text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.

companyName: QWEST CORP

ticker: CTBB


text: Cybersecurity incidents are responded to in accordance with the Company's established Cybersecurity Incident Response Plan ("IRP"). In the event of an incident, we follow our IRP, which includes evaluation of the severity of the incident based on factors such as the number of assets affected, the extent of the incident, the likelihood of inappropriate data exposure, operational impact and/or reliability impact. Dependent upon the severity of an incident, the incident is escalated to the senior leadership, including the CEO and CISO. Senior leadership then determines whether, based on various factors, the incident requires immediate escalation to the Board of Directors and to third-party incident response organizations and notification to functional areas, such as legal and finance, as well as senior leadership and the Board, and external entities, as appropriate and required. We maintain relationships with third-party Digital Forensics and Incident Response ("DFIR") service providers to strengthen our incident response capabilities in the event that we determine the need to augment our effort during an incident and to provide us additional assurance that our responses to complex incidents or highly sophisticated threat actors have been effective and complete.

companyName: TUCOWS INC /PA/

ticker: TCX

secItem: Item 1C


text: Our Board understands the importance of maintaining a robust and effective cybersecurity program. The Audit and Finance Committee of the Board oversees the Company's cybersecurity program as well as risk exposures and steps taken by management to monitor and mitigate cybersecurity risks. The CISO provides a quarterly update on the cybersecurity program, on an alternating basis to the Audit and Finance Committee or the full Board.

companyName: GAP INC

ticker: GAP


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our cybersecurity program prioritizes threat mitigation, while focusing on maintaining the integrity and resilience of our systems. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as guidelines in the development of our cybersecurity program. We also adhere to applicable Payment Card Industry Data Security Standards. The cybersecurity risk management process and related governance processes are integrated into our broader enterprise risk management framework, which is designed to appropriately identify, prioritize, manage, and oversee risks.

companyName: HOME DEPOT, INC.

ticker: HD


text: The Company's Information Technology, Enterprise Security, Internal Audit, as well as the Legal and Privacy teams work closely to identify issues and incidents in a timely manner, and report them to senior leadership, the Board of Directors, and appropriate regulatory bodies, as appropriate. Assessing, identifying, and managing cybersecurity risks are integrated into our overall enterprise risk management (ERM) framework that provides risk quantification, scenario analysis to determine the potential impact on the enterprise, and processes to manage risk within the parameters of the organization's risk appetite. Additionally, ERM provides support to the decision making process to enable cybersecurity risk owners to accomplish the desired level of asset protection and alignment consistent with the organization's strategy. The ERM work is presented annually to the Audit Committee and Board of Directors, including the management of top risks and the review of emerging risks.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Our information security risk management program is designed to, among other things, assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service to information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our information security risk management program includes technology and processes designed to maintain active awareness of risks to the security of our information or systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.

companyName: CoreCivic, Inc.

ticker: CXW


text: The Company maintains information systems which contain personal data, financial reports and proprietary data. As a result, we are exposed to cybersecurity threats which could result in loss of or damage to our intellectual property, proprietary information, client data and reputation, or interruption of our business operations, or additional costs to prevent, respond to, or mitigate cyber-attacks.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: We have an information security program in place to safeguard our information systems and protect our confidential data. This cybersecurity risk management program is integrated into our broader enterprise risk management framework, under a Risk Committee that is led by our Chief Financial Officer and includes our Chief Technology Officer, who is responsible for cybersecurity and information technology matters, General Counsel, Chief Accounting Officer, Chief Human Resources Officer, Chief Commercial Officer, and other business and strategy leaders. The Risk Committee identifies, assesses, and manages enterprise level risks facing the Company, taking into account likelihood of occurrence and potential impact. The Risk Committee reports to our Executive Committee and this process is primarily overseen by the Audit Committee of our Board. Our Executive Committee consists of the Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Technology Officer, Chief Human Resources Officer, Chief Commercial Officer, and Vice President, Communications and Corporate Social Responsibility.

companyName: QXO BUILDING PRODUCTS, INC.


text: Our board's Security/Technology Committee reviews the overall status of management's information security program, including any significant issues, significant emerging risks, strategies, and other information to ensure that information security management practices appropriately address potential risks. It is also responsible for the exposure and containment of technology risks, including security risks.

companyName: Federal Home Loan Bank of Indianapolis


text: Management is responsible for assessing and managing our material cybersecurity risks, practices and policies on a day-to-day basis.

companyName: Dynatrace, Inc.

ticker: DT


text: BancPlus recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats and safeguarding the security of its banking operations and data, including protecting its customers' information. As described in more detail below, BancPlus has established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats (collectively, the "cybersecurity program"). The Company has devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and has made significant investments to maintain the security of the Company's banking operations and data and cybersecurity infrastructure.

companyName: BANCPLUS CORP


text: We routinely conduct risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change that may affect production and information systems that are vulnerable to such cybersecurity threats and assessments in the event Samsara-specific or industrywide relevant vulnerabilities are discovered. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Samsara Inc.

ticker: IOT


text: PGE utilizes the cybersecurity framework established by the National Institute of Standard and Technology (NIST) to manage cybersecurity risk. The NIST Cybersecurity Framework provides the foundation for a comprehensive view of the lifecycle for managing cybersecurity risk. All employees are required to take annual cybersecurity awareness training. The Company conducts monthly phishing campaigns in which employees are expected to report suspicious emails. If employees click on the training phishing email, they are provided immediate feedback on how to avoid phishing, in addition to being required to complete additional training. Quarterly security awareness is provided to all employees and focuses on cyber and physical security best practices.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a global incident response capability. We also have established a dedicated vendor assessment team, which employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use, as well as a global training and awareness program. We also continuously test and assess our cybersecurity posture, including through annual third-party risk assessments performed by reputable assessors, consultants and auditors. A global FAIR (Factor Analysis of Information Risk) assessment is conducted at least annually to update our cybersecurity risks and corresponding mitigations.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item is incorporated herein by reference to the information under "Information Technology Risk Management" under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations" in the Company's 2023 Annual Report to Shareholders (included as Exhibit 13 hereto).

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: Risks from cybersecurity threats are among those that we address in our general risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions designed to reduce, eliminate or manage risks. Risk assessments are performed quarterly as part of this program and the results are discussed and reviewed with management.

companyName: Cardlytics, Inc.

ticker: CDLX


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as our business depends on customers trusting that their shopping experience with us is both reliable and safe. We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our regular enterprise risk management updates to the Audit Committee, (ii) our information technology and security related internal controls and (iii) our global incident response and vulnerability management programs.

companyName: Wayfair Inc.

ticker: W


text: As part of our risk management processes, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings. We require relevant third-party service providers to confirm that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Lyft, Inc.

ticker: LYFT


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.

companyName: Q32 Bio Inc.

ticker: QTTB


text: At least annually, the Annual Electronic Data Processing Report & Risk Assessment is presented to the Board. The report provides an overview of IT operations, core providers, IT policies, audit and testing information, and IT strategic accomplishments and future planned IT initiatives. The report also includes an IT Risk Assessment and risk matrix. IT audit findings are included on the Master Exam/Audit Tracking Report of Action Items which is presented to the Board bi-monthly.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Our information technology (IT) systems process, store, and transmit sensitive information, and we are heavily reliant on IT to operate our business. As such, IT security is viewed as a critical aspect of our business and one which we must continually evaluate and optimize in order to ensure ongoing effectiveness across the business in meeting the challenge of evolving cyber threats.

companyName: Loar Holdings Inc.

ticker: LOAR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a vulnerability management policy, disaster recovery and business continuity plans, network security controls and data segregation (for certain systems), employee training, and cybersecurity insurance.

companyName: GENELUX Corp

ticker: GNLX


text: Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved as necessary, based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: Skillz Inc.

ticker: SKLZ


text: Role of our Board of Directors and the Audit and Compliance Committee As part of our Board of Directors' role in overseeing the Company's ERM program, which includes our cybersecurity risk management, our Board is responsible for overseeing management's identification, assessment and management of material cybersecurity risks which may reasonably be expected to impact the Company. While our Board has overall responsibility for enterprise risk oversight, our Board has delegated to the Audit and Compliance Committee responsibility for overseeing risks from cybersecurity threats and incidents. The Audit and Compliance Committee is responsible for overseeing the effectiveness of the Company's cybersecurity risk management initiatives, taking into account the Company's risk exposures. Management briefs the Audit and Compliance Committee at least once a year and our Board as appropriate on cybersecurity controls, protocols, risk assessments and mitigation measures.

companyName: Ventas, Inc.

ticker: VTR


text: Further, the contracts for EQRT, the Adviser and EQT include stringent data protection and liability clauses in the event of a breach.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Looking ahead, we remain committed to continuously improving our cybersecurity strategy and initiatives. We recognize the ever-evolving nature of cybersecurity threats and the need to adapt our measures accordingly. In the future, we plan to focus on enhancing employee training and awareness programs to foster a culture of cybersecurity awareness within the Company.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's policies and processes through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity controls and oversight. Third-party audits and independent reviews of our cybersecurity measures, information security control environment and operating effectiveness are conducted on at least an annual basis.

companyName: PHINIA INC.

ticker: PHIN


text: As of the filing date of this report, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see the section titled "Risk Factors—Risks Related to Our Business Operations and Industry— Our information technology systems, or those of any of our service providers, may fail or suffer security incidents and other disruptions, which could result in a material disruption of our ecDTx development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: Boundless Bio, Inc.

ticker: BOLD


text: The Company's Information Security Officer ("ISO") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of the Company's information security program, including risks of cybersecurity threats. The Risk Oversight Committee and Audit Committee, which support the Board of Directors in the oversight of the Company's information security program are focused on risks from cybersecurity threats, including incident response planning, timely identification and assessment of incidents, incident recovery, and business continuity considerations. The Risk Oversight Committee members have varied expertise and experience including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The Risk Oversight Committee has delegated day-to-day oversight of our information security program to our executive officers, including the Vice President of Information Technology ("VP of IT") along with our Global Cybersecurity Director ("Director"). The Director reports to the VP of IT and is a 31-year veteran of the information technology industry having served in the military and with a Fortune 500 company with over 20 years of cybersecurity experience including leading incident responses, policy development, and building security architectures. The VP of IT and the Director regularly meet with our President and Chief Financial Officer to inform them of matters related to cybersecurity risks and incidents. These meetings are designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant known cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that the Board of Directors has oversight and can provide guidance on critical cybersecurity issues. We believe our information security team is well positioned to identify risks from cybersecurity threats based on numerous job qualifications and on-going training.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Our Board has oversight of all cybersecurity threats and incidents. On a quarterly basis, and more often if warranted, the Company's CIO, or the CFO in coordination with the CIO, each after consultation with the CISO, reports to the full Board any potentially material cybersecurity threat or incident and our activities monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: A security team consisting of our executive management team, other members of senior management, and our managed information technology Service Provider, Connetic, LLC, a Delaware limited liability company ("Connetic") is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems. The team has primary responsibility for our overall cybersecurity risk management program. Connetic has provided information technology support, security audit and on-call services to financial industry participants for more than 25 years.

companyName: Peakstone Realty Trust

ticker: PKST


text: In addition, our third-party service providers play a role in our risk management and strategy as well as with the investigation of cybersecurity incidents. Based upon the assessment of the type of incident and risk presented, the ISIRT engages outside counsel and/or external resources, such as forensic consultants, to conduct or assist with cybersecurity investigations in order to provide advice to the Company. The vendors we engage with are globally recognized companies with expertise in cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: BRUKER CORP

ticker: BRKR


text: Like other companies with a large technology footprint and high-profile client base, we are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact to our operations or clients. In the future, it is possible such attacks could be successful and have a material impact on our operations or our clients' operations. Our cybersecurity program strategy is to implement layered controls to reduce our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events. These controls are aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third -party assessments, internal information technology audit, information technology security, governance, and risk and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and techniques to test security controls, conduct employee training, and monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Board of Directors Oversight T he Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. T he Audit Committee is composed of independent board members with diverse expertise and experience which allows them to oversee cybersecurity risks effectively.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Due to our highly regulated stature for medical device development and manufacture, we have been practicing cybersecurity for a long time. We are ISO-13485 Certified for medical device manufacturing. Elements of that certification include risk management. And we are knowledgeable about ISO-27001. We have an engineer responsible for the security of our computers, network, etc.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. On a periodic basis, our Board of Directors reviews the adequacy of our computer systems controls, cybersecurity risk management and related governance and incident disclosures.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: The Incident Response Plan ("IRP") includes procedures for responding to actual or potential cybersecurity incidents, including providing timely notice to customers and our bank regulatory agencies when appropriate. The IRP is based on the NIST Cybersecurity Framework. The plan is tested annually through tabletop exercises.

companyName: Investar Holding Corp

ticker: ISTR


text: Employees outside of the cybersecurity team also have a role in our cybersecurity defenses and they are engaged in a culture supportive of security protocols, which management believes improves the Company's cybersecurity. All employees are required to complete cybersecurity trainings annually and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. The internal business owners of hosted applications are required to document user access reviews at least annually and receive a System and Organization Controls ("SOC") 1 or SOC 2 report from the vendor. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, management will take additional steps to assess the vendor's cybersecurity preparedness.

companyName: Andersons, Inc.

ticker: ANDE


text: While no material incidents have occurred, we cannot guarantee that future incidents will not materially affect our company, especially as we expand digital product features, enter new geographic markets, and integrate with third-party systems.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: In the event of a reported potential cybersecurity incident, a first response team, which includes leaders of the GIS team, other members of management and the legal team, determines without undue delay whether it is a QCI as defined in the CIRP. If an incident is determined to be a QCI, the process included in the CIRP is initiated and such incident is communicated to the designated leadership team, including Hilton's general counsel. Further, appointed leaders collaborate on determining if the incident is material, as well as the resulting response, including any legal and financial reporting obligations of the Company. Information also is provided to additional members of senior management as appropriate. The remediation plan for the QCI is entered within Hilton's GRC platform and monitored and reviewed at least monthly to ensure effective implementation; depending upon the type of incident, additional reporting may be produced and monitored by the GIS team to ensure the effectiveness of the remediation plan. All cybersecurity incidents are tracked within our incident response platform, regardless of the potential materiality of the impact.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: The Fund's Cybersecurity Risk Management Approach The Fund utilizes and relies on CIM for its IT and IT administration. CIM's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.

companyName: CIM Opportunity Zone Fund, L.P.


text: For additional information regarding the risks we face from cybersecurity threats, please see the section entitled "Item 1A. Risk Factors—Cybersecurity incidents or other failures in telecommunications or IT systems could result in information theft, data corruption and significant disruption of our business operations."

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to Item 1A, Risk Factors under the heading "Technology, Data Security and Privacy" for additional information on our cybersecurity threats.

companyName: PROASSURANCE CORP

ticker: PRA


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within our information technology ("IT") and risk management systems and addresses both the corporate and the operational IT environment.

companyName: W&T OFFSHORE INC

ticker: WTI


text: We have combatted cybersecurity threats in the normal course of business, but prior cybersecurity incidents have not materially affected, and do not appear likely to materially affect, our operations, business strategy, results of operations or financial condition. However, our Enterprise Risk Management program has recognized that we face ongoing risks from cybersecurity threats that, if not successfully prevented or mitigated, could materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information on this risk, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.

companyName: BEST BUY CO INC

ticker: BBY


text: Further, cybersecurity risk is integrated into our enterprise risk management ("ERM") approach and is among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. We use several tools and controls designed to manage IT risk, including, but not limited to, controls for the management of privileged access, anti-malware tools, simulated email phishing attacks, and other email security tools intended to detect and prevent intrusions as well as monitor risks. Cabot employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. We have a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engage in response planning, simulations, trainings, tabletop exercises, and other efforts to prepare for any incidents should they occur.

companyName: CABOT CORP

ticker: CBT


text: Furthermore, we offer cybersecurity consulting as a service to clients. Our client-facing cybersecurity and information security experts periodically advise our cybersecurity and information technology teams regarding best practices. In addition, from time-to-time, they address our executives, directors, and other segment or regional leaders regarding complex issues faced by other companies that arise from data-security-related challenges. Among other things, they discuss new and evolving types and levels of threats and attacks, hacking and ransomware, foreign actors, risks driven by new and evolving technologies, including artificial intelligence, potential damages, and liability, and technological and other solutions potentially available to mitigate such risks, as well as other company responses. The existence of this team within FTI serves to aid in our ability to have current incident and threat intelligence that we can use to bolster our own security posture and defenses. Our cybersecurity practice also provides us with supplemental incident response investigation services in partnership with independent, external consultants, as needed and as appropriate.

companyName: FTI CONSULTING, INC

ticker: FCN


text: We have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: The Company's information security efforts are led by our Senior Vice President, Information Technology ("SVP, IT") and our Director of Information Security ("IT Director"), supported by our executive management team. These efforts are designed to address information security governance and risk, product security, identification and protection of critical assets, third-party risk, security awareness, cyber defense operations and related risk management matters. Our SVP, IT and IT Director have an average of over 35 years of prior work experience in various roles involving information technology, including security, auditing compliance, systems and programming. These individuals have relevant educational and industry experience, including holding similar positions at other large companies.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: In the event of a material cybersecurity incident, the full Board would be convened on a frequent basis to receive updates and provide oversight.

companyName: EQUINIX INC

ticker: EQIX


text: Management's Role Managing Risk The Chief Information Security Officer ("CISO") plays a pivotal role in informing the Board and the Audit Committee on cybersecurity risks and provides comprehensive briefings on a regular basis, with a minimum frequency of three times per year to the Audit Committee and once per year to the full Board. During committee reports, the Audit Committee apprises the full Board of any significant cybersecurity updates. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and knowledge gleaned from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the CISO and Chief Executive Officer inform and consult as appropriate with the Board regarding any significant developments in the cybersecurity domain.

companyName: WORKIVA INC

ticker: WK


text: Additionally, we assess third-party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable.

companyName: Enviva, LLC


text: Cybersecurity Threat Disclosure There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, to date, we are not aware of any cybersecurity threats that have materially affected our business. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Governance & Personnel Our Board believes a robust cybersecurity strategy is vital to protect our business, customers, and assets. The Board has delegated to the Audit Committee responsibility for oversight and review of our cybersecurity and other information technology and data privacy risk management program, controls, strategies, and procedures. The Audit Committee periodically evaluates our cybersecurity strategies to ensure effectiveness and, if appropriate, includes a review from third-party experts. In addition, our Board also may review and assess cybersecurity risks as part of its responsibilities for general risk oversight. Additionally, the Audit Committee has established a subcommittee to evaluate cybersecurity incidents, if any, and determine the Company's disclosure obligations in light of such incidents.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team identifies risks by regularly monitoring alerts, meeting to discuss threat levels, trends, and remediation and immediately informs the Chief Information Security Officer, whom leads the IT security team, upon the occurrence of any material event. The processes used to assess the risk level include preparing a monthly cyber scorecard, regularly collecting data on cybersecurity threats and risk areas and conducting an annual risk assessment. To assure risks are reduced and maintained, we conduct periodic external penetration tests, red team testing, and maturity testing to assess our processes and procedures and the threat landscape. We regularly test defenses by performing simulations and drills at both a technical level (including penetration tests) and by reviewing our operational policies and procedures with third-party experts. We view cybersecurity as a shared responsibility throughout the Company, and we periodically perform simulations and tabletop exercises at technical and management levels and incorporate external resources and advisors as needed. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. We utilize our Internal Audit team to assess the design and operating effectiveness of our internal controls, including those that relate to our IT security environment. Further, we maintain various cyber insurance policies and believe we are adequately covered in the event we experience a cybersecurity breach. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Sinclair, Inc.

ticker: SBGI


text: We regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having third parties, including independent Qualified Security Assessors review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: JUNIPER NETWORKS INC


text: We are continually assessing the need to implement and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic or competitive in nature.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on- going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: Southern States Bancshares, Inc.


text: In addition, we have a cybersecurity disclosure committee ("Cybersecurity Disclosure Committee") which receives updates on an as needed basis from our security organization regarding cybersecurity incidents. The Cybersecurity Disclosure Committee includes our VP of Security and Controls and senior representatives from finance, controllership, internal audit, investor relations, and legal teams. In the event of a cybersecurity incident, the Cybersecurity Disclosure Committee meets to assess the incident for materiality and required disclosure.

companyName: Symbotic Inc.

ticker: SYM


text: Further, in support of our information security program, we utilize certain third-party service providers, primarily in the following capacities: 1) incident response partners that assist with performing incident simulations and who are available to assist in the event of an actual cybersecurity incident; 2) consultants to conduct penetration testing on AAM systems and certain third-party systems, as necessary; and 3) auditors to assist with testing IT controls and performing gap analysis over IT processes and procedures. AAM's CISO manages and monitors these third-party service provider relationships and works closely with AAM's information security, procurement, legal and internal audit departments to ensure proper evaluation and security assessment of critical third-party service providers and data processors.

companyName: Dauch Corp

ticker: DCH


text: The CISO has served in various roles in information technology and information security for over 20 years, including serving as the Chief Information Security Officer of PAE Incorporated prior to its acquisition by Amentum. The CISO holds an undergraduate degree in computer science from the University of Maryland and a graduate degree in information security and assurance from Carnegie Mellon University. The CISO has attained the professional certifications of Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Manager.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: We rely heavily on third parties to deliver our products and services to our customers, and a cybersecurity incident at a key supplier or subcontractor could materially adversely impact us. We include security and privacy addenda to our contracts where applicable. In addition, any subcontractors connecting to our network are instructed to report cybersecurity incidents to us so that we can assess the impact of the incident on us.

companyName: RideNow Group, Inc.

ticker: RDNW


text: Our Director of Information Technology and Chief Financial Officer (CFO) are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Tracon Pharmaceuticals, Inc.


text: Management is directly involved in steering the company's cybersecurity program employing a multi-disciplinary approach that operates through a three lines of defense model. Management's approach helps ensure the organization works collaboratively to monitor, assess and respond to cybersecurity incidents at all levels and functions consistent with our incident response procedures and corporate practices.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: We recognize the importance of maintaining the trust and confidence of our customers, business partners, and employees, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our approach to cybersecurity risk management is aligned with our risk profile and business, and includes efforts towards meeting the standards for an organization of our size and type in conjunction with the National Institute of Standards and Technology. We also utilize a third-party IT vendor to manage the technological security and efficacy of our systems, including a Virtual Chief Information Officer, a Virtual Chief Information Security Officer, and other IT specialists who manage our IT and cybersecurity needs.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: Our information security program is audited annually against a well-known security framework, by an accredited third party. We currently carry a HITRUST certification, which is a security assessment that targets the healthcare industry and HIPAA compliance. We are currently which has more general applicability and covers the trust services criteria of security, confidentiality, privacy, accessibility, and processing integrity.

companyName: OptimizeRx Corp

ticker: OPRX


text: As an externally managed closed-end management investment company that has elected to be treated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior Blackstone Credit & Insurance professionals and each of the Adviser and Administrator is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: The Company's MSP is responsible for identifying and assessing risks on an ongoing basis to ensure that the Company's policies and procedures are functioning as designed to protect the Company's information systems from potential cybersecurity threats. Management is provided regular updates on the Company's cybersecurity programs and material cybersecurity risk and mitigation strategies, along with any necessary enhancements to those programs. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would be notified immediately of any cybersecurity incidents.

companyName: KOSS CORP

ticker: KOSS


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: The Board of Directors (Board), acting through the Audit Committee of the Board (Audit Committee), has overall responsibility for risk oversight and oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures. On a regular basis, the VP of IT reports to the Audit Committee on information technology and cybersecurity matters, including key risks, the potential impact of those exposures on the Company's business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures, the Company's information governance and cybersecurity policies and programs, and significant legal and regulatory developments that could materially impact the Company's cybersecurity risk exposure.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and necessary, the use of third-party security experts if and when an incident is detected are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.

companyName: Transit Pro Tech Inc.


text: The Company's cyber risk management program also includes regular security awareness training to educate employees and new hires on the Company's cybersecurity policies, standards and practices. This training is supplemented by Company-wide testing initiatives, including periodic phishing tests. The Company provides specialized security training for certain employee roles such as application developers and privileged account holders. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers, who may be system vendors or data processors. The Company utilizes an external risk management tool to assist with oversight and monitoring of third-party cybersecurity risk. Each third-party service provider is vetted, evaluated and scored based on its cybersecurity methodology. For many vendors of third-party hosted applications, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports to support our assessment of our vendors' security practices. If a third-party vendor was not able to provide the requested reports, we would take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: Governance and Oversight Management Oversight in Cybersecurity Governance Cabot's Cyber Risk Steering Committee is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Bart Kalkstein, an Executive Vice President of Cabot and a member of Cabot's Management Executive Committee, is a member of the Steering Committee and has executive responsibility for Digital matters. He is supported by our Chief Digital Information Officer (the "CDIO") and our Senior Director of Digital Security (the "SDDS"). The SDDS is the member of the Company's management principally responsible for overseeing the Company's cybersecurity risk management programs in partnership with business and functional leaders across the Company as well as a managed security service provider that provides threat intelligence, global infrastructure monitoring and threat detection and response to cyber events. The SDDS has held various positions within Cabot's IT department over her approximately 30-year tenure with the Company, has an educational background in Information Systems and contributes technical expertise to the Company's management team.

companyName: CABOT CORP

ticker: CBT


text: Financial institutions have an obligation to customers, consumers and stakeholders to safeguard the confidentiality, integrity and availability of nonpublic, sensitive information and the information systems used to store, transmit or process such information.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to our Business and Industry" in this annual report on Form 10-K.

companyName: MongoDB, Inc.

ticker: MDB


text: The cybersecurity and compliance department, in conjunction with our Computer Security Incident Response Team ("CSIRT"), designs, implements, and executes continuous monitoring processes for our information systems. Our monitoring programs include the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CSIRT is responsible for the detection and assessment of cybersecurity threats and incidents in accordance with a formal risk assessment matrix established in cooperation with our Cybersecurity Disclosure Committee. This risk assessment matrix establishes a framework for notification of an incident to the Cybersecurity Disclosure Committee and, if appropriate, the Audit Committee or Board of Directors. The CISO also partners with internal functions such as finance, legal, and internal audit, as well as third-party consultants who perform risk-based assessments against the National Institute of Standards and Technology ("NIST") 800-171 Rev2 and Cybersecurity Maturity Model Certification with recommendations, in designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategy, helping ensure such programs and strategy align with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee or Board of Directors.

companyName: TRIUMPH GROUP INC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations,business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: NEVRO CORP


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through its audit committee, which provides oversight of our cybersecurity program as part of its periodic review of enterprise risk management.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: The board provides oversight of cybersecurity risks and has designated primary responsibility to the risk committee which oversees our information security programs, including cybersecurity, and is actively involved in monitoring the progress of key cybersecurity initiatives. Our board and risk committee receive regular updates on the activities and effectiveness of our GIS Program, including reports on incident response plan testing exercises and results of compliance testing and third-party evaluation results. Our CISO provides quarterly, or as needed, reports and updates to our board and risk committee on the company's cybersecurity risk management program and meets with the risk committee at least annually in a private session. The CISO has an indirect reporting line to the risk committee. We also engage with leading professional consulting firms to provide periodic updates to the board on cybersecurity-related risks in the evolving threat landscape and to provide education on best practices for board oversight of our GIS Program.

companyName: CME GROUP INC.

ticker: CME


text: Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. To date, no attempted cyberattack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.

companyName: Envista Holdings Corp

ticker: NVST


text: Our platform is designed to help ensure the security of our data and systems, protect our customers' personal information, and meet the rigorous privacy and security requirements of our Enterprise clients. To that end, we have obtained and maintain the following security and privacy certifications: ISO 27001 and 27018, SOC 2 Type 2 certification, SOC 3 certification, PCI-DSS Level 1 certification, U.S. Department of Commerce Data Privacy Framework certifications, and TRUSTe Enterprise Privacy & Data Governance Practices certification from TrustArc.

companyName: UPWORK, INC

ticker: UPWK


text: AMC Risks Committee These committees provide support to the Company's Board of Directors with respect to information security and cybersecurity matters. In particular, the Risk Committee provides oversight of the Company's risk management, cybersecurity, and operational compliance activities, as well as a means of bringing risk issues to the attention of management.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT. Personnel at all levels and departments are made aware of cybersecurity issues through trainings.

companyName: RAMBUS INC

ticker: RMBS


text: Security Awareness. Annual security training is conducted for all employees, and routine phishing tests are administered routinely. We also post articles regarding common cybersecurity schemes on our intranet for our employees' awareness.

companyName: FNB CORP/PA/

ticker: FNB


text: DTE Energy's Chief Information Officer leads the cybersecurity team and has responsibility for assessing and managing cybersecurity risks. The Chief Information Officer has held this position for over 10 years and has decades of experience in IT, including oversight of information protection security (IPS). The IPS cybersecurity team is also led by two full-time directors with over 40 combined years of industry experience, including (1) the director of cybersecurity operations responsible for the CSDC, identity and access assurance, and cloud security and (2) the IPS director of cybersecurity strategy, risk, and engagement who is also responsible for engagement and outreach to internal and external stakeholders.

companyName: DTE Electric Co


text: The Advisor and its affiliates engage vendors to enhance cybersecurity safeguards and improve incident response and update or replace systems and applications as appropriate to improve data processing and storage management and enhance security. These cybersecurity safeguards include multi-tiered backup protocols, which incorporate immutable backups, embody an innovative approach to data security, providing an additional barrier against ransomware and other cyber threats. Immutable backups ensure that data remains unmodifiable and immune to deletion for a predefined duration, thereby shielding it from unauthorized tampering or access. This technology utilizes sophisticated methods, including immutable storage repositories and ransomware-resistant backup architectures, to uphold the integrity and accessibility of vital data. Through the enforcement of stringent access controls and encryption measures, the resilience and availability of backup data is ensured, empowering an organization to swiftly and securely recover from cyber incidents.

companyName: Lightstone Value Plus REIT V, Inc.


text: The audit committee of the board of directors receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur. Board members receive presentations on cybersecurity topics from the Senior Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, our code of business conduct and ethics expects all employees to safeguard our electronic communications systems and related technologies from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to our Chief Legal and Administrative Officer and the Senior Vice President and Chief Information Officer. Our cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party service providers, suppliers and vendors. Our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments and conducting periodic reassessments during their engagement.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: We rely heavily on IT systems to operate our business, including processing and monitoring a large number of transactions across different markets and multiple currencies. To date, we have not experienced a cybersecurity incident that we deemed to be material. For a discussion of whether and how risks from cybersecurity threats could materially and adversely affect us, including our business, results of operations or financial condition, refer to Item 1A. Risk Factors – "Operational and Industry Risks," which is incorporated by reference into this Item 1C.

companyName: PRA GROUP INC

ticker: PRAA


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.

companyName: DBV Technologies S.A.

ticker: DBVT


text: We conduct regular risk assessments to identify potential cybersecurity threats. These assessments involve evaluating our systems, networks and data for vulnerabilities that could be exploited by cyber threats, through, among other things, vulnerability scanning and penetration testing. Once risks are identified, we implement measures to manage and mitigate these risks. This includes updating and patching our systems, implementing security controls and monitoring our networks for suspicious activity. We have a process in place to respond to any identified threats, which includes containment, eradication and recovery measures. We also monitor and update our cybersecurity risk management strategy to respond to the evolving cyber threat landscape. This includes staying abreast of the latest cybersecurity threats and trends and updating our systems and processes accordingly.

companyName: Frontdoor, Inc.

ticker: FTDR


text: The SDIT or a delegate thereof informs the ERM Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's Cybersecurity Policy and related processes. The SDIT periodically reports to the ERM Committee concerning material risks from cybersecurity threats to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Our partnership with a trusted third-party service provider stands as a pivotal pillar in our cybersecurity strategy. Leveraging their expertise, they have crafted and implemented 58 automated lockdown policies, each strategically designed to create safeguards around our digital infrastructure. These policies serve as a sophisticated array of safeguards, actively working to thwart potential breaches before they can even manifest. Moreover, their commitment to our security extends to continuous monitoring measures that operate round-the-clock. This proactive surveillance ensures that any anomalies or suspicious activities are swiftly identified and addressed, minimizing the window of vulnerability.

companyName: BeyondSpring Inc.

ticker: BYSI


text: The CISO has information technology and information security experience, including enterprise risk management leadership, and holds a Certified Information Security Manager certification from the Information Systems Audit and Control Association (ISACA). The CISO reports to the Chief Information Officer ("CIO"), who is a member of the EMT and reports directly to the CEO. The CIO has extensive experience overseeing and executing technology strategies and implementations in complex, global organizations.

companyName: Hillenbrand, Inc.

ticker: HI


text: The principal role of our board of directors and the Safety Committee, a board-level committee composed solely of independent directors, is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: We recognize that employees play a critical role in maintaining a strong cybersecurity posture. Our Information Governance Policy sets forth the requirements for employee conduct relating to company information and company-managed devices, including relevant privacy, data security and data retention policies. We believe that our Information Governance Policy is aligned with industry best practices and applicable legal and regulatory requirements. In addition to our Information Governance Policy, we conduct regular cybersecurity training programs emphasizing the importance of cybersecurity awareness. These programs address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness exercises, and there is a range of consequences for underperformance that includes termination.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: We recognize that our third-party vendors can be subject to cybersecurity incidents which may impact us. To mitigate third-party risk, vendor access to network resources is reviewed, authorized, and monitored by our IT resources, including requirements for our third-party vendors' cybersecurity, estimated termination dates for network access, and regular reviews of all third-party vendor accounts and after access is granted, it is managed through various security tools. Third-party IT vendors are also subject to additional diligence such as questionnaires, inquiries, and relevant certifications.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Our business heavily relies on various IT and application systems, which contain proprietary and confidential information about our operations, employees, customers, and our customers' customers, including personally identifiable information. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. Our process is supported by both management and our Board of Directors. Organizationally, our businesses are structured as three operating and reportable segments: Ting, Wavelo and Tucows Domains. These segments are decentralized; management and cybersecurity resources are organized both at the parent company level and within each decentralized segment. Each segment has dedicated liaisons for cybersecurity, compliance, and risk management activities.

companyName: TUCOWS INC /PA/

ticker: TCX


text: Our Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee receives periodic reports from management on our cybersecurity risks.

companyName: KILROY REALTY CORP

ticker: KRC


text: The Company continues to invest in its cybersecurity program and performs assessments to identify opportunities to enhance training and awareness and improve processes and technology used to identify, prevent, detect, respond, and recover from cybersecurity incidents.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: In the event of a potentially material cybersecurity event, pursuant to our incident response plan, in addition to notification and involvement of our General Counsel, Chief Financial Officer and Chief Executive Officer, among others, the Audit Committee would be notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: We use third-party vendors to review and test our IT systems and utilize our internal team of experienced personnel to evaluate and assess the efficacy of cybersecurity systems and to make recommendations and identify opportunities for improvements to our cybersecurity risk management program. We report the results of these assessments to our Audit Committee regularly and to our Board of Directors at least annually.

companyName: PRICESMART INC

ticker: PSMT


text: We have dedicated cybersecurity resources led by our Chief Information Officer ("CIO"), who regularly provides reports on cybersecurity to our executive officers, including the CEO and CFO. Our CIO has significant experience in the cybersecurity and IT fields and holds multiple degrees, including a Bachelor of Science in Information Science and a Master of Business Administration. Additionally, our CIO is a Certified Information Security Manager.


text: Our CSIRP provides clear communication protocols, including with respect to members of management, including the members of the IRT, CEO, CFO, CIO, General Counsel, Audit Committee, and external counsel, particularly with respect to legal obligations to report the incident to tenants, regulators, and law enforcement and, if applicable, our SEC reporting obligations.


text: Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees and management.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Board oversees Celcuity's management of risks arising from cybersecurity threats. Our management team is implementing processes for delivering periodic briefings to the Board on material cybersecurity risks that are pertinent to our business operations. Additionally, we have processes to promptly notify the Board of a significant cybersecurity incident and to inform the Board of remediation progress, as appropriate.

companyName: Celcuity Inc.

ticker: CELC


text: To date, cybersecurity threats have not materially affected our Company, including our business strategy, results of operations or financial condition. We are unaware of any ongoing or previous cybersecurity incidents.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: The Company provides regular, mandatory training for applicable personnel on cybersecurity threats to help them identify, avoid and address cybersecurity threats and to communicate the Cybersecurity Program, including applicable policies, standards, processes and practices.

companyName: BORGWARNER INC

ticker: BWA


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the heading "We face risks associated with security breaches or cyberattacks," included as part of our risk factors disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: SYNAPTICS Inc

ticker: SYNA


text: The IT Manager works closely with the Company's management and executive team to determine the Company's IT-related needs, to evaluate the sufficiency of the Company's data-governance policies and practices, to keep the Company's management informed of notable cybersecurity-related updates, to review its security-related policies, and to identify ways to strengthen the systems and procedures implemented by the Company to detect, assess, and manage data risks.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Information Technology ("IT") Risk assesses technology risks and controls, evaluates application systems' conformance to internally defined and approved security standards, coordinates audits and examinations for IT and IT security, as well as tracks open risk issues and exceptions. IT Security defines security policies and standards, conducts security awareness and training, evaluates security configuration and assesses vulnerability risk.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Board of Directors' Oversight of Risks from Cybersecurity Risks Cybersecurity risks are overseen by our full Board of Directors with input from the Audit Committee, which reviews the results of internal audit assessments and tests related to cybersecurity. As part of this oversight, the Board of Directors and the Audit Committee meet regularly to discuss the progress of ongoing initiatives and to seek coordination between enterprise stakeholders. At these meetings, our Chief Information Officer ("CIO"), who oversees the Company's cybersecurity program, along with key subject matter experts, as necessary, review current and emerging cybersecurity-related threats as well as key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance in countering these threats. Based on the information provided through these various processes, our Board of Directors evaluates the risks facing us and provides guidance to management on our risk management strategy.

companyName: HF Sinclair Corp

ticker: DINO


text: Spire's Board of Directors ("Board") recognizes the significance of cybersecurity risk and has therefore retained oversight of cybersecurity rather than delegating this risk to a committee of the Board. Every regular meeting of the Board includes a cybersecurity report provided by the Company's Chief Information Officer and the Chief Information Security Officer. These reports focus on developments within the Company's cybersecurity program and provide an update on any cybersecurity events or concerns. In 2024, the Board added a new director with expertise in cybersecurity to assist the Board to appropriately oversee the Company's efforts.

companyName: SPIRE INC

ticker: SR


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • The utilization of Microsoft 365 services for email, data storage, Identity Provider ("IdP") for Single Sign-On ("SSO"), and other technical controls such as remote user and device management; • Microsoft 365 configurations which are aligned with security and industrial standards, including automatic risk management mechanisms and alert notifications for our Information Technology ("IT") team; • A zero trust approach to cybersecurity focused on preventing and limiting damage in the event that a malicious actor gains access to our network and operating on the principle "never trust, always verify," continuously authenticating and authorizing users and devices that seek to obtain access to our systems and data; • Privileged access management protocols that require user access requests to receive formal, documented approvals with specific business justifications and, following receipt of such approvals, the provision of only the minimum access necessary for the approved purpose; • Regular monitoring of our Microsoft security score, which serves as a benchmark for our security posture and guides our continuous improvement efforts; • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, including annual external assessments and vulnerability scanning; • A security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Regular security awareness training sessions for users, including simulated phishing email campaigns managed by KnowBe4, a third-party leader in security awareness training; • A disaster recovery program, including business continuity procedures in the event of a disaster, backup procedures, failover features with up-to-date SaaS services, and data recovery protocols; and • A third-party risk management ("TPRM") process to safeguard against risks posed by service providers, suppliers and vendors, based on our assessment of their respective criticality to our operations and respective risk profile, encompassing risk identification, due diligence and risk assessment prior to engagement, and categorization of third parties based on risk levels.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: Our Chief Information Officer and our Senior Director of Cybersecurity each have more than two decades of experience in technology and cybersecurity. The cybersecurity team has related academic degrees, multiple certifications, and real-world experience managing cybersecurity incidents and risks and is responsible for building out the materials for review by leadership.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our, or our vendors', information technology systems or data is or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to regulatory investigations or action; litigation; fines and penalties; interruptions to our operations such as our clinical trials; claims that we breached our data privacy and security laws; harm to our reputation; a loss of customers or sales; and other adverse consequences."

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Our information technology and security, or IT, team and risk committee, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using a multi-faceted approach including use of automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, and evaluating reported threats as well as the industry's risk profile.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents.

companyName: Dave Inc./DE

ticker: DAVE


text: Anu Pillai, our Chief Technology Officer, leads our cybersecurity efforts. She has been serving in her current role since March 2021. Ms. Pillai has over 20 years of experience serving companies across multiple industries in senior management roles, within information technology and as such has developed substantial experience in cybersecurity, among other areas. Team members who support our Chief Technology Officer have similar broad experience and expertise in information security, including cybersecurity.

companyName: Direct Digital Holdings, Inc.

ticker: DRCT


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Directors as part of periodic reports.

companyName: Fidelity Private Credit Co LLC


text: Information technology (IT) is critical to many of our operating activities and is subject to security threats and increasingly sophisticated cyber-attacks.

companyName: XMax Inc.

ticker: XWIN


text: Core activities supporting the Company's strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to firm operations, at least annually or whenever there are material changes to our systems or operations. As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing. We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements. We store firm data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Inc.

ticker: TPG


text: The Audit Committee, in addition to the Company's Chief Financial Officer, General Counsel and Chief Compliance Officer, oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee, Chief Financial Officer, General Counsel and Chief Compliance Officer on the effectiveness of the Company's cyber risk management program, generally on a quarterly basis. In addition, cybersecurity risks will be reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: As of the date of this Annual Report, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's results of operations and/or financial condition. See "Item 1A. Risk Factors" for additional information about cybersecurity risk.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: Our global information security team led by our CISO works in coordination with these management committees and other cross-functional teams and is principally responsible for overseeing our information security strategy, working collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents when they arise. Our global information security program is operated on a 24/7 basis to address risks from cybersecurity threats and to respond to cybersecurity incidents globally.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Cyber Risk Management and Strategy We, under the oversight of the audit committee of our board of directors, have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats. Our risk management is supported by various tools and technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address risks from cybersecurity threats.

companyName: Cabaletta Bio, Inc.

ticker: CABA


text: Our Cybersecurity Compliance and Disclosure Committee (CCDC), which is further described below, is chaired by our CIO and includes the General Counsel of A-Mark and other representatives from the Company and our subsidiaries, including top-level management, to ensure enterprise-wide implementation and consistent application of the Company's data security policies and procedures. The CCDC regularly enlists subject matter experts to assist where necessary.

companyName: Gold.com, Inc.

ticker: GOLD


text: While we devote resources to implement and maintain security measures to protect our systems and data, these measures cannot provide absolute security against a cyberattack. In such an event, the insurance coverage we maintain may be inadequate to cover claims, costs, and liabilities relating to cybersecurity incidents.

companyName: Ispire Technology Inc.

ticker: ISPR


text: The Company has also developed a comprehensive set of key risk metrics to evaluate ongoing cybersecurity threats and the security risk exposure. These metrics are used for threat trending, identifying attack vectors, and determining the effectiveness of controls. Key risk metrics are provided to management monthly and reported through the Governance Model to the Board.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: The Bank's Information Technology ("IT") and Compliance and Risk Management ("C&RM") teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. Members of these teams have a wide variety of relevant certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certification in Risk Management Assurance and Certified in Risk and Information Systems Control. Our C&RM team provides risk management oversight to the IT team. The Bank's Internal Audit function, using internal and outside expertise, independently oversees, reviews and validates the IT and C&RM activities and reports to the Board of Directors' Audit Committee on the effectiveness of governance, risk management and internal controls.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: President and Chief Executive Officer is responsible for overseeing our cybersecurity processes and works directly with third party service providers, as applicable, to identify, assess and manage the Company's cybersecurity threats and risks. In doing so, he seeks to identify and assess risks from cybersecurity threats in a manner appropriate for a company of comparable size and resources.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: SoundHound designates the Information Security Management Committee as responsible for assessing and managing cybersecurity risks. Committee members possess professional experience or backgrounds presenting relevant experience or capacity to address those matters within the scope of the Committee's responsibility, including senior executives, department leaders, and subject matter experts. Committee members are familiar, or have the ability to quickly gain familiarity, with major technology platforms employed by the Company; have knowledge of technological ecosystems and challenges confronted in current or emerging business environments; have the capacity to understand new or emerging technologies and cyber security threats; are familiar, or have the ability to quickly gain familiarity, with information security principles, privacy regulations, standards, and guidelines; and possess experience relating to enterprise risk management and process.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Risk Management Strategy We recognize the critical importance of effectively managing cybersecurity risks to protect our businesses, intellectual property, employees, and customers. We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls.

companyName: Enpro Inc.

ticker: NPO


text: The Company's Chief Information Officer has served in various roles in information technology and information security for over 29 years and holds degrees in Business Information Systems and Accounting. The Vice President of Risk Management has served in various roles in information technology and information security for over 18 years, holds an undergraduate degree in Accounting and a Master of Business Administration degree, and is a Certified Public Accountant.

companyName: WillScot Holdings Corp

ticker: WSC


text: With respect to cybersecurity risks, we have invested and continually invest in new cybersecurity services, technologies, and capabilities. On an ongoing basis we provide our employees with comprehensive cybersecurity awareness training around phishing, malware and other cybersecurity risks, all in a manner reasonably intended to educate employees to safely avoid cyber attacks and mitigate the risk of employee related security breaches. In support of our cybersecurity program, our systems and services undergo regular reviews by management to determine if any insufficiencies in cybersecurity exist.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: Risk Management & Strategy Cybersecurity is integral to our risk management approach. We are reliant on information technology, and any interruption, failure, or security breach-including cybersecurity incidents-could adversely impact our operations and business continuity.

companyName: MASIMO CORP

ticker: MASI


text: Board and Management Oversight Our Board of Directors has delegated to its Audit and Risk Management Committee (the "Audit Committee"), which consists of all of our non-management directors, the authority and responsibility to oversee our company's compliance program, including our cybersecurity program. Accordingly, the Audit Committee oversees our approach to cybersecurity risk management and plays a critical role in the governance of our cybersecurity risk management program.


text: As mentioned above, our management team meets with the Audit Committee at least twice a year to review and discuss risk exposure related to our IT systems and data privacy. The purpose of these management updates is to inform the Audit Committee of any potential risks related to our IT systems and data privacy, as well as any relevant mitigation or remediation tactics being implemented. The management team and/or Audit Committee, in turn, regularly provide data protection and cybersecurity reports to the full Board of Directors.

companyName: Century Communities, Inc.

ticker: CCS


text: We use third-party service providers to perform a variety of functions throughout our business application providers, hosting companies, contract research organizations (CROs), contract manufacturing organizations (CMOs), supply chain resources, and other business-related SaaS platforms. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes conducting risk assessments of certain vendors, reviewing certain vendors' security assessments, reviewing reports of certain of our vendors' security, and reviewing the written information security program of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM