cybersecurity Framework ("NIST CSF"). The NIST CSF provides a flexible model for identifying and managing cybersecurity risks. Our security infrastructure uses a layered controls approach, incorporating various capabilities guided by the NIST CSF and other industry standards and best practices. We routinely invest in our security processes and capabilities, including those related to our risk management and assessment programs, vulnerability and intrusion detection, incident response plans, and other advanced detection, prevention, and protection capabilities.

companyName: PAYCHEX INC

ticker: PAYX


text: Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of our company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for our cybersecurity program and is a key member of the risk management function, reporting directly to the Chief Risk Officer ("CRO") and to the Enterprise Risk Committee of our Board of Directors.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: The level of each identified risk is determined by the Company' Chief Financial Officer, considering the impact of the risk itself and the likelihood of the risk materializing.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: We organize roles and responsibilities for risk management into a three-LOD model. Our Information Security Program is a first LOD function and has responsibility for the primary management of the risks that emanate from first LOD activities. Each first LOD unit owns, identifies, measures, controls, monitors, and reports risks originated through its activities. The second LOD which reports to the Chief Risk Officer, independently monitors risk exposures, implements comprehensive and appropriate risk controls, and reviews and challenges first LOD units on their activities to ensure that risk is managed in line with agreed frameworks and risk appetite levels. The third LOD provides independent assurance to the Company's Board of Directors and senior management by assessing the quality and effectiveness of the processes and systems of internal control, risk management and risk governance, compliance with applicable regulations, and the reliability and integrity of financial and operational information. The third LOD reports to the Chief Audit Executive and to the Board of Directors, independent of any other function or unit in the Company.

companyName: Santander Holdings USA, Inc.


text: For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Development and Commercialization of Our Current and Future Product Candidates" and other risks described in the "Risk Factors" section of this Annual Report on Form 10-K.

companyName: Genprex, Inc.

ticker: GNPX


text: Our management team, in conjunction with our third-party IT and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team, in conjunction with our strategic third-party partners, oversees our cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged for strategic cyber risk management, advisory and decision making.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: The Audit Committee and the Technology and Cybersecurity Committee are responsible for oversight relating to cybersecurity. The Board, the Audit Committee, and the Technology and Cybersecurity Committee regularly receive presentations and reports on cybersecurity risks from the CISO, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and cybersecurity considerations arising with respect to our peers and vendors. Our incident response process includes escalation of potentially material cybersecurity incidents to relevant members of our executive management team. The Board, the Audit Committee, and the Technology and Cybersecurity Committee are updated as appropriate. Periodically, the Audit Committee discusses our approach to cybersecurity risk management with our CISO. Our Technology and Cybersecurity Committee receives regular reports from our CISO as part of its assessment of our cybersecurity threat landscape, and the quality and effectiveness of our information security programs.

companyName: BLACKLINE, INC.

ticker: BL


text: The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks. For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective of improving decision-making and prioritization and promoting monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: Response Planning: We intend to maintain a breach reporting and resolution plan that includes defined processes, roles, communications, responsibilities and procedures for responding to cybersecurity incidents and other events that impact our operations. Our incident response plans will be tested and evaluated on a regular basis.

companyName: Trio Petroleum Corp

ticker: TPET


text: The AFC, comprised entirely of independent directors, assists the Board in its responsibilities of ensuring that the Company has established, documented and maintained, and periodically reevaluates, its processes with respect to cybersecurity. Our CISO briefs the AFC on cybersecurity matters, including on the evolving threat landscape and the Company's enhanced efforts in light of emerging risks, no less than twice per year, and in 2024, our CISO provided cybersecurity updates to the AFC two times during the course of the year. In addition to formal updates provided to the AFC, our CISO maintains regular communication throughout the year with members of the AFC on these issues. The chair of the AFC also briefs the full Board on cybersecurity matters discussed amongst the AFC. Furthermore, and as discussed above, cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of the annual ERM assessment.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the section titled "Risks related to privacy, information technology and cybersecurity" located in Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: NeuroPace Inc

ticker: NPCE


text: We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting providers, supply chain resources and data back-up service providers. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process involves different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Components of the vendor risk management program include, for example, conducting risk assessments for certain vendors, reviewing certain vendors' written security programs, reviewing security assessments and responses to security questionnaires, auditing of certain vendors, vulnerability scans related to vendors, and the imposition of certain contractual information security obligations for certain vendors.

companyName: Lionsgate Studios Corp.

ticker: LION


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has over a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.

companyName: Tradeweb Markets Inc.

ticker: TW


text: While management is responsible for the day-to-day management of cybersecurity policies and procedures, our audit committee is tasked with oversight of our risk management process, which includes risks from cybersecurity threats. The processes by which our audit committee is informed about and monitors the Company's strategy regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following:

companyName: Arq, Inc.

ticker: ARQ


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers. We manage cybersecurity risks associated with our use of these providers using measures including risk assessments, reviewing their security assessments, reviewing their written security program, audits, and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Turnstone Biologics Corp.


text: We rely on our technology infrastructure and information systems to operate our gaming and non-gaming facilities, interact with customers, employees, utilize our data, support and grow our customer base, and bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: Each business unit's Chief Information Security Officer ("CISO") on at least an annual basis is to provide a report to the Company's senior management, regarding the state of their cybersecurity program and its material cyber risks. These reports are then shared with the Company's cybersecurity oversight committee to inform and augment the Company's risk management processes.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Furthermore, our information security function works with a security committee (the "Security Committee") to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business and evaluate material risks from cybersecurity threats against our overall business objectives. We use third-party service providers to perform a variety of functions throughout our business, such as CROs and contract manufacturing organizations ("CMOs"). Under our information security function, we perform risk and security assessments for certain of our vendors that involves a review of the vendor's written security program. Depending on the nature of the services provided, and the sensitivity of the Information Systems and Data at issue, and the identity or experience of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Risk is assessed based on multiple factors and is overseen by the Audit Committee. Our IT and cybersecurity teams update and maintain our digital asset inventory to ensure all digital assets are included in our risk management process. The same is also true for all physical records/files as well as physical assets that would be considered intellectual property. Key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the Audit Committee and stakeholders to create action plans or exception requests for the acceptance of risk.

companyName: USBC, Inc.

ticker: USBC


text: Our executive management is responsible for the oversight of risks from cybersecurity threats. Members of our board of directors receive periodic updates from our executive management team regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Any urgent cybersecurity threats are immediately flagged and reported to the board of directors.

companyName: Journey Medical Corp

ticker: DERM


text: The Virtual Information Security Officer (vISO) has an over 18-year career in Information Technology, Cybersecurity and both Internal/External Audit experience. He presently holds a position of Partner of Herbein, COA Advisor & Audit, where he's held multiple positions within Information Technology and Cybersecurity.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: 6. Risk Monitoring and Review - Continuously performed to evaluate any changes or the need for changes. The Company uses the Ontrack software solution ("Ontrack") to monitor and track all aspects of risk assessment. Ontrack also serves as tool to track any cybersecurity incidents and remediation tasks.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: We design and assess our program based on applicable laws and regulations, and informed by industry standards and industry-recognized practices including but not limited to following the latest NIST and CISA guidance and SOC 2 Principles and Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such laws and regulations and industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Expensify, Inc.

ticker: EXFY


text: To identify and assess risks from cybersecurity threats, we will evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We will regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments will be evaluated by management and reported to our board of directors, and we will continue to adjust our cybersecurity policies, standards, processes, and practices as necessary.

companyName: BLACKSTAR ENTERPRISE GROUP, INC.


text: From an external assessment and monitoring perspective, Littelfuse engages third parties to monitor and report on known exploitable vulnerabilities, within and external to Littelfuse's information technology (IT) ecosystems. These third parties provide assessment and vulnerability scanning tools to detect exploitable unauthorized access into the Littelfuse environments.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: The Company's processes to assess, identify and manage material risks from cybersecurity threats include, but are not limited to, the following:

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: The Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives reports on the Company's technology and cybersecurity functions, including vulnerability assessments, any third-party and independent reviews, the threat environment, and other information security considerations. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. The cyber security Steering Committee meets multiple times throughout the year to discuss the Company's cyber security programs and practices, risk management related to cyber security and a wide range of other related topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. At least once each year, the Board and the Company's executive leadership team discuss the Company's approach to cybersecurity risk management with the Company's VP of Information Technology.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: As part of our overall risk management system, we monitor and test our safeguards and train relevant personnel on these safeguards. These efforts are led by our Information Security group. All personnel are expected to engage in security awareness training. We engage third parties to perform security assessments to test our safeguards and, when appropriate, implement modifications to or add new safeguards based on the results of such assessments.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: We have also implemented an IT Security Incident Response Policy. Incident response preparation comprises of how to respond to incidents and how to protect against and detect computer-related incidents. The process of providing incident response is identified by four distinct phases: (i) preparation; (ii) detection and analysis;

companyName: Cycurion, Inc.

ticker: CYCU


text: Nordson Corporation 18 The Senior Director of Security and Compliance assesses cybersecurity readiness using a variety of tools, including internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. Our security and compliance organization elevates issues relating to cybersecurity to our Chief Executive Officer and Board of Directors, such as potential threats or vulnerabilities. We also seek to prevent, detect, mitigate and remediate cybersecurity incidents by employing various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.

companyName: NORDSON CORP

ticker: NDSN


text: Although we have experienced and will continue to experience cybersecurity incidents of varying degrees, to date, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the measures the company takes to mitigate cybersecurity risks, there can be no assurance that such measures will be sufficient to protect the company's systems, information, intellectual property,and other assets from significant harm and, therefore, the scope and impact of any future cybersecurity incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.

companyName: Bunge Global SA

ticker: BG


text: Cybersecurity risk management is an integral part of the Company's enterprise risk management framework and is overseen at both the Board and management levels.

companyName: Perfect Moment Ltd.

ticker: PMNT


text: Our cybersecurity leadership team is made up of highly experienced professionals with an extensive background in information security, risk management, and incident response. This background includes more than 50 years of collective experience in infrastructure, cybersecurity and telecommunications. In addition to having the requisite training, knowledge, skills and abilities required for their respective positions, the cybersecurity leadership team collectively holds various relevant U.S. and Canadian information security certifications. The cybersecurity leadership team is supported by a dedicated team of skilled cybersecurity professionals, each bringing diverse expertise in areas such as network security, data protection, and threat intelligence.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: Our SIO, who reports to our Chief Operating Officer, has primary oversight of the material risks from cybersecurity and data privacy matters. Our SIO has more than 20 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the employee and customer-facing aspects of our business.

companyName: Investview, Inc.

ticker: INVU


text: The Audit Committee meets periodically, and receives regular reports from our Head of Information Technology and, as appropriate, other members of the Information Security Team concerning any significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation, generally. The Head of Information Technology also provides regular reports to the Board of Directors of significant matters related to the Audit Committee's responsibilities.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: email security systems including automatic detonation and evaluation of the implementation of formal protection systems against phishing; the use of multi-factor authentication (MFA), next-generation anti-virus, the use of tools to monitor access for unusual behaviour; the use of a protective DNS service to block access to malicious websites;

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training, and penetration testing.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: The Information Security Department, under the leadership of the Chief Information Security Officer, has the responsibility for implementation and monitoring our information security program. The responsibilities of this department include cybersecurity risk assessments, vulnerability management, access reviews for systems and applications, incident response and management, gathering and sharing threat intelligence, monitoring of controls, and overall responsibility for the development of the information security program including relevant policies, procedures, standards and guidelines to enhance data security and mitigate risks. Members of this department include individuals with varying degrees of education and experience, in particular, our Chief Information Security Officer has over twenty seven years of experience in information technology and risk management, with emphasis on information security and cyber security risk management; throughout his career he has served in different positions including as Information Technology Auditor, Technology Risk Manager, Information Security Program Manager and, since September 2018 as our CISO. He has a bachelor's degree in computer systems analysis and has obtained several relevant certifications, including having completed the EC-Council's Certified Chief Information Security Officer Program and obtaining the Information Systems Auditor and Risk and Information Systems Control certifications from the Information Systems Audit and Control Association, ISACA. Several management committees, including our Executive Management Committee, manage our information security program and meet periodically to review and discuss information security matters. In general, summaries of key matters discussed are reported to the Risk Committee.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: Our Audit Committee is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. Our Systems Application Manager, or a delegate, informs the Chief Executive Officer of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The CEO also notifies the audit committee chair of any material cybersecurity incidents.

companyName: OLB GROUP, INC.

ticker: OLB


text: Key elements of our cybersecurity risk management program include: • cybersecurity and information technology governance departments principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents; • engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation; • training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally managed vendors based on their criticality to our business and risk profile.

companyName: Hyatt Hotels Corp

ticker: H


text: Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the ISO 27001, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), and other relevant standards.

companyName: Aeries Technology, Inc.

ticker: AERT


text: Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST") and the Crypto Currency Security Standard ("CCSS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST and CCSS as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: American Bitcoin Corp.

ticker: ABTC


text: Our Chief Financial Officer and members of our audit committee are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers that may bring more expertise regarding cybersecurity matters.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: A subcommittee of the Board of Directors has been established to oversee and manage the company's risk, response, and recovery policies, processes, and procedures related to, and stemming from, cyber-related issues; Purchased cybersecurity risk insurance to protect against potential losses arising from a cybersecurity incident; Implementation of quarterly vulnerability and penetration tests to identify, and if necessary, remediate, any potential risk to the organization;

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: Our Security Committee is comprised of key management stakeholders and experts and is chaired by our Chief Information Officer, who has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. The Security Committee is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Governance and Oversight Management Oversight in Cybersecurity Governance Cabot's Cyber Risk Steering Committee is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Our Chief Digital Information Officer (the "CDIO") is the member of the Company's management principally responsible for overseeing the Company's cybersecurity risk management programs in partnership with business and functional leaders across the Company as well as a managed security service provider that provides threat intelligence, global infrastructure monitoring and threat detection and response to cyber events. The CDIO has held various positions within Cabot's IT department over his 20-year tenure with the Company, and contributes technical expertise to the Company's management team. The CDIO leverages extensive industry, IT and cybersecurity expertise to make strategic and operations decisions for Cabot's information security program. The CDIO collaborates with Cabot's Management Executive Committee to manage cyber risk and enhance the cyber program and reports directly to a member of our Management Executive Committee who has executive responsibility for Digital matters.

companyName: CABOT CORP

ticker: CBT


text: Board Oversight of Cybersecurity Matters The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining a robust cybersecurity risk management strategy and governance program in order to safeguard the confidentiality, integrity and availability of the Company's systems and information. The Board's Audit Committee is tasked with overseeing cybersecurity threats, risk management strategy and governance. The management of cybersecurity risk has been integrated into the Company's overall risk management processes.

companyName: CAMBER ENERGY, INC.

ticker: CEIN


text: Our board of directors established a standing Cybersecurity Committee, which is tasked with oversight of the Cybersecurity Program, including: (i) strategy and governance; (ii) operations; and (iii) risk management and regulatory compliance.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Our current CISO has over 20 years of experience in the field of cybersecurity and holds a Certified Information Security Systems Professional designation. The CISO has a staff of more than 100 employees dedicated to protecting the data and systems belonging to the Company, our customers, business partners and consumers.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Separately, Jackson experienced unauthorized access to two servers as a result of the MOVEit flaw; however, the scope and nature of the data accessed on those servers was significantly less than the PBI impact. Our assessment was that a subset of information relating to certain partner organizations and individuals, including certain customers of Jackson, was obtained from the two affected servers.

companyName: Jackson Financial Inc.

ticker: JXN


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. Novel cybersecurity threats to the Company that are identified are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: Molecular Templates, Inc.


text: The company's Director of Global Information Technology is responsible for leading the assessment and management of cybersecurity risks. The current Director of Global Information Technology has over 10 years of experience in information security and holds CISSP and GIAC credentials. The Director of Global Information Technology reports to the Audit Committee and management on cybersecurity threats on a regular basis.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Our global cybersecurity organization is led by our chief information security officer (CISO), who reports directly to our chief information officer (CIO) and under the organization of our chief information and digital officer (CIDO). Our current CISO has over 19 years of extensive information technology experience, including in security architecture, software development and engineering, as well as leading security operations and incident response, offensive and defensive cyber projects in increasing roles of responsibility. He also previously held Certified Information Systems Security Professional (CISSP) and GIAC Certified Forensics Analyst certifications. Our current CIDO has extensive experience overseeing information technology and security programs, including roles of increasing leadership within our Information and Digital organizations over the last ten years, and prior to that in increasing roles of responsibility managing information systems, including over 18 years at General Electric. Our current CIDO holds CISSP and other IT certifications.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: We are an early-stage company with limited operations, yet we recognize that we are subject to various cybersecurity risks that could adversely affect our business. Cyberattacks on companies around the world continue to increase, which cause operational failures, compromised sensitive corporate or customer data, and/or result in significant financial damages. These attacks occur over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: GenFlat Holdings, Inc.

ticker: GFLT


text: To manage against existing and emerging cybersecurity threats, we maintain enterprise-wide cybersecurity, crisis management, and information security policies and regular training and tests that reinforce the acceptable use of Ameren's information assets, protection of customer and employee data, and the role each employee plays in protecting Ameren against cybersecurity threats. Incident response plans and procedures are continuously tested through recurring companywide cybersecurity exercises to promote readiness across the organization. The plans and procedures are also designed to escalate incidents to appropriate members of management to guide the prevention, detection, response, recovery, and remediation from a material cybersecurity incident. These cybersecurity plans and procedures are positioned to promote the expedient identification, escalation, handling and reporting of a potentially material cybersecurity event or incident. To address cybersecurity threats, we work closely with law enforcement, cybersecurity consulting firms, and industry associations to enhance information sharing and guard against cybersecurity attacks.

companyName: AMEREN CORP

ticker: AEE


text: Cybersecurity and privacy incidents in the pharmaceutical industry are growing in frequency and severity, prompting organizations to invest heavily in people, processes, and technology to bolster their cybersecurity risk management capabilities.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: Risks from Cybersecurity Threats Brighthouse Financial systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. We have not experienced any cybersecurity incidents to date, directly or indirectly, that have materially impacted our business, financial condition, or results of operations. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in cyber- or other information security systems, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, associates, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Our board of directors addresses the company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for reviewing the company's guidelines and policies with respect to risk assessment and risk management, including those related to assessment and mitigation of risks from cybersecurity threats.

companyName: Equillium, Inc.

ticker: EQ


text: The Board, in coordination with the Audit Committee, oversees our risk management program, including the management of cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds. Annually, the Board and the Audit Committee discuss our approach to overseeing cybersecurity threats with our Chief Information Security Officer/Chief Information Officer, or CISO/CIO, and other senior management members.

companyName: CareDx, Inc.

ticker: CDNA


text: The company has made investments in our technology to identify and manage the material risks of cybersecurity threats that could hinder our operations. As part of our regular cybersecurity risk management systems, we routinely reach out to external cybersecurity experts and third-party consultants to provide advice and implement changes in our current policies. The company also relies on the utilization of outsourced service providers who help provide certain functions that are key to the operations of our business. The company has taken steps to ensure the security of any data we might provide to these service providers and to ensure that our operations would be mitigated in terms of risk by engaging reputable service providers who maintain cybersecurity protection programs and protocols for their customers.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: Our management team, including our CIO and CISO, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information systems environment.

companyName: AMGEN INC

ticker: AMGN


text: Internally, our employees are a key part of our Program. All Avalo employees and contractors are required to participate in annual security awareness training, which includes phishing simulations. Company Employees are also trained on policies of information security and acceptable usage of systems, as well as procedures related to electronic record management, and Avalo regularly reviews and updates user accounts and permissions and ensures that only approved applications are installed on Company devices. The Company manages endpoints centrally and content can be deleted remotely in the event of stolen devices or terminated users.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: At Braves Holdings, the Senior Vice President ("SVP") and Head of Technology, together with the Director Cybersecurity and IT Infrastructure, is responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The SVP and Head of Technology provides regular reporting to Braves Holdings executive management and the ISSC. Braves Holdings has also established a Security Executive Steering Committee, which is composed of a cross functional group of executive management and technical team members, including the Chief Financial Officer, Chief Legal Officer, Baseball Assistant General Manager, Vice President Security, SVP and Head of Technology, and Director Cybersecurity and IT Infrastructure. The Security Executive Steering Committee meets at least quarterly and has primary management oversight responsibility for assessing and managing information security, data protection and privacy, and cybersecurity risks.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.

companyName: Owlet, Inc.

ticker: OWLT


text: Threat Identification: We utilize advanced threat detection tools and services that continuously monitor our network for signs of unauthorized access, anomalies, and potential breaches. Our third-party cybersecurity provider is equipped with sophisticated detection technologies that help to swiftly identify even the most subtle signs of compromise. We focus on: • Real-time monitoring of our networks; • Regularly updated intrusion detection systems (IDS); • Deployment of endpoint detection and response (EDR) solutions; and • Utilization of threat intelligence platforms to stay abreast of emerging threats.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Critical elements of our ISMS include: • Operational measures to monitor and respond to data breaches and cyber attacks. We have application, database, network, and resource monitoring in place that are designated to identify vulnerabilities and protect our applications. Our personnel are trained to promptly report any security incident and any such incident is addressed by our Security Incident Management Policy, which includes a formal incident response process. We also provide a trust site that displays upcoming maintenance downtimes, data center incidents, and relevant security communications. • Vulnerability and penetration testing. Our solutions undergo internal vulnerability testing prior to release. We have built our own internal penetration testing systems and we conduct vulnerability assessments on our software using automated and manual methods, at least annually. In addition, we commission annual vulnerability and penetration testing of our systems by industry-recognized, third-party security specialists. • Training. We require role-based security and security awareness training. All employees receive annual training on our Code of Conduct and our Acceptable Use Policy, which establishes our commitment to protecting the confidential and proprietary information of our customers and partners. In addition, all new hires and contractors must undergo information security awareness training. Subsequent security awareness training is required annually for all active employees and contractors. Employees in certain roles (e.g., customer support representatives, developers, and hiring managers) receive more extensive data security training annually. • Disaster recovery and business continuity. Our solutions are designed to help avoid single points of failure to reduce the chance of business disruption from security breaches, incidents, and other disruptions of systems. We maintain formally documented recovery processes that may be activated in the event of a significant business disruption of our corporate IT infrastructure or the production infrastructure that processes our customer data. We conduct testing, at least annually, to verify the validity of the recovery processes and provide reports on the test results for production infrastructure that processes our customer data to customers via access to a customer portal.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: We have updated our comprehensive cybersecurity and data protection policies and procedures to address any cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Motus GI Holdings, Inc.

ticker: MOTS


text: Technical Safeguards: The Company deploys technical safeguards designed to protect the Company's information systems from cybersecurity threats. The Company deploys tools in an effort to detect vulnerabilities, and when a weakness is identified, the Company seeks to assess the significance of the impact and mitigate before the weakness is exploited by an unauthorized actor.

companyName: BORGWARNER INC

ticker: BWA


text: The Company maintains a comprehensive risk management program designed to assess, identify, and manage material risks facing the Company, including material risks associated with cybersecurity risks and vulnerabilities. Through this risk management program, the Company seeks to mitigate the potential impact of any cybersecurity incidents on the Company's operations and financial condition. We have a comprehensive set of processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Implementation of cybersecurity measures, such as firewalls, endpoint intrusion detection and response systems, and anti-virus/anti-malware software. Employee training and awareness programs to educate all employees about cybersecurity threats, incident reporting and prevention measures. Monitoring of network traffic and information technology systems for signs of potential threats.

companyName: JANEL CORP

ticker: JANL


text: We are committed to protecting Company information and the confidential information of our employees, customers, partners, and suppliers. To that end, we have in place various policies, procedures, and processes to identify, assess, manage, and prevent potential cybersecurity risk's, and to timely detect the occurrence, and mitigate the effects of, cyberattacks and data breaches. Our Chief Information Officer ("CIO"), who has more than 25 years of information security and cybersecurity experience, manages cybersecurity, and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity. Our personnel, along with external parties engaged to assess the sufficiency of our risk management processes (e.g., through penetration testing), continuously work to maintain and improve our cybersecurity program and the security and integrity of our information systems and infrastructure through our ongoing risk management program, including (i) by conducting cybersecurity assessments and audits to address threats and to stay in step with emerging malicious trends, and (ii) by performing due diligence on partners and suppliers to ensure similar values and appropriate security standards and safeguards are maintained by such partners and suppliers with respect to our information security assets and to third-party systems on which we rely. In addition, our Incident Response Team is trained to identify, quarantine, and remediate cybersecurity threats, and all of our employees are regularly trained to increase awareness of threats and to identify how to spot and avoid them.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Incident Response and Testing. We maintain a robust cybersecurity incident response plan that incorporates regular simulations, drills, vulnerability scans, penetration testing and third-party assessments to evaluate and enhance our cybersecurity controls and resilience.

companyName: Ingevity Corp

ticker: NGVT


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our IT management team, internal security staff, or external experts as part of the Board's continuing education. Six members of our Board of Directors have information security expertise, including Joseph C. Beery, Gary S. Guthart, Ph. D., Amal M. Johnson, Sreelakshmi Kolli, Keith R. Leonard, Jr., and Mark J. Rubash.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: Our Board is responsible for overseeing OFG's cybersecurity efforts and approving the Information Security Program, which sets forth OFG's policy regarding the confidentiality, integrity and availability of its information assets. The Board's Risk and Compliance Committee more directly oversees the implementation of the Information Security Program and receives quarterly reports on any cybersecurity risks.

companyName: OFG BANCORP

ticker: OFG


text: Internal Audit Program – We operate an internal audit program. On an annual basis, our internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. Included in this evaluation is a report on our cybersecurity posture and related matters that is presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Cybersecurity risk management oversight is led by our CISO and CTO. Prior to joining Chubb in 2015, our CISO was Director of the threat analytics platform for a major cybersecurity incident detection and response company. Prior to that, our CISO was an executive leader within the information security practice and a technical architect with two global accounting firms. Our CTO has extensive experience as a chief technology officer in digital-first environments and was previously the chief technology officer of a large global bank, responsible for the bank's core infrastructure, end-user technology, production support, group architecture, cloud technology, and software license management. Our CTO holds a master's degree in geographical information systems and a bachelor's degree in artificial intelligence and computer science. Chubb management also benefits from the advice provided by a Cyber Advisory Board of external experts. The members of the Cyber Advisory Board have extensive experience and deep expertise on cybersecurity matters, several having served in senior government positions with executive responsibility for identifying and mitigating cyber threats across the globe.

companyName: Chubb Ltd

ticker: CB


text: The audit committee of our board of directors (the "Audit Committee") is responsible for overseeing risk management strategies that are specific to us, including reviewing management's assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on material security incidents and cybersecurity risks are made to senior management and the Audit Committee by the Adviser.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: We maintain multiple layers of security designed to detect and block cybersecurity events, as well as employ a dedicated team of cybersecurity personnel and professionals, who assist our Vice President – Information Technology in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. Further, we have various processes and programs designed to manage cybersecurity risks associated with our use of third-party vendors and suppliers.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: Third Party Security Experts We engage third party security experts for cyber security assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, training, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: TEAM INC

ticker: TISI


text: As of the date of this report, we are not aware of any actively exploited security risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: The Company's Information Security Program ("ISP") is a robust framework overseen by the Information Technology Board Committee ("ITBC") and the IT Steering Committee ("ITSC"). These committees play a pivotal role in managing technology and cyber risks, ensuring compliance with regulatory requirements, and fostering a controlled risk environment.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: The Company's CISO, in coordination with our Chief Executive Officer, Chief Financial Officer, CIO, General Counsel and Chief Compliance Officer, works collaboratively across the Company to implement the Company's cybersecurity program, to protect the Company's information systems from cybersecurity threats, and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company relies on the expertise of its cybersecurity team to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the cybersecurity team and key security vendor partners, the CIO and CISO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.

companyName: AGILITI, INC. \DE


text: The Company's Chief Information Officer and CISO bring over 35 years of combined experience in the technology and cybersecurity space. The Chief Information Officer has served as a chief information officer and chief technology officer of both private and public institutions for the past 10 years and was responsible for the IT operations and cybersecurity practices of those institutions. The CISO is a certified cybersecurity professional and technologist. He holds an active ISO/ANSI-accredited cybersecurity certification and has experience managing security programs across multiple industries, including financial services and insurance. Other credentials among Ambac's IT staff include a Certified Information Systems Security Professional certification and a Masters Degree in cybersecurity risk and management.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "If we, our third-party vendors, our regulators or any other quasi-governmental organization we are required to report information to are subject to cyberattacks, data breaches or other security incidents, or if there is a disruption or failure of our information technology systems or software, such events could expose us to liability and could adversely affect our financial condition and operating results," "The personal information that we collect may be vulnerable to breach, theft or loss, any of which could adversely affect our reputation, operations and ability to attract and retain students," and "Our primarily remote work environment may exacerbate the risks related to our business technology infrastructure," included as part of our risk factor disclosures within Item 1A of this Annual Report on Form 10-K. We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents in the last three fiscal years, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, and the expense we have incurred from cybersecurity incidents were immaterial.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: Annual risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. Management regularly provides data protection and cybersecurity reports to the Audit Committee and the Board of Directors, which includes updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: Our advisor's Information Technology Director and Executive Committee are responsible for our incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats. Our advisor's Information Technology Director also coordinates with consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's cybersecurity risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has delegated primary oversight responsibility over the Company's cybersecurity risk and cybersecurity risk management to the Information Services Steering Committee of the Board of Directors. The Information Services Steering Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Information Security Officer ("ISO") and/or the Chief Information Officer ("CIO"). The ISO and/or CIO also provide periodic updates regarding cybersecurity risks and the cybersecurity program to the Audit Committee of the Board of Directors and to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: We do not believe that any risks from cybersecurity threats of which we are aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For information regarding the risks we face associated with cybersecurity incidents, see "Risk Factors – We rely on information technology systems in our operations, and any breach or security failure of those systems could materially adversely affect our business, financial condition, results of operations and reputation" included in this Annual Report on Form 10-K.

companyName: Mid-America Apartments, L.P.


text: Board Oversight of Cyber Risk The Audit Committee of our Board of Di rectors oversees our policies and procedures with respect to risk management, including our management of risks from cybersecurity threats. The Audit Committee administers this cybersecurity risk oversight function through the receipt and review of reports from the management team and the vCIO on the Company's information technology systems and the status of the cybersecurity risk management tools.

companyName: Vivani Medical, Inc.

ticker: VANI


text: The Audit Committee of our Board of Directors (the "Audit Committee") is primarily responsible for overseeing our compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of our information system and cybersecurity controls.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: Following these risk assessments, or when we otherwise identify cybersecurity risks through the processes described in this "Risk Management and Strategy" section, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We devote significant resources and designate high-level personnel, including our Information Security Officer, who reports to our Head of Finance and Administration, to manage the risk assessment and mitigation process.

companyName: Blend Labs, Inc.

ticker: BLND