text: Security Council Committee. As part of our cybersecurity governance framework and for purposes of establishing and maintaining our ISSP, we have established an SCC, which consists of members of our management team and IT department. The SCC is subject to oversight by the Service Center Board, the Risk Committee, and the Board. The Risk Committee of the Board works directly with the SCC to develop and implement our policies and procedures concerning cybersecurity and data protection. As stated in the Risk Committee Charter, our Risk Committee reviews management reports on the adequacy of our data-governance activities and IT security program; evaluates risks related to customer information, significant outsourcing with third parties or Vendors, and operational outsourcing arrangements; reviews, evaluates, and updates our data-governance framework, processes, and systems for identifying, assessing, and managing data risks that impact critical business operations; and reviews and evaluates our overall risk-management framework.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Mr. Fabbri, in coordination with our Board of Directors, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Mr. Fabbri and Ms. Garrison monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to our Board of Directors and applicable regulatory authorities when appropriate.

companyName: Farmland Partners Inc.

ticker: FPI

secItem: Item 1C


text: Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of our incident response plan. As discussed above, our CISO reports to the Compliance and Regulatory Affairs Committee, about the risks from cybersecurity threats among other cybersecurity related matters and meets regularly with our Chief Technology Officer.

companyName: Evolent Health, Inc.

ticker: EVH


text: The SVP & CRO receives reports on cybersecurity threats from the CISO who regularly reviews threat intelligence from various sources including the FBI and Department of Homeland Security (DHS). The SVP & CRO, in conjunction with management, also regularly reviews risk management measures implemented by us to identify and mitigate data security and cybersecurity risks. The significance of these threats is assessed by the SVP & CRO and his team and reported, as appropriate depending on the significance, to the Audit Committee.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Our team that is responsible for assessing and our material risks from cybersecurity threats, including our Chief Operating Officer, Chief Financial Officer, and Senior Director, Head of IT Security and Compliance, has more than a combined 30 years of risk management experience. Our team's experience includes the Senior Director, Head of IT Security and Compliance, who has an extensive (+25 years) track record on cyber- and IT risks management, developing security and compliance programs and frameworks and leading IT security organizations, our Chief Finance Officer who, serving that role at Merus and prior companies and serving as a previously Audit Committee chairperson for Merus and current chairperson at Kala Pharmaceuticals, has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, while evaluating strategies to gain a high level of cyber security, and our Chief Operating Officer, who manages the IT organization at Merus and has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, and review U.S. jurisprudence concerning protection of confidential information and trade secrets and has participated in trainings on cybersecurity threat defense and response, and cybersecurity strategies from a legal perspective.

companyName: Merus N.V.


text: The Information Security team serves as the Bank's dedicated cybersecurity incident response team. Cybersecurity incident response is a sub-section of the Bank's Incident Response Plan. The Information Security team handles the technical aspects of the Bank's response to a cybersecurity incident. Escalation instructions are included in the Plan for engaging resources outside the Information Security team. The Board is notified immediately of cybersecurity incidents, as per the incident response instructions.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Due to the nature of our business, we face a variety of potential cybersecurity risks that are ever evolving and include unauthorized access to our systems and data, disruption of our online game services, theft of intellectual property, and third-party risks as a result of our use of various third party service providers and cloud service providers. The Company's risks related to our end user data is borne by our platform partners as we do not maintain any sensitive information of our players within our infrastructure. There have been no cybersecurity threat events identified during the year ended December 31, 2024, which have resulted in a material incident, or are reasonably likely to result in a material impact on our business strategy, results of operations or financial condition. For more information regarding risks relating to intellectual property and cybersecurity related attacks, see Item 1A of Part I, "Risk Factors — Risks Related to Intellectual Property" and "Risk Factors — Risks Related to Our Business and Industry" of this Annual Report.

companyName: Snail, Inc.

ticker: SNAL


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. Blackstone's CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Blackstone's CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as BREIT, on technology-related matters.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Our Incident Response Team ("IRT"), which includes members from various functional areas within the Company, including our data center operations, software, internal information systems, customer support, legal, and marketing departments, which are responsible for managing and mitigating any cybersecurity incidents at the Company. This team operates under the policy procedures that are outlined in our Cybersecurity Incident Response Plan.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: The Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness. Certain processes involve the use of third parties. A summary of each process is below.

companyName: FNB CORP/PA/

ticker: FNB


text: threat" means any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Trans American Aquaculture, Inc

ticker: GRPS


text: The Board exercises its oversight of material risks from cybersecurity threats through the Board's Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee. The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to the Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. The Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by the Cybersecurity Risk Committee, with material issues raised with our Board.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: The Audit Committee receives periodic reports from our Chief Digital Officer on our cybersecurity risks and risk management program as well as presentations on cybersecurity topics as part of the Audit Committee's continuing education on topics that impact public companies. In addition, management updates the Audit Committee, as necessary, regarding any potentially material cybersecurity incidents.

companyName: Cerevel Therapeutics Holdings, Inc.


text: While we have not experienced a cybersecurity incident that has materially affected our business, results of operations or financial condition, see the risk factor entitled "We could be affected by cyberattacks or breaches of our information systems, any of which could have a material adverse effect on our business" in Item 1A — Risk Factors for information about the cybersecurity risks we face.

companyName: RXO, Inc.

ticker: RXO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the IT Lead. The IT Lead has 3 years of experience in roles that include oversight of cybersecurity risk management programs.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: We follow a formal cybersecurity incident response policy, which provides for use of third-party service providers where circumstances dictate it is necessary. Our cybersecurity incident response policy incorporates recommendations from the International Organization for Standardization ("ISO") and the NIST, and it includes proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents, we undertake the below activities: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual risk assessment and review of our consumer facing policies, business changes and statements related to cybersecurity, or more frequently as needed; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees and contingent workers; • conduct annual cybersecurity management and incident training for employees and contingent workers involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contingent workers with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data in accordance with local laws and regulations; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and • use an internal well-tested incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident. Where circumstances dictate the use of third-party service providers, such services include regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; evaluation and approval of our critical business partners and vendors; and participating in incident response processes. As part of our cybersecurity incident response policy, we identify, evaluate and mitigate any risks posed from engaging with any third-party service provider. As of December 31, 2024, we are not aware of any cybersecurity incident in the past year that materially affected or was reasonably likely to materially affect our operations, business, results of operations, cash flows or financial condition.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, the Federal Financial Institutions Examination Council ("FFIEC"), and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Technology Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 12 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its President, Chief Compliance Officer, Chief Operating Officer, who acts as chairperson of the ORC, Chief Credit Officer, Chief Financial Officer - Investment Funds and Chief Financial Officer - Management Company. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.

companyName: Monroe Capital Income Plus Corp


text: Dana has an established cybersecurity awareness training program. Formal training on topics relating to cybersecurity is mandatory at least annually for all employees with access to the Company's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Training is supplemented by phishing awareness campaigns.

companyName: DANA Inc

ticker: DAN


text: Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Kronos Bio, Inc.


text: A fundamental part of risk management is not only understanding the risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for the Company. The involvement of the full Board in setting the Company's business strategy is a key part of its assessment of management's tolerance for risk and also a determination of what constitutes an appropriate level of risk for the Company.

companyName: BADGER METER INC

ticker: BMI


text: The Company uses a multiple lines of defense management approach to managing cybersecurity. The Company's cybersecurity operations function is headed by the Vice President Information Security Officer ("ISO") who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The ISO leads a team of security professionals in safeguarding the Company's critical data, systems, and assets against threats, breaches, and attacks. The ISO is responsible for ensuring the confidentiality, integrity, and availability of information assets.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: External Assessments. Our cybersecurity program is regularly assessed by consultants and third-party auditors. These assessments include information security maturity evaluations, audits, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, our board of directors, and our Audit Committee. We adjust our cybersecurity processes based on these results. We have obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us. Information about such certifications can be found on our website.

companyName: Elastic N.V.

ticker: ESTC


text: As of the date of this report, we have not experienced a cybersecurity incident that has resulted in a material effect on our business strategy, results of operations or financial condition. Despite our efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of the Company's or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm; damage to our brand; lost sales; physical damage to facilities; physical harm to individuals; reduced demand; loss of intellectual property rights; significant costs; or the Company being subject to government investigations, litigation, fines or damages. For additional information, see Part I, Item 1A, "Risk Factors—Operational Risks—Information technology systems failures, data security breaches, cybersecurity attacks or network disruptions have harmed us in the past and could compromise our information, disrupt our operations and expose us to liability, which may adversely impact our operations."

companyName: CABOT CORP

ticker: CBT


text: To educate our management, employees, and consultants, and help mitigate the risk of human failure in exposing our Information Technology systems to cybersecurity threats from bad actors; management, employees, and consultants are required to complete on-line cybersecurity training annually. We also provide regular reminders to employees regarding suspicious emails or other communications and conduct periodic phishing simulations and remedial spot testing and training to reinforce recognition and response techniques.

companyName: FTI CONSULTING, INC

ticker: FCN


text: The Vice President of Security and Privacy Engineering leads our global information security organization responsible for overseeing the Netflix information security program. Our VP of Security and Privacy Engineering has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.

companyName: NETFLIX INC

ticker: NFLX


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are incorporated into our overall enterprise risk management framework. We take a cross-functional approach to cybersecurity risk, which includes input from information security, information technology, legal, compliance, internal audit, finance, and operations, as appropriate. Under the oversight of our Board, including its Audit and Finance Committee, our senior management, information security team, and our Cybersecurity Risk Committee (comprised of key executive and senior leaders from primary corporate functions) devote resources to cybersecurity and implement risk management processes designed to adapt to the changing cybersecurity landscape, respond to emerging threats and proactively coordinate our people, processes and procedures to respond to cybersecurity incidents. We regularly assess the threat landscape and cybersecurity risks. Our internal audit team reviews enterprise risk management-level cybersecurity risks as part of our overall enterprise risk management framework. In addition, our information security team oversees regular monitoring of our information technology and other operating systems that are designed to detect potential security incidents. We have operationalized a written incident response plan designed to assess, identify and coordinate among various functions the response activities to cyber incidents and determine the impact of any such cybersecurity incidents that may jeopardize the confidentiality, integrity or availability of our information systems or adversely affect our business and information systems. In the event of a significant cybersecurity incident, the incident response plan provides guidance on roles, responsibilities, procedures and reporting processes.

companyName: PATTERSON COMPANIES, INC.


text: We maintain a cybersecurity program, designed to proactively identify, assess, manage, mitigate, and respond to cybersecurity threats. Our Cybersecurity Organization develops, implements, and maintains this program, which is documented in our global cybersecurity policy. The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information technology and is aligned to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. Cybersecurity is an important and integrated part of our enterprise risk management program that identifies, monitors and mitigates business, operational and legal risks. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threats alongside other company risks as part of our overall risk assessment process. In addition, we perform an external, specific cybersecurity risk assessment every eighteen months. Included in our management of cybersecurity risk is our annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company. Our Chief Financial and Administrative Officer has primary responsibility for overseeing our information systems and information technology resources, including risks from cybersecurity threats. To assist our Chief Financial and Administrative Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial and Administrative Officer, the principal of a third-party, managed security service provider (an "MSSP"), our Vice President of Risk Management, our Chief Accounting Officer, our Senior Vice President of Human Resources and certain other members of our information technology staff and property management. This committee meets on a quarterly basis, with additional meetings held as-needed throughout the year, to: • monitor emerging data protection laws and implement changes to our processes designed to comply with these laws; • identify and assess material risks from cybersecurity threats; • provide guidance on our cybersecurity strategy development and implementation; • ensure that regular risk assessments and appropriate mitigation strategies are in place; • ensure the performance of regular vulnerability and penetration testing and remediation of findings; • oversee the implementation and management of cybersecurity-related tools such as security information and event management systems; and • review relevant service organization controls reports for the MSSP that serves as our Security Operation Center; and • require training and security awareness programs for our employees.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to our Materiality Assessment Team, comprised of members of management. In addition, our cybersecurity incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Kura Oncology, Inc.

ticker: KURA


text: As part of our overall risk management system, we monitor and test our safeguards and we train our relevant employees on these safeguards, in collaboration with our third-party IT provider and management. Since users are typically the weakest link in any information system, we periodically train all our employees on good cybersecurity practices, including password management, phishing prevention, and other security awareness issues. We have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: Cybersecurity risks are integrated into our overall ERM, and our Chief Information Officer assesses the trends and need for additional mitigations on a quarterly basis. Our main concerns are (i) the unauthorized exfiltration of personal information pertaining to Axcelis employees, (ii) the unauthorized exfiltration of confidential business or technical information, and (iii) an inability to use our business systems for a period of time following a cybersecurity event.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Our CTO and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provide periodic reports to the technology and audit committees of our board of directors, which evaluate our overall enterprise risk.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us.

companyName: ContextLogic Inc.


text: The Bank conducts due diligence prior to engaging third-party service providers which have access to the Bank's networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Bank's policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Primis conducts ongoing monitor of third-party service providers/vendors on a risk-based approach.

companyName: Primis Financial Corp.

ticker: FRST


text: Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.

companyName: Aeluma, Inc.

ticker: ALMU


text: Management is responsible for the operational oversight of the company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: Our CTO has direct responsibility for cybersecurity and overseeing the Company's cybersecurity strategy, policies, standards and processes. Our CTO has more than 25 years of experience developing user-centric consumer marketplaces and artificial intelligence products and has held various leadership roles in product development, product design and data science. The CTO is supported by two senior risk, compliance, and security leaders who engage regularly with the CTO to manage cybersecurity and compliance risks. Additionally, the Company's cybersecurity team is comprised of experienced information security professionals dedicated to protecting the company's assets. The CTO receives regular updates on security, compliance risks and initiatives and provides a quarterly cybersecurity risk and incident review to GoHealth's Internal Compliance Committee. This committee includes cross-functional senior leadership members, including C-suite executives and personnel from legal, compliance and internal audit.

companyName: GoHealth, Inc.

ticker: GOCO


text: Additionally, the ISO provides the ERC with regular reports on the status and effectiveness of the Programs and risk management activities, as well as cyber and IS issues that may affect the Company.

companyName: LAKE SHORE BANCORP, INC.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date we have not experienced any cybersecurity incidents that have materially affected our business strategy, financial condition, or results of operations. The cybersecurity threat landscape continues to evolve and escalate. We are subject to ongoing risks from cybersecurity threats that could materially affect our business strategy, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: Clearfield, Inc.

ticker: CLFD


text: We are in the process of formalizing a cybersecurity risk management program tailored to our current scale and evolving operations. Our risk management efforts are focused on foundational protections, including the use of secure infrastructure (e.g., cloud-hosted environments via Amazon Web Services), hardware-based protections (e.g., exclusive use of Apple systems by key internal personnel such as our Chief Executive Officer), and security features such as multi-factor authentication (MFA) for key accounts and tools. We also maintain a cyber liability insurance policy intended to mitigate potential financial impacts arising from cyber threats.

companyName: Brag House Holdings, Inc.

ticker: TBH


text: Our programs are focused on building digital trust through sound oversight of cybersecurity and data privacy protections and the responsible use of data and technology. We operate a CFC, and we have a cross-functional approach to addressing cybersecurity-related risks through the functional compliance structures in our digital technology and legal organizations with oversight from the corporate audit and controllership functions. The cybersecurity and legal functions employ full time cybersecurity and privacy roles with expertise in managing cybersecurity and privacy compliance and risks and responding to incidents.

companyName: Baker Hughes Co

ticker: BKR


text: We foster a culture of cybersecurity awareness through regular phishing simulations, enterprise-wide security training, employee education on safe technology practices, and information security policies. We continue to evaluate cybersecurity risks and enhance our strategy to safeguard our operations and data as part of our commitment to operational resilience and innovation.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: Assessment and Management conduct regular risk assessments to identify and evaluate potential cybersecurity threats and vulnerabilities. Our risk management framework is aligned with industry standards such as the NIST Cybersecurity Framework (CSF) and ISO 27001. We continuously monitor and update our cybersecurity measures to address emerging threats and ensure the protection of our assets.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security controls and leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an independent industry recognized security service provider to conduct an annual red team assessment of our security controls, as well as third-party penetration testing of our information systems. The results of these assessments are reported to senior management and the Audit Committee of the Board of Directors.

companyName: ManpowerGroup Inc.

ticker: MAN


text: Our Chief Executive Officer ("CEO") and CFO are responsible for assessing and managing our material risks from cybersecurity threats, our overall cybersecurity risk management efforts, and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: We employ risk management functionality and document enterprise information security risks. Our information security team maintains documentation to assess risk and mitigate cyber risk in alignment with risk (understanding general impact and likelihood of risk exploitation), resources, and business process. Cybersecurity risks are tracked throughout the risk management process from risk mitigation to ultimate completion of remediation. From time-to-time significant risks may be escalated to the executive management team and/or the Board in the existing executive management processes for cybersecurity and Board briefing schedule.

companyName: Altair Engineering Inc.


text: Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance. We may in the future engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our existing cybersecurity processes.

companyName: Bowen Acquisition Corp


text: Board of Directors facilitates ongoing information exchange, including updates on SEC requirements for reporting on cybersecurity risk management and improving and standardizing disclosures related to cybersecurity incidents. Management regularly updates the Board on IT matters, including cybersecurity.

companyName: Guardion Health Sciences, Inc.


text: The Board oversees our processes for identifying and mitigating risks, including cybersecurity risks. Our management periodically briefs the Board on our cybersecurity and information security policies and plans. In the event of an incident, we have developed an incident response plan, which sets forth the steps to be followed from incident detection and assessment to mitigation, recovery and notification and reporting, including notifying functional areas, as well as senior leadership and the Board, as appropriate.

companyName: HEALTHY EXTRACTS INC.

ticker: HYEX


text: Board Governance and Management The Executive Vice President ("EVP") & Chief Information Officer ("CIO") and the SVP of Enterprise Strategy and Execution provide quarterly written and in-person updates on the strength of our cyber risk control environment, emerging cyber threat issues, and the results of external assessments by outside security consultants and assessors to the Board's Risk Committee. The Board's Risk Committee oversees our ERM framework and practices and assists the Board in overseeing our operational activities, including the Company's information technology security program, and identifying and reviewing related risks.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: Procedures Governing our Third-Party Vendor Relationships. Similar to our governance approach with respect to responding to cybersecurity incidents, we have implemented a layered, collaborative governance system to manage our third-party Vendor relationships and to implement our Vendor Management Policy. Prior to working with any Vendor, we conduct a comprehensive security screening to evaluate the Vendor's security protocols and identify any potential vulnerabilities that could compromise our sensitive data. At least annually, we also perform a security assessment of the Vendor to identify any change in the Vendor's security posture that may negatively impact the security of our information systems. Our CISO or other designated IS personnel oversees and makes a final recommendation regarding the Vendor security assessments, determines the necessity of Vendor site visits, and coordinates and provides a final report on any site visit that occurs. Our Vendor relationships are monitored by our Vendor Management Department, the day-to-day operations of which are led by our Vendor Manager. In coordination with the applicable Business Unit Manager, the Vendor Manager categorizes and ranks the risks presented by our Vendors, performs Vendor due diligence, and provides periodic reports to our Board and Risk Committee concerning Vendor risk management. Before entering into any Vendor contract, the Business Unit Manager that will be contracting for the Vendor's service or product must perform a thorough risk evaluation. In addition to working alongside the Vendor Manager to categorize and rank Vendor risks, the Business Unit Manager participates in contract review and negotiations, establishes performance-monitoring controls, and completes Vendor reviews. The CISO or other designated IS personnel may participate with the Business Unit Manager in contract negotiations as needed.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: The CISO leads the Company's cybersecurity department. The CISO reports to the Chief Technology and Operations Officer and is a member of the Enterprise Risk team and the Company's Disclosure Committee. The CISO has over 20 years of cybersecurity and information security risk compliance and threat analysis experience. Prior to joining the Company in 2023, the CISO served as Chief Security Officer for a national telecommunications service provider. Under the direction of the CISO, the Company's Cybersecurity department analyzes cybersecurity and resiliency risks to the Company's business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term strategies, which are executed through a collaborative effort within Technology, Cybersecurity and Business Resiliency and are communicated to the Risk Committee of the Board of Directors on a regular basis.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: As of the date of this Annual Report, we have not yet adopted a formal, written cybersecurity risk management policy or enterprise-wide cybersecurity governance framework. However, we are aware of the growing risks associated with cybersecurity threats and are in the early stages of assessing and developing appropriate controls to identify and mitigate such risks in proportion to our size, scale, and operational complexity. We intend to implement a formal cybersecurity risk assessment and governance policy by Q4 2025. This process will include third-party vendor risk assessment, incident response protocols, and reporting mechanisms to management and the sole director.

companyName: Arculus System Co., Ltd.

ticker: AQLS


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. On occasion, the Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board and Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: FARO TECHNOLOGIES INC


text: We have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers. Our approach is tailored based on the types of services provided and the extent and type of data accessed or processed by a third-party vendor. For critical vendors who will have access to our systems or data, we diligence their cybersecurity practices prior to engagement, including requiring responses to standardized information gathering questionnaires. We may conduct additional reviews of certain vendors depending on criticality or risk. In addition, where we consider it to be appropriate, we seek to include in our contractual arrangements with certain of our third party vendors provisions addressing best practices with respect to data and cybersecurity, including the right to audit and test their compliance with these contractual requirements.

companyName: Hamilton Lane INC

ticker: HLNE


text: Under the direction of our CIO, our CISO oversees the development and implementation of our enterprise-wide cybersecurity risk management program, ensuring the protection of both enterprise and operational technology systems. Our CISO joined the Company in 2025 with an extensive background in cybersecurity strategy, governance, risk, compliance, and data protection. Prior to joining Air Products, our CISO spent over 25 years in executive security and operations management across the industrial manufacturing, software, and financial services industries. Our CISO maintains professional certifications in cybersecurity and information management, including as a Certified Chief Information Security Officer, Certified Information Systems Security Professional, and Certified Information Systems Manager.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: In the normal course of business, we experience cybersecurity threats and attempted breaches of our systems and network. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. We have not experienced any cybersecurity incident and the risks presented by cybersecurity threats have not materially impacted our business strategy, results of operations or financial condition. However, even well-designed and implemented cybersecurity programs cannot completely eliminate cybersecurity threats, and we cannot guarantee that such events or material impacts will not occur in the future.

companyName: HAWKINS INC

ticker: HWKN


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of cybersecurity risks and potential related impacts on the Company, refer to the risk factors in Part I, Item 1A. "Risk Factors," including "If a material cybersecurity or other security breach impacts our services, systems, supply chain, or end-user customer systems, or if stored data is improperly accessed, our business could suffer significant harm."

companyName: NetApp, Inc.

ticker: NTAP


text: The Company has established processes to assess, identify, and manage risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board through our Audit Committee, along with our executive management.

companyName: CITIUS ONCOLOGY, INC.

ticker: CTOR


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST as well as by engaging experts to attempt to penetrate our information systems. To provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Quantum-Si Inc

ticker: QSI


text: As part of its approach, the Company conducts varied due diligence on its key technology vendors to review their cybersecurity risk profiles and scores. This includes pre-contract award due diligence reviews of such vendors and cyber and information security requirements within its vendor contracts. Additionally, the Company leverages independent, third-party services to monitor the cyber and information security posture of key suppliers and vendors. The Company's quarterly information security update to the Chief Executive Officer and Chief Financial Officer includes an update on the results of these reviews.

companyName: Matson, Inc.

ticker: MATX


text: The Board of Directors has delegated responsibility for cybersecurity risk oversight to the Audit Committee, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, and IT risks or exposures, and the Company's policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board of Directors on such matters. The Chair of the Audit Committee has expertise in risk management which includes IT and cybersecurity.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: As mentioned above, management has formed an IT Committee consisting of the Chief Executive Officer, Chief Financial Officer, and the Vice President of Information Technology to review and discuss information security matters and cyber security risks. The committee meets at least twice a year and reports to the Board of Directors as needed.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Our board of directors has delegated oversight of our company's cybersecurity risk management to our audit committee. The audit committee, pursuant to the audit committee charter, is responsible for reviewing our company's information security and technology risks (including cybersecurity), including high-level review of the threat landscape facing our company and our company's strategy to mitigate cybersecurity risks and potential breaches. We have recently implemented a process for our Senior Vice President of Finance and Administration and/or our Chief Financial Officer, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program and on an as needed basis.

companyName: ImageneBio, Inc.

ticker: IMA


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Muzinich BDC, Inc.


text: Cybersecurity Risk Assessment Cybersecurity is an integral subset of information security and refers to anything intended to protect enterprises and individuals from intentional attacks, breaches, incidents, and consequences. The foundation of this protection begins with identifying the risk of these threats and assessing the controls in place to mitigate such risks. The Company has included cyber threats in its information security risk assessment in accordance with regulatory guidance and conducts a targeted cyber risk assessment using the FFIEC CAT. Utilizing the FFIEC CAT, the Company's inherent risk profile is documented along with its maturity level and effectiveness in managing cyber risk.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. These firms also provide educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.

companyName: Repay Holdings Corp

ticker: RPAY


text: b. Review and monitor impacts, outcomes and remediation plans or mitigation activities related to internal and external security incidents, vulnerability scans or assessments. c. Review and monitor significant information security related projects and regulatory initiatives. d. Monitor metrics related to the Company's information security program.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Our cybersecurity risk management program is supervised by our Director of Information Systems whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes, as well as managing the Company's information security and risk management awareness program.

companyName: ELUTIA INC.

ticker: ELUT


text: We engage independent third party auditors to validate our risk management program. Third party experts assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Cue Health Inc.


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested and audited by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.

companyName: Wingstop Inc.

ticker: WING


text: Our IT department includes staff members who hold certifications in security, networking, and systems administration. This team of qualified professionals works collaboratively to implement and maintain our comprehensive cybersecurity program. Their specialized expertise is supplemented by strategic partnerships with third -party security providers who hold additional industry-recognized certifications such as CISSP, CISM, CEH, and CompTIA Security+.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: The Adviser partners with third parties to assess the effectiveness of our cybersecurity prevention and response policies and procedures. The Adviser utilizes a third party to perform penetration testing once a year. Penetration testing involves scanning the Adviser's internet points of entry and attempting to detect potential vulnerabilities. Remediation is performed, if needed, and a second scan is conducted. Internal penetration testing is performed by a combination of regularly scheduled vulnerability scans and using a third party service for real-time vulnerability management. To assess the capability to maintain operation of its business in the event of serious failure or disruption of essential services located in its primary data center, the Adviser also performs business continuity testing twice a year. See "Item 1A. Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results."

companyName: Silver Point Specialty Lending Fund


text: A key part of our strategy for managing risks from cybersecurity threats is the assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability scanning and other exercises focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties to perform assessments on our cybersecurity measures, including information security penetration tests, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board Operational Risk Committee and are used to adjust our cybersecurity policies, standards, processes and practices, as necessary.

companyName: LendingClub Corp

ticker: LC


text: Our cybersecurity risk management program includes the following elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing: (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external experts, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • cyber/technology errors & omissions insurance; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and assessment of materiality against external reporting requirements; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.

companyName: System1, Inc.

ticker: SST


text: As discussed above, to support its preparedness, Franklin Templeton has an incident response plan that it regularly updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt its network or networks of its vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "We depend on our information systems and those of our third-party collaborators, service providers, contractors or consultants. Our information systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations."

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: Our cybersecurity training and education emphasizes periodic phishing tests and a mandatory training curriculum to assist our employees' awareness of common types of attacks. This includes awareness of phishing, malware, social engineering, and overall security best practices for new and existing employees. We also perform periodic, independent risk assessments that consider four primary areas of risk: physical, digital, social, and administrative/governance.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: Our CISO and his team have also developed processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers who access our information technology systems, which includes leveraging our vendor risk management program designed to assess and manage the cybersecurity risks associated with these partnerships. As part of the program, our governance, risk and compliance team conducts due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: We engage specialized third parties in connection with our risk assessment processes. These third parties assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Further, the Company's internal controls, various threat landscapes, internal events and incidents, and emerging risks are periodically reviewed to make adjustments to the Cybersecurity Program as needed. Additionally, annual risk assessments and penetration tests are performed.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. Leaders of our information technology and device engineering, together with members of our finance team, comprise our Cybersecurity Committee, which meets to assess cybersecurity risks and identify new risks and assess our risk management framework on a quarterly basis. Among the members of this committee are employees who are knowledgeable about our products and systems, have prior experience managing cybersecurity risks, and maintain an active Certified Information Systems Security Professional certification.

companyName: CVRx, Inc.

ticker: CVRX


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to our data and systems, including malware and computer virus attacks. However, such risks and threats have not materially affected our business strategy, results of operations, or financial condition to date.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: Prelude has also established an Incident Response Policy which includes reporting thresholds and follows standardized identification and authentication practices. If an incident is identified, it is documented by Prelude's Head of IT, who in turn, will report the incident to necessary management members.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: Our full Board receives biannual updates on cybersecurity from our Chief Technology and Product Officer (the "CTPO") or head of cybersecurity (the " CISO ") to, among other items, review cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. Our Board also regularly reviews cyber-related risks as part of our enterprise risk management program on a quarterly basis and receives updates from our Internal Audit team on the results of the risk monitoring and mitigation process, as described in more detail above.

companyName: TheRealReal, Inc.

ticker: REAL


text: Data and Consumer Privacy Our data and consumer privacy program monitors, adapts to and works diligently to comply with changes in global privacy legislation. We have implemented technical, procedural and organizational measures designed to comply with applicable data protection and consumer privacy laws. We conduct external benchmarking, as well as privacy compliance audits, to stay abreast of developing privacy laws and understand developing risks, best practices and industry trends.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: The Chief Technology Officer works together with our board of directors, audit committee, and members of executive management ("Cybersecurity Team") to set the strategic digital landscape. The Cybersecurity Team provides strategic guidance and oversight to ensure our cybersecurity posture is robust and aligned with our overall objectives. The Cybersecurity Team does this by establishing cybersecurity policies and setting risk tolerance levels, approving budgets for security initiatives, and ensuring compliance with relevant regulations and standards. The Cybersecurity Team engages in regular and ad hoc discussions regarding incident response strategies to assess the preparedness for cyber threats and continually evaluates our incident response plans. The Incident Response Team ("IRT") is led by the Senior Vice President of Information Technology, who is the overall incident response coordinator. The IRT, under the guidance of the Chief Technology Officer, assesses risk and materiality of an incident and engages members of Cybersecurity Team as needed.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: The Company's cybersecurity program is led by its Chief Information Security Officer (CISO), who reports to its Chief Information Officer (CIO). The CISO is responsible for management of cybersecurity risk and the protection and defense of the Company's networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in incident response, forensics, threat intelligence, vulnerability management, and mitigation. The Company's cybersecurity team has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees, mechanisms to detect and monitor unusual network and endpoint activity, integrated threat intelligence, and containment and incident response tools. The cybersecurity team also leverages multiple third-party security programs for full-time monitoring of security stacks and on-demand support to act as force multipliers in the event of severe or critical security events.

companyName: BOSTON BEER CO INC

ticker: SAM


text: The company maintains a multi-layered approach to cybersecurity risk management which leverages technology and human oversight. The company uses active and passive methods designed to continuously monitor information systems and assess, identify, and manage potential vulnerabilities and threats. This digital-security management process is integrated into the company's broader enterprise risk management framework.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: Our Board of Directors is responsible for overseeing the Company's cybersecurity strategies and setting the acceptable cybersecurity risk appetite as part of its oversight of the Company's risk management activities. The Board has designated the Executive and Risk Committee to oversee the Company's Enterprise Risk Management Program, which includes the framework for identifying, measuring, monitoring and controlling cybersecurity risk. Between updates provided by the Chief Technology Officer and Chief Risk Officer, who leads the Company's Enterprise Risk Management function, the Committee receives quarterly updates over assessed internal and external risks, cyber threats, industry trends in the cyber area, security operations and incident response, threat and vulnerability management activities, identity and access management controls, and the results of third-party audits and examinations. To ensure this focus is properly disseminated, the Enterprise Risk Management Program includes a Management Risk Committee, made up of executive officers, to ensure proper oversight of risk-related decision making and communication by executive management. In addition to internal monitoring procedures, the Company maintains a vendor risk management program that is designed to identify and manage risks, including cybersecurity risks, posed by our third-party vendors, particularly those with access to, or possession of, sensitive information. Vendor contract negotiations require the inclusion of data protection terms and responsibilities regarding information breach notifications and reporting. The program also includes due diligence and risk assessment procedures occurring prior to and during the life of these contractual relationships, to evaluate the vendor's management of data transmission, storage of information, encryption practices, vulnerability testing and general strength of the vendor's information security policy and practices. Additionally, the Company uses a continuous vendor monitoring solution to monitor third-party cyber risk, delivering risk-prioritized action plans customized to match the Company's risk appetite.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: As part of our enterprise risk management ("ERM") program, we maintain a cybersecurity program in an effort to reduce the risk of a breach of our systems or information. Our cybersecurity program includes policies and controls which are regularly reviewed through internal assessments. We have an active HITRUST certification for our expert medical opinion offering and Service Organization Control ("SOC") 2 Type II security compliance reports that are issued by third-party entities for our other offerings. We have controls in place intended to assess our cybersecurity readiness and prevent unauthorized access to our critical systems, including, for example, vulnerability scanning of our systems, detection and blocking of potentially malicious email, multifactor authentication, and security review of our vendors. We also actively engage with the law enforcement community, industry groups, and key vendors to maintain awareness of the evolving threat environment. We have a documented cybersecurity response plan for identification and assessment of cybersecurity incidents, including an escalation process for management to assess the materiality of an incident.

companyName: Accolade, Inc.


text: We use multiple mechanisms to identify risks associated with cybersecurity threats, including but not limited to the following: • Our information security program describes three levels of risk assessment exercises to be performed or obtained on a periodic basis by the Information Security function, ranging from enterprise-level to system-level risk assessments; • Our Information Security function also includes a threat intelligence team that performs continual threat monitoring activities; • Our Business Technology Services function includes teams that provide architectural review, security advisory, and application testing services in connection with the development of new products, applications, and integrations; • Our Internal Audit function performs annual reviews designed to evaluate selected systems' compliance with our information security program and/or recognized external control frameworks; • Independent consultants and auditors evaluate selected systems and applications on an annual basis; and • All team members are empowered to submit self-identified information security risks for analysis by our internal risk management professionals.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: The ISC, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISC's expertise includes a combined 20 plus years of experience in managing security technologies; designing and implementing security strategies; and risk management and incident response across various industries. Our ISC supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Solo Brands, Inc.

ticker: SBDS


text: The IR support team is responsible for the monitoring, prevention, and timely detection, confirmation, mitigation and remediation of information security incidents.

companyName: AdTheorent Holding Company, Inc.


text: We have established processes to identify, assess, and manage material cybersecurity risk, which are fully integrated into our overall enterprise risk management system and processes. These processes include risks related to our use of third-party service providers.

companyName: Santander Holdings USA, Inc.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess, and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company engages a third-party provider to conduct periodic maturity assessments. The Company stores data in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: Our cybersecurity program includes: • a comprehensive cyber education program with ongoing employee cybersecurity awareness and training activities, which include frequent phishing simulation, testing, and ongoing education; • access management and access controls with periodic reviews; • protection of certain data through encryption at rest and in transit; • endpoint and network monitoring and protection software; • sensitive data transmission detection tools; • the engagement of a managed detection and response service which monitors the Company's environment at all times for threats, and in the event of an incident, provides proactive services; • a vulnerability management program that includes identifying and managing the cybersecurity risk associated with third-party service providers, including third-party software, hardware, and network infrastructure; • a dedicated internal cybersecurity team and a cyber incident response plan that provides controls and procedures to support appropriate identification, containment, response, investigation, reporting, and recovery from cybersecurity incidents; • simulated cyber security emergency response readiness scenario training with key IT personnel and executive leadership; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provision into various contracts.

companyName: FOSTER L B CO

ticker: FSTR


text: Cybersecurity and risks related to our information technology and other computer resources are an important focus of our Board of Directors' risk oversight. Our Audit Committee receives materials on a frequent basis to address the identification and status of information technology cybersecurity risks, and management, including our Chief Information Officers (CIO) and Chief Information Security Officers (CISO), provides quarterly updates to our Audit Committee and an annual update to our Board of Directors with respect to cybersecurity matters.

companyName: PULTEGROUP INC/MI/

ticker: PHM


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the CCO of the Advisor regarding the overall state of the Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Kennedy Lewis Capital Co


text: Murphy considers its cybersecurity risk management framework to be a core component of its overall enterprise risk management system. The cybersecurity risk management framework directly aligns with the National Institute of Standards and Technology Cybersecurity Framework and involves regular review and update of security policies and procedures; leverage of industry-leading technologies focused on continuously monitoring, analyzing, and defending against intrusions; regular testing of such technologies and other controls; periodic simulations of security incidents; and constant monitoring of the broader cybersecurity environment for new and emerging threats. The Company also requires employees to attend regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third-party advisors, industry groups and policymakers.

companyName: MURPHY OIL CORP

ticker: MUR


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit Committee each receive periodic reports from our Chief Information Security Officer and Chief Risk Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit Committee provide feedback and recommendations accordingly.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Our cybersecurity program assesses our cybersecurity risk profile through inventories of physical devices, software, and information systems, evaluations of critical third-party systems, and a catalogue of security risks. Periodic assessments are conducted to ensure the risk catalog is up to date.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: The Bank's Information Security Department is led by the Bank's Chief Information Security Officer ("CISO"). The CISO reports to the Chief Information Officer ("CIO"), with an open line of communication to the Bank President. The Bank also has an internal cross functional committee – the internal Technology and Operations Committee –which is responsible for, among other activities, overseeing Information and cyber security risks and the steps taken by management to understand and mitigate such risk. This Committee reports to the Bank's Management Committee.

companyName: Federal Home Loan Bank of New York


text: The Company's Office of the Chief Information Security Officer ("Office of the CISO"), which is responsible for the daily direction and management of cybersecurity risk activities, consists of the Chief Information Security Officer, Chief Information and Digital Officer and other information technology and cybersecurity specialists. The Office of the CISO uses various data protection frameworks and conducts vulnerability assessments, cybersecurity monitoring and recovery software, employee, supplier and dealer training programs and monitoring of incidents and threats. Members of the Office of the CISO also engage with the Company's internal audit department to review cybersecurity threats focusing on operational applications and databases through the course of their activities. The Chief Information Security Officer has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management, and is a Certified Information Security Manager and a Certified Data Privacy Solutions Engineer.

companyName: HYSTER-YALE, INC.

ticker: HY


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Security Committee.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: Risks from Material Cybersecurity Threats Although we have taken steps to prevent and mitigate data security threats, there can be no assurance that our protective measures and those of our third-party service providers will prevent or detect security breaches that could have a significant impact on our business, reputation, operating results and financial condition.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: The Company's information security program encompasses the security policies and procedures in place throughout the enterprise network to address compliance, transaction, reputation, and strategic risks. Our Information Security Officer is primarily responsible for this managing the information security program that includes identifying, assessing, and mitigating cyber threats. Our Information Security Officer reports directly to the Chief Information Officer.

companyName: CITY HOLDING CO

ticker: CHCO


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance that equips them to oversee cybersecurity risks effectively. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework. The CFO reports to the Audit Committee regarding cybersecurity risks and provides a comprehensive briefing to the Audit Committee on a regular basis as needed, with a minimum frequency of once per year. The CFO also maintains an ongoing dialogue regarding emerging or potential cybersecurity risks and cybersecurity incidents.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: As technology and potential cybersecurity threats evolve, we intend to continue to adapt and enhance our cybersecurity controls, procedures, and protections.

companyName: Cyber App Solutions Corp.


text: The Board of Directors, both directly and through the delegation of responsibilities to the AEOC has risk management oversight, which includes the proper functioning of our cybersecurity risk management program. In particular, the AEOC assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Cybersecurity is a critical component of our overall risk management framework and a key area of focus for our Board of Directors and management. Cybersecurity responsibility is shared across the organization, from facility technicians and operators to the members of our Board of Directors. Our Director of Information Technology (IT) has direct responsibility for assessing, monitoring, and managing cybersecurity risks, as well as developing and executing our cybersecurity strategy. The Board of Directors and Audit Committee provide oversight of the Cybersecurity Program.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: The Audit Committee of our Board of Directors has oversight responsibility for our cybersecurity program. Our Chief Financial Officer and Head of Information Technology provide periodic updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee, and provide other information as needed or requested to facilitate the committee's oversight of our cybersecurity risk. The chair of our Audit Committee, who previously founded and for 19 years led an information technology consulting company that specialized in providing software and systems integration, business process and technical consulting to multinational companies, holds a certification in Systemic Cyber Risk Governance for Corporate Directors. Other members of our full Board of Directors, which also receives periodic briefings on cybersecurity matters, also have received professional education and training related to cybersecurity.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Technology Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management ("ERM") program considers cybersecurity risks alongside other company risks as part of a quarterly and ongoing process designed to identify, assess and manage risk exposures over the short-, intermediate- and long-term. In addition, our management-level Information and Technology Risk Oversight Committee ("ITROC"), led by our CISO, and including senior leaders such as our President and COO, CFO and General Counsel, among others, provides oversight relating to cybersecurity and technology-related risks that may present significant impacts to our operations, clients, reputation and financial position, and the considerations of the ITROC are fully incorporated into our overall ERM framework. Our CISO is also a member of the Company's Disclosure Committee and reports to the Disclosure Committee on a quarterly basis on any major cybersecurity incidents.

companyName: MSCI Inc.

ticker: MSCI


text: HCTI employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a dedicated cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis. HCTI's cybersecurity team works in conjunction with the risk management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into HCTI's Enterprise Risk Management process, HCTI's information technology leadership reviews the company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into HCTI's enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: expert input from both public and private partnerships;

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: At least annually we conduct a self-audit of our information security management systems ("ISMS"), in order to identify if there is any non-conformance with our ISMS policies and procedures. The results of the self-audit are reported to our Steering Committee and our external auditor for ISO/IEC 27001 compliance.

companyName: authID Inc.

ticker: AUID


text: Our Board of Directors has ultimate oversight of cybersecurity risk as part of its risk management oversight responsibilities, including with respect to cybersecurity risk priorities, resource allocation and oversight structures. The Board of Directors receives an update on our cybersecurity program on a quarterly basis, or more frequently as determined to be necessary or advisable. The Board of Directors has delegated risk management oversight responsibility for information security and data protection to the Audit & Finance Committee, which regularly reviews our cybersecurity program and related matters with management and reports to the Board of Directors. Topics discussed at the board level include our approach to cybersecurity risk management, key initiatives, the threat landscape and recent developments and trends. The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.

companyName: NIKE, Inc.

ticker: NKE


text: The Company, with the assistance of a third party, has policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We engage third party personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to add internal personnel and further investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Our risk factors, which can found be found in Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. There can be no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Incident responses under our cybersecurity incident response plan are led by our incident response team, consisting of our Chief Executive Officer (the "CEO"), Chief Financial Officer (the "CFO"), General Counsel, head of information technology and head of human resources, and supported by Legal, Compliance and other functions as appropriate. The incident response team, in connection with outside legal and cybersecurity advisors, is responsible for investigating suspected cybersecurity incidents, taking appropriate steps to contain, mitigate or resolve a cybersecurity incident and reporting findings to management. In the event of a cybersecurity incident, our General Counsel is responsible for convening a materiality incident response team to assess the materiality of cybersecurity incidents meeting certain escalation criteria. Through ongoing communications with the incident response team, management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity initiatives. Management provides regular updates to the Audit Committee and the Board concerning the Company's technology and cybersecurity programs, associated risks and our efforts to help mitigate those risks.

companyName: Liquidia Corp

ticker: LQDA


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our current vendor evaluation procedures include, as appropriate, a review of certain vendors' security standards.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CISO and CIO. Our CISO, CIO and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: We review our cybersecurity risk framework and related policies annually with our senior management to help identify areas for continued focus and improvement. We also engage third parties to review and assess our processes annually. Our information security management system has been independently certified as being in conformity with ISO/IEC 27001:2013.

companyName: N-able, Inc.

ticker: NABL


text: In addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates. We leverage internal auditors and third-party consultants to periodically review the processes, systems, and controls underlying our ISP and assess their design, operating efficacy, and program maturity, as well as to make recommendations to enhance their currency and effectiveness.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: Our Chief Information Security Officer ("CISO") is responsible for Marqeta's information security posture and cybersecurity program. We believe our CISO is qualified to assess and manage our material risks from cybersecurity threats based on over 15 years of cybersecurity and risk management expertise as a security and risk management leader at various public and private companies and as a cyber threat intelligence analyst for a branch of the United States military. Our CISO reports to our Chief Technology and AI Officer and oversees a team of cybersecurity professionals in areas including Governance, Risk, and Compliance, Product and Infrastructure Security, Security Operations, and Identity Security.

companyName: Marqeta, Inc.

ticker: MQ


text: The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed.

companyName: Envista Holdings Corp

ticker: NVST


text: In addition, our internal audit function, in conjunction with third-party experts, plays a key role in reviewing and assessing our cybersecurity technologies, controls and procedures. Our security programs and measures may not prevent all incidents or intrusions and our systems and insurance coverage for protecting against cyber security risks may not be sufficient. As cybersecurity risks continue to evolve, we may be required to expend additional resources to continue to modify or enhance our protective measures or to investigate and remediate any vulnerability to cyber incidents or intrusions. Laws and regulations governing cybersecurity, data privacy, and the unauthorized disclosure of confidential or protected information pose increasingly complex compliance challenges, and failure to comply with these laws could result in penalties and legal liability. Our insurance coverage for cyberattacks may not be sufficient to cover all the losses we may experience as a result of such cyberattacks.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK